topic Re: Android devices can't access wifi webauth 1.1.1.1/login.html in Wireless

Android devices can't access wifi webauth 1.1.1.1/login.html

sulimanalassiry — Mon, 28 Oct 2024 10:56:46 GMT

Hi there;

Actually, I have wireless and I set the wifi access by web authatciin 1.1.1.1/login.html by username and password..

All devices can access to wifi except android devices when try's connect, we faced this message:

- The message of error err_ssl_version_or_cipher_mismatch

How can we solve that? Thanks

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

Mark Elsen — Mon, 28 Oct 2024 11:34:30 GMT

- Could you start by no longer using 1.1.1.1 for web authentication (and or redirect) , because these days the address is owned by Cloudfare and that might result in side effects such as you are seeing , use a (real) private address instead ,

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

Haydn Andrews — Mon, 28 Oct 2024 22:20:53 GMT

If your doing Local Web Auth make sure you have a publicly signed certificate on the WLC

also as stated do not use 1.1.1.1 as the virtual IP

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

Rich R — Tue, 29 Oct 2024 09:32:30 GMT

Also what model of WLC are you using and what version of software?
See the TAC recommended link below for TAC recommended software versions.

Your redirect URL should be using a DNS resolved FQDN with matching publicly signed certificate (as Haydn has highlighted) because most modern browsers and OS will not trust IP based URL and self-signed certificates.

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

sulimanalassiry — Sun, 01 Dec 2024 08:15:09 GMT

Thanks much for comment; but how do "use a (real) private address instead ,"?

What these steps for configure that?.

Thanks

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

Mark Elsen — Sun, 01 Dec 2024 10:44:47 GMT

- Checkout : https://community.cisco.com/t5/wireless/setting-management-interface-wlc-7-4-121-0/m-p/2557362/highlight/true#M116897

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

Rich R — Sun, 01 Dec 2024 13:19:33 GMT

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213535-wlc-virtual-ip-address-1-1-1-1.html

We already explained in the answers below but here goes again... You could use any of the private subnets listed in the guide above but for your certificate to work 100% with modern devices you need a fully qualified domain name (FQDN) eg: mywlc.companyname.com, which correctly matches the name on your certificate. Your DNS for that FQDN needs to resolve to the virtual IP address you choose to configure. It might be difficult for you to do that with a private IP. In that case you need to use a registered public internet address. Talk to your Internet Service Provider about how to get a public IP (some provide with the internet connection already). Once you have that setup your redirect needs to use the FQDN not the IP address. The requirement for the IP to be "unrouteable" just means you do not want anybody who is not a WLC client or on the internet to be able to reach it, so if you use a public IP then make sure to filter any internet traffic to that destination. Only your wireless clients should ever be using that IP which will be intercepted by the WLC.

A convenient side effect of this is that if you have multiple WLCs you can use the same FQDN and IP address on every WLC because it is always intercepted on the WLC so it becomes an anycast address.

https://www.cisa.gov/news-events/news/understanding-website-certificates
https://venafi.com/blog/how-does-browser-trust-certificate/

Re: Android devices can't access wifi webauth 1.1.1.1/login.html

nnemrmaika — Sun, 01 Dec 2024 20:42:52 GMT

he error "err_ssl_version_or_cipher_mismatch" on Android devices indicates an incompatibility with the SSL/TLS protocol versions and cipher suites. To resolve this:

Update Android Device Firmware: Ensure the latest firmware is installed.
Configure Web Authentication Server: Enable TLS 1.2 and 1.3, use strong cipher suites, and verify the CA certificate.
Android Device Network Settings: Clear network settings, forget the Wi-Fi network, and reconnect.
Additionally, check firewall rules, DNS settings, and browser settings.