topic Re: Web-auth not automatically redirecting in Wireless

Web-auth not automatically redirecting

vikas01234das — Fri, 11 Nov 2022 16:55:55 GMT

When i connecting in my SSID, no automatic redirect to https://1.1.1.1/ But when i enter url https://1.1.1.1 with my hands everything is ok working !

1) ipconfig - correct

2) DNS resolving - correct

3) WLC-> controller -> interface -> Virtual -> ip address - 1.1.1.1 and DNS Host Name -> Empty

4) When i reboot WLC - web-auth redirect not working.

Re: Web-auth not automatically redirecting

Mark Elsen — Fri, 11 Nov 2022 18:09:13 GMT

- FYI -> https://community.cisco.com/t5/wireless/1-1-1-1-is-no-more-recommended-as-a-virtual-ip/td-p/3831937

Re: Web-auth not automatically redirecting

vikas01234das — Sat, 12 Nov 2022 04:21:26 GMT

Changed the virtual ip address to 192.168.X.X but still it is not working.

Note:My WLC and Web authentication page is not opening in HTTPS whereas it is opening in HTTP.

Re: Web-auth not automatically redirecting

Mark Elsen — Sat, 12 Nov 2022 10:00:44 GMT

- Have a checkup of the controller configuration with : https://cway.cisco.com/wireless-config-analyzer

Re: Web-auth not automatically redirecting

vikas01234das — Sat, 12 Nov 2022 11:39:15 GMT

Uploaded file into given link but it is not giving any output.Its seems
that tool is not working

Re: Web-auth not automatically redirecting

Mark Elsen — Sat, 12 Nov 2022 12:00:20 GMT

- It works but you need to take care, for aireos controllers it needs the 'raw' output of show run without any prompting (output) in between, have a look at : https://community.cisco.com/t5/networking-knowledge-base/show-the-complete-configuration-without-breaks-pauses-on-cisco/ta-p/3115114/page/2#toc-hId-1039672820 Probably in aireos the best method would be to transfer the running config and put it on to a tftp server and use that for WirelessAnalyzer. For 9800 based controllers Wireless Analyzer needs the output of show tech wireless (not just show tech)

Re: Web-auth not automatically redirecting

Arshad Safrulla — Sat, 12 Nov 2022 12:09:52 GMT

Do you have specific set of clients impacted? (only impacting apple devices etc.)

If you are using 9800, For HTTPS redirection you can enable Web Auth intercept HTTPS under the web auth parameter map, but there will be a hit on CPU usage of WLC. If you need more support please post the web auth parameter map configuration, redirection ACL and http/s server status along with the controller model, code and CWA or LWA

Re: Web-auth not automatically redirecting

Rich R — Mon, 14 Nov 2022 16:01:24 GMT

Warning: do not use https redirection on a busy 9800 WLC. We had it enabled and numerous clients were not getting splash/landing page at all. TAC eventually told us to turn it off "NOT RECOMMENDED" and that solved all the problems. No option to tune or optimise it and it turns out 9800 capacity for https redirection is less than 8540 and the WLC will just stop redirecting clients - even on http - causing severe degradation of service.
Do not use it on older AireOS WLCs and it is only scalable on 8540 or 5520 running 8.10 software.

Regarding @vikas01234das original problem - as I've explained many times before on this community:
Redirects to https pages will only work reliably on modern devices and browsers using a registered DNS resolvable fully qualified domain name (FQDN) with a matching certificate issued by a public CA which the devices trust. Trying to use IP addresses (whether 1.1.1.1 - which you should not use - or anything else) WILL cause problems on the majority of modern devices and browsers.

Re: Web-auth not automatically redirecting

vikas01234das — Tue, 15 Nov 2022 09:37:02 GMT

I am using 5508 WLC .secure web enabled .HTPS enabled .but not getting gui of WLC in https also web auth page not coming automatically .virtual ip is 2.2.2.2.If i enter ip http://2.2.2.2 in chrome browser than the page is comming.,

Re: Web-auth not automatically redirecting

Rich R — Tue, 15 Nov 2022 11:38:32 GMT

@vikas01234das opening the page directly with http is *not* the same as a redirect to https!
If you enter any https domain which then gets redirected to your https page then the browser/device expects to see a certificate matching the domain entered initially. If it doesn't then the page is blocked. Some browsers will still provide a warning and option to proceed. Most captive portal assistants will simply block the page. Similarly even when the redirect is from a http page (that's what all captive portal assistants use now) the https cert *must* match the domain of the page and be issued by a trusted root CA. This is the reality you must work with or you WILL have problems. Security enforcement is getting stricter all the time on devices and browsers so something that worked 10 years ago will not work today.

Re: Web-auth not automatically redirecting

istoleyowifi — Wed, 09 Oct 2024 00:53:56 GMT

Is there any more in depth info about this? I'm trying to find more information which explains the interaction of said devices but can't find anything concrete

Re: Web-auth not automatically redirecting

Rich R — Wed, 09 Oct 2024 22:16:36 GMT

Info about what specifically @istoleyowifi ?

Re: Web-auth not automatically redirecting

istoleyowifi — Wed, 09 Oct 2024 22:59:54 GMT

How https web redirect works with aironet wireless controllers

Re: Web-auth not automatically redirecting

Rich R — Fri, 11 Oct 2024 09:00:52 GMT

I think you mean AireOS controllers.

The WLC simply intercepts the TCP connection and responds masquerading as the destination IP address.
Because most browsers and clients now strictly enforce security with certificate verification https will normally be blocked and is NOT recommended. All device and browser captive portal detection now use http (not https) because that can be safely redirected.

The other reason you should not redirect https is because on modern devices you have dozens of apps trying to connect on https. The connections will all fail (because the redirect to captive portal fails certificate verification) so all you do is overload the WLC. 8540 running 8.10 code can cope with a moderate number of these - older WLC and code cannot. 9800 running IOS-XE is very weak at handling https redirects and will simply cause high CPU and dropped customer connections.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/115951-web-auth-wlc-guide-00.html
https://learn.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/captive-portals
https://en.wikipedia.org/wiki/Captive_portal
If you search you can find plenty of other articles explaining how captive portals work.

Re: Web-auth not automatically redirecting

istoleyowifi — Sat, 12 Oct 2024 07:18:47 GMT

se essentially I should use an http instead of https on my redirect url?

Re: Web-auth not automatically redirecting

Rich R — Sat, 12 Oct 2024 11:51:30 GMT

The captive portal URL you redirect to should be https (with valid trusted public certificate which matches the fully qualified domain name of the portal) but you should only intercept and redirect http traffic from the client eg http://www.neverssl.com or any of the OS and browser URLs as per https://en.wikipedia.org/wiki/Captive_portal which as you can see are always http because they're intended to be redirected.