I'm having some trouble with CNA and our guest portal, and I suspect the WLC image, but I can't seem to find a compatibility chart between Apple CNA, ISE and WLC? Any help?
the captive portal is disabled. The GUI is disabled, and the CLI is: Web Auth Redirect Ports .................... 80 Web Auth Proxy Redirect ................... Disable
I noticed the default ports in the config guide, and our portal is running on 8447. Could this have an impact?
I had deleted my post because it was a bit strongly worded and I thought that I may have missed something. I do have a TAC case open. They don't know how to make IPhone CNA work. The initial response was captive portal bypass which is a joke. This does not work and has not worked for years. There are numerous threads on numerous forums stating the same thing. Apple has no documentation on how their CNA works nor will they release any. Cisco has no documentation that mentions this issue, a workaround, or what would be required to make it work correctly.
There is nothing to make it work. Disable captive portal bypass on the controller. Having it enabled will suppress the Apple CNA.
Again this is strictly for Guest basic flows. If you have javascript loading and doing redirections and fancy things then I wouldn’t recommend allowing that and would suppress the CNA using captive portal bypass.
The only reason I could think for TAC support is if something isn’t working but I have it working with WLC 8.3 and 8.5 code fine. If you’re not getting support from TAC ask for an escalation.
I'm just not seeing it work. I am testing 8.5 MR3 and ISE 2.2 patch 6 with IOS clients, haven't seen CNA launch yet. They fool around guessing different websites until the portal pops up. We're going to be upgrading ISE to 2.4 soon but this appears to be a WLC issue.
The mini browser sends out probes to different sites. If it can’t get to those sites then it won’t pop up. So if your URL redirect redirects everything to ISE and your ACL only allows access to ISE then it should pop. I would recommend tracing with the TAC as well.
When you enable captive portal bypass it spoofs responses to those sites causing it not to pop up. There are scenarios where you wouldn’t want it to (example BYOD, social media login, SAML SSO advanced customization)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
