Issues with ISE hotspot and self registration portals with apple devices

[n-russell-biggie]

Hello,

I have configured ISE 2.4 to create wifi hotspots and self registration access. We user a WLC 2504 controller software version 8.5.

Everything works fine with windows devices and android devices which get correctly redirected to ISE portal pages. However, with the iphone we get errors. The phone connects to the ssid but then gives an error as below:

Error Opening Page - "Hotspot login cannot open the page because the server cannot be found". I believe this is trying to go to captive.apple.com. My redirect ACL on the WLC allows access to DNS and also to the ISE server. Do I need to add access to captive.apple.com in the ACL?

Another point is that the ise server has a certificate signed by a CA that is not a publicly trusted CA. I have added the root CA to my trusted certs on the iphone but still the same issue. I have also enabled web-auth captive-bypass and rebooted the WLC but still the same issues.

Any help would be great.

Thanks in advance

Nick

[Jason Kunst · Accepted solution]

Yes likely the Apple Captive network assistant is not liking the self signed cert.

I recommend reviewing the guest guide under http:://cs.co/ise-guest<>

And also enabling captive portal bypass on the controller to suppress the CNA so the regular browser is used
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/wlan_security.html


Look for Captive Portal Bypass

Information About Captive Bypassing

Long term you will want to allow users to have a seamless flow and disabling it

[n-russell-biggie]

Many thanks Jason,

I have enabled captive bypass on the WLC. I am able to get a step further, so obviously I do not get automatically redirected to ise, however when I open a browser I do get redirected to ISE but that is as far as I can get as it tells me there is an issue with he certificate. I do not get the option to trust or add the certificate for ISE so I get stuck here.

The domain name is xxxxxxx.local. I have read somewhere that iphones do not like a .local domain.

Any other help would be great.

Thanks

Nick

[Jason Kunst]

Correct Apple doesn’t like that. Would recommend trying something else. We use a fake domain like securitydemo.net. And a well known cert, otherwise Apple devices won’t go through BYOD flow as well. This isn’t an ise issue.

[n-russell-biggie]

Thats great, thanks Jason. I will give this a try and let you know how I got on.

Cheers

Nick

[briankk1582]

Hi Russell, can I ask what the results of your testing were?

[Jason Kunst]

thanks please let me know

[ganiabdullahgenderang]

Hi Jason,

i facing same issue, i try to change certificate selfsigned using xxx.com

the result, still same in apple device. " hotspot login cannot open the page because the server cannot be found "

i try to using browser its working normally.

is there any advice ?

thanks

[Jason Kunst]

Are you saying you’re using self signed certificate?

Apple captive network browser assistant doesn’t like that likely

[ganiabdullahgenderang]

hi Jason,

yes, i am using selfsigned certificate.
earlier everything running well.
and now apple device cannot using CNA.

so, we need using public certificate ?

thanks

[Jason Kunst]

that's correct, self-signed certificate is not supported in the guest flow for production as many browsers have issues with them

check out guest guide
https://community.cisco.com/t5/security-documents/ise-guest-access-prescriptive-deployment-guide/ta-p/3640475
and certificate guide
https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897