topic Re: IOS is not redirecting to the BYOD portal. in Network Access Control

IOS is not redirecting to the BYOD portal.

JustTakeTheFirstStep — Thu, 08 Feb 2024 02:51:35 GMT

I'm testing BYOD.

WINDOWS and ANDROID can be redirected to the BYOD portal.

However, IOS is not redirected to the portal.

Are there any URLs I should add to the URL filter?

I've followed a combination of guides, but I'm not sure if what I've set up is correct.

Re: IOS is not redirecting to the BYOD portal.

Greg Gibbs — Thu, 08 Feb 2024 03:23:26 GMT

With captive bypass enabled, you would have to manually open a browser on the IOS device and browse to an HTTP page (like http://neverssl.com).

When you do so, it should redirect you to the ISE BYOD portal.

Re: IOS is not redirecting to the BYOD portal.

Arne Bier — Thu, 08 Feb 2024 03:37:09 GMT

Oh the wording in the IOX-XE GUI is probably not helpful. Does "Captive Bypass Portal" ticked mean that the CNA (Captive Networking Assistant from iOS) is being bypassed? In other words, "Captive Portal bypass" ? If so, then untick that. You don't want to bypass the iOS CNA. The CNA is like a "mini browser" that the iOS uses for open ssid logins.

If you bypass the CNA, then the user is not redirected automatically. They will have to trigger a manual re-direction by opening a browser to http://1.1.1.1/ or whatever.

Re: IOS is not redirecting to the BYOD portal.

Ruben Cocheno — Thu, 08 Feb 2024 03:48:43 GMT

@JustTakeTheFirstStep

if Bypass the CNA, you will need to trigger a manual redirect browsing a URL (e,g www.cocheno.com)

Re: IOS is not redirecting to the BYOD portal.

Greg Gibbs — Thu, 08 Feb 2024 04:46:23 GMT

The Apple CNA causes many issues with portal flows like BYOD, so it's best practice to have the Captive Portal Bypass enabled and train your users to manually open a browser for the redirect.

With IOS, if you disable the bypass option on the SSID, you will likely get a message from the BYOD portal (served up from the CNA) stating that the browser is not supported.

Re: IOS is not redirecting to the BYOD portal.

Arne Bier — Thu, 08 Feb 2024 05:13:53 GMT

Oh yes of course. This is BYOD and not Guest Portals. Not a pretty workflow for iOS then.

Re: IOS is not redirecting to the BYOD portal.

JustTakeTheFirstStep — Tue, 13 Feb 2024 03:44:22 GMT

@Arne Bier @Greg Gibbs @Ruben Cocheno

Adding gstatic.com to the URL Filter and attempting to access the internet from a Chrome browser redirects to the BYOD Portal.

The redirect to BYOD Portal succeeds regardless of whether Captive Portal Bypass is enabled/disabled on the controller.

When press Start in the BYOD portal on a Chrome browser, show the message "This browser is not currently supported"

However, it does not redirect to the BYOD Portal in Safari browser.

What do I need to do?

Re: IOS is not redirecting to the BYOD portal.

Greg Gibbs — Tue, 13 Feb 2024 03:56:54 GMT

@JustTakeTheFirstStep , the URLs defined in URL filter defines what traffic will be exempted from redirection. If you want the redirect to happen when the browser is directed to 'gstatic.com' then you would not want that defined in the URL filter.

The expected behaviour (and what I see in my lab with my iPad [OS 17.2] and ISE 3.2 is the following:

With captive portal bypass disabled, the redirect happens and the ISE portal returns the error 'This browser is not currently supported'
With capture portal bypass enabled, after the initial SSID connection, the user must manually open a browser and input a URL that initiates the redirect (I use 'http://neverssl.com' as HTTPS redirects can be problematic). At that point the redirect happens and the BYOD enrolment flow can be followed.

Re: IOS is not redirecting to the BYOD portal.

JustTakeTheFirstStep — Tue, 13 Feb 2024 05:27:30 GMT

@Greg Gibbs

Removed gstatic.com from the URL filter.

Wich Captive portal bypass disabled,

not automatically ridirected. manually opened the browser and entered the URL to start the redirect. show the message "This browser is not currently supported"

Wich Captive portal bypass enabled,

manually opened the browser and entered the URL to start the redirect. show the message "This browser is not currently supported"

Re: IOS is not redirecting to the BYOD portal.

Greg Gibbs — Tue, 13 Feb 2024 21:29:32 GMT

I can't replicate this issue in my lab (which is using an AireOS WLC). You might need to open a TAC case to investigate in more detail.