topic Re: Web-auth redirect not working in Wireless

Web-auth redirect not working

bgp.ripe901 — Mon, 05 Jul 2021 17:49:21 GMT

When i connecting in my SSID, no automatic redirect to https://1.1.1.1/

But when i enter url https://1.1.1.1 with my hands everything is ok working !

WLC-5508 - software: 8.0.152.0

My config:

WLAN Identifier.................................. 16
Profile Name..................................... Guest-WEB
Network Name (SSID).............................. Guest-WEB
Status........................................... Enabled

Web Based Authentication...................... Enabled
Web Authentication Timeout.................... 300
IPv4 ACL........................................ web-acl
IPv6 ACL........................................ Unconfigured
Web-Auth Flex ACL............................... Unconfigured
Web Authentication server precedence:
1............................................... ldap
2............................................... local
3............................................... radius
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled

(Cisco Controller) show>custom-web wlan 16

WLAN ID: 16
WLAN Status................................... Enabled
Web Security Policy........................... Web Based Authentication
Global Status................................. Enabled
WebAuth Type.................................. Internal

###

WLC -> Management -> HTTP-HTTPS

HTTP-HTTPS Configuration:

HTTP Access - Disable
HTTPS Access - Enabled
WebAuth SecureWeb - Enabled
HTTPS Redirection - Enabled
Web Session Timeout - 30 Minutes

My Preauthentication ACL :

(Cisco Controller) show>acl detailed web-acl

Source Destination Source Port Dest Port
Index Dir IP Address/Netmask IP Address/Netmask Prot Range Range DSCP Action Counter
------ --- ------------------------------- ------------------------------- ---- ----------- ----------- ----- ------- -----------
1 Any 0.0.0.0/0.0.0.0 10.0.253.20/255.255.255.255 17 0-65535 53-53 Any Permit 468
2 Any 10.0.253.20/255.255.255.255 0.0.0.0/0.0.0.0 17 53-53 0-65535 Any Permit 466
3 Any 0.0.0.0/0.0.0.0 10.1.254.20/255.255.255.255 17 0-65535 53-53 Any Permit 2
4 Any 10.1.254.20/255.255.255.255 0.0.0.0/0.0.0.0 17 53-53 0-65535 Any Permit 2
5 Any 0.0.0.0/0.0.0.0 1.1.1.1/255.255.255.255 Any 0-65535 0-65535 Any Permit 0
6 Any 1.1.1.1/255.255.255.255 0.0.0.0/0.0.0.0 Any 0-65535 0-65535 Any Permit 9159

DenyCounter : 12069

Full config in attachment.

Re: Web-auth redirect not working

bgp.ripe901 — Wed, 07 Aug 2019 13:34:08 GMT

ip: 10.0.253.20/10.1.254.20 - my private DNS

Re: Web-auth redirect not working

patoberli — Wed, 07 Aug 2019 14:31:41 GMT

Do NOT use 1.1.1.1, that IP belongs to the company Cloudflare.

Use 192.168.x.x and it should start working.

Re: Web-auth redirect not working

bgp.ripe901 — Wed, 14 Aug 2019 09:09:22 GMT

I change Virtual ip to 192.0.2.1 and reboot WLC. But web-redirect not working !

Re: Web-auth redirect not working

patoberli — Wed, 14 Aug 2019 12:30:56 GMT

What happens on the client?

Can you use a Windows based client with a real browser for testing?

Do you get a warning message?

Also add a DNS name pointing to the IP and I suggest to also get a public signed certificate for that name (or mobile phones will have issues/not connect) to the IP/name.

One more thing to check, does the client get a correct IP address?

The output of the logfile seems wrong to me, but I might be wrong.

Re: Web-auth redirect not working

bgp.ripe901 — Wed, 14 Aug 2019 13:35:31 GMT

Safari empty in the browser !
when i turn on url https://192.0.2.1 - WLC portal loading ok !
there is no warning either!
I created in DNS new A record: web-portal.
By name, it also loads normally! But you need to indicate it with your hands

Re: Web-auth redirect not working

patoberli — Wed, 14 Aug 2019 14:14:23 GMT

Have you enabled the following command:
config network web-auth captive-bypass enable

Also have you updated the ACL with the new IP address?

Re: Web-auth redirect not working

bgp.ripe901 — Thu, 15 Aug 2019 13:11:57 GMT

My config :

Web Auth CMCC Support ...................... Disabled
Web Auth Redirect Ports .................... 80
Web Auth Proxy Redirect ................... Enable
Web Auth Captive-Bypass .................. Enable
Web Auth Secure Web ....................... Enable
Web Auth Secure Redirection ............... Enable

and my acl:

permit ALL DNS Number of hits
permit 0.0.0.0/0.0.0.0 192.0.2.1/255.255.255.255 Any Any Any Any Any 0
permit 192.0.2.1/255.255.255.255 0.0.0.0/0.0.0.0 Any Any Any Any Any 1115

But ! Not working redirect !

Testing on Windows client, in attach !

