topic Re: Web Authentication Error WLC2504 8.2.166 in Wireless

Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Tue, 07 Dec 2021 02:05:02 GMT

We are experiencing issue with Chrome and Edge browser where guests are not able to see the login page.

Firefox is working fine as the advance option is visible. Clicking the "Advanced" then it will redirect to the login page seems to be the workaround.

Anyone experiencing the same issue and what is the solution?

Thanks

Re: Web Authentication Error WLC2504 8.2.166

patoberli — Tue, 07 Dec 2021 10:32:59 GMT

Very old software on the WLC, out of support since a while.

Regardless, what is the IP address of your virtual interface?

Re: Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Tue, 07 Dec 2021 10:37:10 GMT

hi,

my virtual interface ip is 1.1.1.1

Does upgrading the software to 8.2.170 or 8.3 fixes the issue?

Thanks

Re: Web Authentication Error WLC2504 8.2.166

Haydn Andrews — Tue, 07 Dec 2021 11:13:16 GMT

need a public certificate on installed for the webauth portal

Re: Web Authentication Error WLC2504 8.2.166

patoberli — Tue, 07 Dec 2021 11:48:13 GMT

No, this is a safety feature of newer Chrome based browsers. You need to change your virtual interface IP Address to a private one, for example 192.0.2.254.

Re: Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Tue, 07 Dec 2021 19:29:18 GMT

Hi Patoberli,

Thanks, will give this a try and let you know. Will this need to be done after hours or can be done during business hours without breaking any connection?

Cheers

Re: Web Authentication Error WLC2504 8.2.166

Rich R — Wed, 08 Dec 2021 17:04:40 GMT

1. @patoberli - if by private you mean RFC1918 then 192.0.2.254 is not! https://datatracker.ietf.org/doc/html/rfc1918

2. Like @Haydn Andrews says you should use a public cert with a resolvable DNS name for your IP which matches your cert.

Even if you do that you can still see cert errors because that's an unavoidable effect of browser security and all web sites switching to https. So the only way to avoid that is to access a http site then the redirect will not trigger cert errors/warnings. http://neverssl.com is a good one to use. All modern browsers and OS already use http captive portal detection for exactly this reason.

eg: https://support.mozilla.org/en-US/kb/captive-portal uses http://detectportal.firefox.com/canonical.html

Re: Web Authentication Error WLC2504 8.2.166

patoberli — Wed, 08 Dec 2021 23:14:45 GMT

I don't remember it, but I think there was something about a reboot involved, but I tend to say no.
Important, if you need to reboot, read this first (you should read this anyway): https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html and implement the workaround before you reboot.

Re: Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Wed, 08 Dec 2021 23:43:54 GMT

The MIC in WLC will expire on 2025.

Certificate Name: Cisco SHA1 device cert

Subject Name :
C=US, ST=California, L=San Jose, O=Cisco Systems, CN=AIR-CT2504-K9-dceb94954f80, emai lAddress=support@cisco.com
Issuer Name :

--More-- or (q)uit
O=Cisco Systems, CN=Cisco Manufacturing CA
Serial Number :
66EFC96400000009E09D
Validity :
Start : Jul 20 06:03:16 2015 GMT
End : Jul 20 06:13:16 2025 GMT
Signature Algorithm :
sha1WithRSAEncryption
Hash key :
SHA1 Fingerprint : 4f:04:96:90:c3:63:1e:27:53:df:90:31:90:62:6f:8b:69:34:f0:e3
MD5 Fingerprint : 64:5e:d6:04:ac:f1:77:27:24:6a:49:7f:b1:d2:30:ca

Re: Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Thu, 09 Dec 2021 00:06:37 GMT

Hi,

Changed the virtual IP to 192.0.2.254 didn't work for me. Strange the certificate details still is pointing to 1.1.1.1

I have attached the capture for reference.

Re: Web Authentication Error WLC2504 8.2.166

Dirt_Devil — Thu, 09 Dec 2021 00:47:36 GMT

I have regenerated a new certificate from WLC but still doesn't work. Steps below.

Security>Web Auth>Certificate>Regenerate Certificate>Reboot WLC

Re: Web Authentication Error WLC2504 8.2.166

Haydn Andrews — Thu, 09 Dec 2021 01:25:22 GMT

needs to be a public cert, not a self signed certificate.

Re: Web Authentication Error WLC2504 8.2.166

Rich R — Thu, 09 Dec 2021 02:09:28 GMT

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

Re: Web Authentication Error WLC2504 8.2.166

patoberli — Thu, 09 Dec 2021 08:41:58 GMT

@Rich R Based on this newer RFC it is reserved for “documentation” purposes:
https://datatracker.ietf.org/doc/html/rfc5737

Re: Web Authentication Error WLC2504 8.2.166

Rich R — Thu, 09 Dec 2021 10:20:23 GMT

Noted thanks @patoberli but the RFC (which is still draft not standard) does say

These blocks are not for local use

so they should not actually be deployed in networks, even privately.

But granted that using them in the same way as RFC1918 is unlikely to cause any problems within a private network.

Regardless of that the problem here is with the cert not the IP - it needs a resolvable DNS name with a matching PUBLIC (not self signed) cert.