topic mini-browser cannot popup automatically in MacOS(Aruba+ISE) in Network Access Control

mini-browser cannot popup automatically in MacOS(Aruba+ISE)

yongwli — Thu, 14 Sep 2017 08:22:16 GMT

Hi Experts,

We are doing guest portal testing, ISE need to work with Aruba wireless. After done configuration, we found mini-browser cannot popup automatically in MacOS. If we launch browser manually, it can redirect to ISE guest portal and login guest network.

I did wireshark traffic capture, found Aruba redirect MacOS request correctly, but mini browser cannot popup automatically.

It looks like because ISE is using private certificate, but not sure mini-browser require public certificate or not.

Does anyone done this test before? do we support mini-browser popup automatically and any suggestion?

Thanks

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

Jason Kunst — Thu, 14 Sep 2017 13:32:37 GMT

Aruba maybe suppressing this mini-browser. This is up to the controller and not something configurable on ISE. ISE only sends down an named ACL.

ISE supports the minibrowser if it pops up since ISE 2.2

Perhaps CNA bypass is enabled on the aruba side?

http://community.arubanetworks.com/t5/Controller-Based-WLANs/What-config-on-Aruba-is-needed-to-Bypass-Apple-Captive-Network/ta-p/170040

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

yongwli — Thu, 14 Sep 2017 15:01:25 GMT

CNA has been disabled in Aruba side, we found client cannot complete ssl handshake with ISE via mini-browser. If use other browser safari/firefox, it's OK. Comparing ssl server hello packets between two scenario, did not find Aruba modified ssl packets.

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

Jason Kunst — Thu, 14 Sep 2017 23:29:33 GMT

Assuming you’re using ISE 2.2?

I have used self-signed certs with mini browser and guest and worked fine on apple ios but haven’t tried my MAC recently

I would suggest to move forward with TAC case to further troubleshoot.

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

yongwli — Mon, 18 Sep 2017 10:49:11 GMT

Hi Jason,

Did you use Aruba WLC in your test? If yes, do you have configuration for reference? and what version?

Thanks

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

Jason Kunst — Mon, 18 Sep 2017 16:42:22 GMT

No, please work with the tac and Aruba team

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

casanavep — Tue, 02 Oct 2018 12:53:56 GMT

Yeah, this is obviously well documented at this point. ISE authentication that invokes Apple CNA has been broken on all versions of ISE, to include 2.2, 2.3, and 2.4. Closing the CNA popup (AKA mini-browser) and opening Safari or another browser on iOS devices will allow for successful onboarding / login experiences. This appears to have begun to be an issue around iOS 11.3 - 11.6 and remains an issue all the way to iOS 12. Several bug IDs have been generated over the last year without a "fixed-in" release to date. All work-arounds to date are related to making changes to suppress the Apple CNA trigger on the users' iOS devices, which is obviously not viable on guest and large venue environments. We have been able to reproduce this, with Cisco ISE engineers onsite, both on ISE 2.3 patch 5 and ISE 2.4 patch 3. I should add, the break appears to be on the Apple CNA side, but the ownership for driving Apple to a fix also fall on Cisco, given the Apple/Cisco advertised enterprise relationship that both companies tout. I am sure they will work this out, but being that it has been a year, things aren't looking satisfactory for either company's efforts.

Re: mini-browser cannot popup automatically in MacOS(Aruba+ISE)

Jason Kunst — Tue, 02 Oct 2018 13:12:21 GMT

Please make sure customers also escalate thru Apple. Will push through from Cisco side