Android devices can't access wifi webauth 1.1.1.1/login.html

[sulimanalassiry]

Hi there;

Actually, I have wireless and I set the wifi access by web authatciin 1.1.1.1/login.html by username and password..

All devices can access to wifi except android devices when try's connect, we faced this message:

- The message of error err_ssl_version_or_cipher_mismatch

How can we solve that? Thanks

[marce1000]

 - Could you start by no longer using 1.1.1.1 for web authentication (and or redirect) , because these days the address is owned by Cloudfare and that might result in side effects such as you are seeing  , use a (real) private address instead ,

 M.

[sulimanalassiry]

Thanks much for comment; but how do "use a (real) private address instead ,"?

What these steps for configure that?.

Thanks

[marce1000]

   - Checkout : https://community.cisco.com/t5/wireless/setting-management-interface-wlc-7-4-121-0/m-p/2557362/highlight/true#M116897

 M.

[Rich R]

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213535-wlc-virtual-ip-address-1-1-1-1.html

We already explained in the answers below but here goes again...  You could use any of the private subnets listed in the guide above but for your certificate to work 100% with modern devices you need a fully qualified domain name (FQDN) eg: mywlc.companyname.com, which correctly matches the name on your certificate.  Your DNS for that FQDN needs to resolve to the virtual IP address you choose to configure.  It might be difficult for you to do that with a private IP.  In that case you need to use a registered public internet address.  Talk to your Internet Service Provider about how to get a public IP (some provide with the internet connection already).  Once you have that setup your redirect needs to use the FQDN not the IP address.  The requirement for the IP to be "unrouteable" just means you do not want anybody who is not a WLC client or on the internet to be able to reach it, so if you use a public IP then make sure to filter any internet traffic to that destination.  Only your wireless clients should ever be using that IP which will be intercepted by the WLC.

A convenient side effect of this is that if you have multiple WLCs you can use the same FQDN and IP address on every WLC because it is always intercepted on the WLC so it becomes an anycast address.

https://www.cisa.gov/news-events/news/understanding-website-certificates
https://venafi.com/blog/how-does-browser-trust-certificate/

[Haydn Andrews]

If your doing Local Web Auth make sure you have a publicly signed certificate on the WLC

also as stated do not use 1.1.1.1 as the virtual IP

[Rich R]

Also what model of WLC are you using and what version of software?
See the TAC recommended link below for TAC recommended software versions.

Your redirect URL should be using a DNS resolved FQDN with matching publicly signed certificate (as Haydn has highlighted) because most modern browsers and OS will not trust IP based URL and self-signed certificates.

[nnemrmaika]

he error "err_ssl_version_or_cipher_mismatch" on Android devices indicates an incompatibility with the SSL/TLS protocol versions and cipher suites. To resolve this:

Update Android Device Firmware: Ensure the latest firmware is installed.
Configure Web Authentication Server: Enable TLS 1.2 and 1.3, use strong cipher suites, and verify the CA certificate.
Android Device Network Settings: Clear network settings, forget the Wi-Fi network, and reconnect.
Additionally, check firewall rules, DNS settings, and browser settings.