Re: Web-auth redirect not working

patoberli — Thu, 15 Aug 2019 14:01:06 GMT

Sorry I'm not sure if I can help you any further.

I know that some clients require a valid certificate and the redirect must go to the URL (not IP address), but I think Windows 7 didn't require that.

What surprises me is the really weak wi-fi signal, but I don't think that is the reason for the guest-portal not working correctly.

Can you compare your settings (mostly the SSID ones) with those here:

https://rscciew.wordpress.com/2014/06/19/wlc-webauth-configuration/ (don't use the suggested IP written there, keep 192.0.2.1)

Maybe try it without an ACL for testing?

Alternative to the above link:

1. Under WLAN settings, configure the following
Security -> Layer 2 -> {Security Type WPA+WPA2} {WPA+WPA2 Paramters: WPA enabled, WPA2 Enabled}{Authentication Key Management: PSK}{PSK: Your Password}
Security -> Layer 3 -> {Layer 3 Security: Web Policy}{Webauth type: Passthrough}

Re: Web-auth redirect not working

bgp.ripe901 — Thu, 15 Aug 2019 14:29:15 GMT

When i disable pre-ACL, redirect and internet not working ! And https://192.0.2.1 not working !

Re: Web-auth redirect not working

bgp.ripe901 — Tue, 20 Aug 2019 14:03:36 GMT

HELP me !

Re: Web-auth redirect not working

edrayer01 — Tue, 29 Oct 2019 20:07:02 GMT

I'm having the same issue on 8.0.152.0. Did you find a fix for this?

Re: Web-auth redirect not working

N9Kway — Thu, 05 Dec 2019 00:22:24 GMT

If your controller does not have a valid SSL certificate you need to change Web Auth redirect URL to be non-https so web users dont get ssl warning.

(Cisco Controller) config> network web-auth secureweb disable

or you usually may change SSL setting via WLC web interface:

----> Go to MANAGEMENT on the top menu on the top menu and then click on HTTP-HTTPS on the left-hand side menu.
----> Under WebAuth SecureWeb use the drop down box to select:

Disabled: If your controller does not have a valid SSL certificate
Enabled: If your controller has a valid SSL certificate

Re: Web-auth redirect not working

Marc0 — Wed, 22 Apr 2020 20:51:32 GMT

im having similar issues however I’m setting my re-direct to my ISE box.

The issue I’m expecting is where my windows 10 device is connect to the guest SSID but it is not auto loading a web page with the re-direct url.

The WLC is on code 8.3.113 and ISE on 2.3(patch 4)

Re: Web-auth redirect not working

d.friday — Wed, 22 Apr 2020 21:03:30 GMT

Can you log into the CLI and do a client debug and post it here
The command is
Client debug " mac address of the client goes here"
Once the debug command is ran please have the client try and join the SSID and past the debug results here

Re: Web-auth redirect not working

Marc0 — Thu, 23 Apr 2020 12:36:06 GMT

Update:

My laptop is now able to connect to the SSID and a web browser automatically is displayed with the url for the portal, but displayed with an error that is 'site cant be reached'

DNS record is in place stating the url name of the ISE server ip address.

WLC has acl rule in place allowing UDP/DNS and TCP8443 to ISE server

@Marc0 wrote:
Hi

im having similar issues however I’m setting my re-direct to my ISE box.
The issue I’m expecting is where my windows 10 device is connect to the guest SSID but it is not auto loading a web page with the re-direct url.

The WLC is on code 8.3.113 and ISE on 2.3(patch 4)

Re: Web-auth redirect not working

patoberli — Thu, 23 Apr 2020 12:55:22 GMT

Can you nslookup the name on the client and check if it can resolve the hostname correctly? Can you then also check if you can manually open the website?

Typically the clients want to use tcp/443 and not 8443, but not sure with the ISE.

Re: Web-auth redirect not working

Marc0 — Thu, 23 Apr 2020 13:50:55 GMT

so nslookup is resolving to the correct IP address, of the server and not a virtual address ie 2.2.2.2 for example.

Have looked at ISE to see if I can change the portal to be tcp/443 only and its design to be tcp 8000 - 8999, so have left it on 8443

Re: Web-auth redirect not working

patoberli — Thu, 23 Apr 2020 14:26:22 GMT

But you do use a private address, or a public address assigned to your company?

For example 1.1.1.1 will often not anymore work.

Can you telnet x.x.x.x 8443 to test if the connection opens?

Here some information about the logging files on the ISE in regards to guest portal (that is, if the telnet works):
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/212594-debugs-to-troubleshoot-on-ise.html#anc35

If the telnet doesn't work, then the ACL might still be blocking the access, or something similar.

Re: Web-auth redirect not working

Marc0 — Thu, 23 Apr 2020 15:11:24 GMT

We use private addressing.

Ive tried telnet and its failing so im seeing how I go about enabling it on the ISE unit.

FYI

My setup is both WLC and ISE sitting inside my network and not in the DMZ like most models would refer to.