topic Re: Xiaomi problem with external captive portal. in Wireless

Xiaomi problem with external captive portal.

felipemoretti — Mon, 05 Jul 2021 18:01:12 GMT

I'm with a problem between Xiaomi and external captive portal (+ external RADIUS), the wlc isn't processing back the requisition.

My virtual interface address is 1.2.3.4 (for avoid troubles with cloudfare for example), and in callback moment that the application (external captive portal) send back to wlc the packet nothing happens, only connection refuse error like show bellow:

What was to happen is the controller (wlc) process back the requisition, send to radius a authentication package, the radius response with ok, the controller generates a accounting package and allow internet to device.

In anothers vendors like motorola, samsung (and others) this error don't happens (all this process work perfectly). Anyone know how i can solve this problem?

Re: Xiaomi problem with external captive portal.

jonathga — Tue, 17 Sep 2019 14:31:38 GMT

Hello Felipe, could you check if you are not able to get the web auth login page from different web browsers? just open the browser an go to http://1.2.3.4/login.html

Re: Xiaomi problem with external captive portal.

felipemoretti — Tue, 17 Sep 2019 16:30:21 GMT

Hey Jonathga, thanks for your reply, i'll try what you suggest...

Re: Xiaomi problem with external captive portal.

felipemoretti — Thu, 19 Sep 2019 12:46:09 GMT

Jonathga, sorry for the delay in responding, trying open in Chrome browser the address http://1.2.3.4/login.html i got the same error.
Any ideia?

Re: Xiaomi problem with external captive portal.

jonathga — Thu, 19 Sep 2019 14:47:40 GMT

Hello Felipe, could you please paste the output of show certificate summary and show network summary from the WLC.

Re: Xiaomi problem with external captive portal.

felipemoretti — Thu, 19 Sep 2019 17:31:58 GMT

Sure! Can you tell me the path for this informations?

Re: Xiaomi problem with external captive portal.

jonathga — Thu, 19 Sep 2019 18:27:49 GMT

What's your WLC model?

Re: Xiaomi problem with external captive portal.

felipemoretti — Thu, 19 Sep 2019 19:55:01 GMT

Re: Xiaomi problem with external captive portal.

jonathga — Thu, 19 Sep 2019 21:57:02 GMT

Hello Felipe, SSH to the WLC then enter the commands that I mentioned before.

Re: Xiaomi problem with external captive portal.

felipemoretti — Fri, 20 Sep 2019 18:33:35 GMT

(Cisco Controller) >show certificate summary
Web Administration Certificate................... 3rd Party
Web Authentication Certificate................... 3rd Party
Certificate compatibility mode:.................. off
Lifetime Check Ignore for MIC ................... Disable
Lifetime Check Ignore for SSC ................... Disable

(Cisco Controller) >show network summary

RF-Network Name............................. LOJAO
DNS Server IP...............................
Web Mode.................................... Enable
Secure Web Mode............................. Enable
Secure Web Mode Cipher-Option High.......... Disable
Secure Web Mode SSL Protocol................ Disable
Web CSRF check.............................. Enable
OCSP........................................ Disabled
OCSP responder URL..........................
Secure Shell (ssh).......................... Enable
Secure Shell (ssh) Cipher-Option High....... Disable
Telnet...................................... Disable
Ethernet Multicast Forwarding............... Disable
Ethernet Broadcast Forwarding............... Disable
IPv4 AP Multicast/Broadcast Mode............ Multicast Address : 225.225.224.2 24
IPv6 AP Multicast/Broadcast Mode............ Multicast Address : ::
IGMP snooping............................... Disabled
IGMP timeout................................ 60 seconds
IGMP Query Interval......................... 20 seconds
MLD snooping................................ Disabled
MLD timeout................................. 60 seconds

Re: Xiaomi problem with external captive portal.

patoberli — Mon, 23 Sep 2019 15:18:03 GMT

Two things, try to enable this:
- Secure Web Mode Cipher-Option High.......... Disable (on the GUI under Management - HTTP HTTPS). You need to reboot the WLC after this change.
- Update to the latest 8.3 release (although I don't think this will solve this specific issue, but it helps in general)

Re: Xiaomi problem with external captive portal.

felipemoretti — Tue, 24 Sep 2019 18:44:27 GMT

Hello Patoberli, thanks for your reply.
The chiper-option high was already disabled and the update cannot be done now.
Another suggestion?

Re: Xiaomi problem with external captive portal.

patoberli — Wed, 25 Sep 2019 06:23:28 GMT

I wrote "enable cipher-option high" 🙂
Also it's suggested to change the IP to a real private one, like from the range: 192.0.2.0/24