ISE 1.4 and Apple's "Captive Network Assistant" causing problems

[Eric Hansen]

I'm testing ISE 1.4 with MAC 10.10.2/Safari 8.0.3, and the annoying scaled down Safari AKA "Captive Network Assistant" is getting in the way.  I'm wondering what other people have done to get around it.

According to the Cisco ISE Network Component Compatibility v1.4 the Safari I have should be compatible, Captive Network Assistant says that its not but I suspect that its because the MAC laptop is trying to validate against ~200 domains(so I hear it does).  My ISE/WLC have a dacl that permits certain IP's prior to AuthC/Z completing and obviously I can't put in dacls for all 200 of these domains.  My ISE is setup with the trustsec model where I have two SSID's, first one on the front end to detect if Anyconnect 4.x is installed and if it isnt then redirect to a portal.  The MAC fails the device security check cause... or i should say wont display it... cause of Apple's Captive Network Assistant.

I do know that I can disable the Captive Network Assistant by renaming its file, but this will probably not be an acceptable solution in my environment because of political reasons.  I am wondering what others have done to get around this annoying problem.  Maybe something with a DNS record or something...

thanks

e-

[jan.nielsen · Accepted solution]

Common recommendation is to cheat the apple devices to think it has internet access, by issuing this command on the command line of your WLC :

config network web-auth captive-bypass enable

[Eric Hansen]

Actually I am planning on putting in that very command tonight after the bulk of my users go home, restart required.  I'll report back.

**EDIT: worked great!

[Marvin Rhoads]

Had the same issue just this week - TAC recommended that as well.

Cheers.