topic WLC 9800: detectportal.firefox and gstatic.com without HTTPS in Wireless

WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Bolivar — Tue, 26 Jul 2022 13:21:19 GMT

Hello,
I'm using the Cisco Catalyst 9800-CL Wireless Controller, with Web Auth and captive portal. The captive portal is hosted on an external server, within my network, with https.

on some devices, when I try to access the internet, I am redirected to the captive portal, using https, as it should.
However, in some cases I am redirected to portals like detectportal.firefox and gstatic.com (depending on browser) , which use http (no security).
Is there any way to force the use of the correct portal, ie the portal with https?

Thank you in advance for your help

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Mark Elsen — Tue, 26 Jul 2022 14:07:08 GMT

- For starters have a review the 9800-CL configuration with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Bolivar — Tue, 26 Jul 2022 15:44:02 GMT

Thanks for the tip. I found and fixed some bugs, as well as adjusting some best practice tips.
However, nothing related to the problem I'm facing

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Mark Elsen — Tue, 26 Jul 2022 16:19:52 GMT

- Make sure the destination portal offers (secure) https access as default , and or disable simple http access (if configured)

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Bolivar — Tue, 26 Jul 2022 17:01:37 GMT

The external captive portal page is configured to operate with https. It is an apache server. That part is working without problems.

I noticed that the problem occurs in two cases:

1st when the captive portal "default" (detectportal.firefox or gstatic.com) is opened in the browser, with http;

2nd when the user tries to access a website with https, before authentication. In this case, the request is forwarded to Cisco's default captive portal, from wlc controller, without https.

When trying to access any website that uses http, I am correctly redirected to the secure captive portal (external with https)

Here at the institution, we have a WLC 5500 series, which works correctly for all cases. Besides the version, another difference is that the older wireless cisco controller is physical while the new one (wlc 9800) is virtualized (KVM).

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Rich R — Wed, 27 Jul 2022 16:48:47 GMT

@Bolivar please clarify?
You say it does NOT work for http captive portal requests to detectportal.firefox or gstatic.com but then you say "When trying to access any website that uses http, I am correctly redirected to the secure captive portal (external with https)" which contradicts that!
Is your apache server using a valid public certificate with matching fully qualified domain name?
Does your WLC also have a valid DNS name and cert installed?

Note that http URLs for captive portal detection and redirection are the ONLY way to reliably trigger a captive portal redirection without security/cert warnings or outright failure as some OS/browsers will now block invalid https redirects altogether without any warning. That is the industry standard now, used by all major browsers and OS on all devices. Trying to block that will break the service or at least make it a horrible experience for most users.

Re: WLC 9800: detectportal.firefox and gstatic.com without HTTPS

Bolivar — Wed, 27 Jul 2022 21:30:33 GMT

Thanks for your reply.

"Is your apache server using a valid public certificate with matching fully qualified domain name?"
Yes, the certificate was signed by the same CA of other services that we already use in the institution.

"Does your WLC also have a valid DNS name and cert installed?"
Yup. Registered in the institutional DNS server

When I try to access an http page, I am correctly redirected to the captive secure portal page. On the other hand, in some cases, where the access attempt (before authentication) is performed through a website with https (example: https://www.google.com), I am redirected to detectportal.firefox or gstatic.com .

To work around this problem, I added a static page, which has the sole purpose of forcing redirection to another page with http. On the other hand, when being redirected to a non-secure page (with http) the WLC manages to redirect me to the correct captive portal (with https).

Here in Brazil, we call this type of procedure a "gambiarra". I believe in English it's "jerry-rig"