topic Re: ISE Apple-iphone guest authentication problem in Network Access Control

ISE Apple-iphone guest authentication problem

mzarli — Wed, 10 Jul 2024 12:35:17 GMT

problem with iPhone guest authentication with cisco ISE as

while we use the Wifi Guest SSID the redirection page opens for a second then

suddenly closes, while we've android phones and IPads that authenticate normally.

ISE 3.3 Patch 2
WLC 9800-L

does anyone have an Idea ? or faced the same issue ?
Cisco TAC Case already opened

@Greg Gibbs

Re: ISE Apple-iphone guest authentication problem

Mark Elsen — Wed, 10 Jul 2024 15:37:45 GMT

- As far as the wireless part is concerned :
Have a checkup of the WLC 9800-L configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

- Also look into : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA

- Further engage in full client debugging according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

- Outputs from the commands mentioned in https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5 can also be useful

- Check software version on the WLC 9800-L ; go for latest advisory = 17.12.3

Re: ISE Apple-iphone guest authentication problem

mzarli — Fri, 12 Jul 2024 07:06:01 GMT

Thank you for your suggestions and guidance.

Unfortunately, the steps you provided did not resolve the issue. We have also tested with a WLC 5520, and the problem persists.

Re: ISE Apple-iphone guest authentication problem

Mark Elsen — Fri, 12 Jul 2024 07:16:32 GMT

- Then try to do the full client debugging on the 5520 too ; feed that into Wireless Debug Analyzer (too)
Compare the session with the full debug on the 9800
For the 5520 go 8.10.196.0 (if needed) and try again

Re: ISE Apple-iphone guest authentication problem

mzarli — Fri, 12 Jul 2024 07:26:56 GMT

We suspect that the issue might be related to the process of the captive portal on Apple devices. Do you have any recommendations to address this specific problem?

Re: ISE Apple-iphone guest authentication problem

Mark Elsen — Fri, 12 Jul 2024 07:37:20 GMT

- Since the problem remains the same on both controller platforms (9800 ios-xe and 5520 with aireos) , it seems a 'local apple' problem indeed ; you could for instance post the problem in :
https://discussions.apple.com/

Re: ISE Apple-iphone guest authentication problem

MHM Cisco World — Fri, 12 Jul 2024 11:51:28 GMT

Yes I think I have answer here

What is type of CoA ypu use do ypu use interface bounce host port ? If not use it and check

MHM

Re: ISE Apple-iphone guest authentication problem

mzarli — Fri, 12 Jul 2024 11:56:30 GMT

Thank you for answer.
would you please provide more details ?

Re: ISE Apple-iphone guest authentication problem

Wavetek75 — Thu, 26 Mar 2026 18:34:01 GMT

We are currently experiencing the same issue, even after upgrading our controller to a 9800. Basically, the issue is only being seen on IOS and MacOS devices, where the guest portal will pop up, but you get a "Error Opening Page Hotspot login cannot open the page because the server cannot be found." Androids, Windows PC, and other devices work fine.

Re: ISE Apple-iphone guest authentication problem

mzarli — Thu, 02 Apr 2026 07:02:25 GMT

the issue was related to the third-party certificate used for the Guest Portal.

I had to unassign and reassign the certificate to the Portal Group, which resolved the problem.

I was able to identify the root cause by performing a packet capture on an iPhone device, where I detected an SSL issue during communication with the portal.

Please let me know if you need any further details.

Re: ISE Apple-iphone guest authentication problem

Wavetek75 — Thu, 02 Apr 2026 15:04:53 GMT

Thanks. We will give that solution a try and see if that helps.