Cant access web auth 1.1.1.1

[tomstechele]

Hi 

We are working with a WLC 8.2.166.0 and AP AIR-AP2802I-E-K9. 

-So we can ping to 192.168.10.2 ( VM: DNS,DHCP, DC)

- We can access the wlc controller 

- We can resolve the dns entries, but we cant access 1.1.1.1 ( error:doesn't show anything/ Can't display page).

Security- Layer 3 set to Web policy  authentication/ type: internal)

We have been looking for a solution quite a while.

Can someone help us?

Thanks!

[Sandeep Choudhary]

check if virtual interface is correct (1.1.1.1) or any other IP !!

Also paste the sh wlan <id> output here.

Can you also  provide the screenshot of your LAYER 3 settings on the WLAN?

Regards

Dont forget to rate helpful posts

[tomstechele]

Hi

Thanks for responding

As requested output sh wlan / screenshot layer 3

[Sandeep Choudhary]

Hi,

The main thing if the webauth page does not appear is due to the clients homepage being https not http or dns issues.  If you remove the webauth and associate to the ssid, can you access the internet?  This will prove that dns is working okay from the guest users.  Try that first and let me know.

Did you enter DNS hostename unders Virtual interface ? IF yes then remove i and try againt.

Regards

Dontf orget to arte helpful posts

[tomstechele]

Hi

For the moment we are working on a offline setup so we can't access the internet. But if we try to resolve other dns names within the network, it works. I don't know if the dns server needs special settings?

There is no dns host name set, so that's not the problem.

[Sandeep Choudhary]

Then check this: 

https://supportforums.cisco.com/t5/wireless-mobility-documents/web-authentication-1-1-1-1-login-redirect-issue-wireless-lan/ta-p/3161248

Regards

Dont forget to rate helpful posts

[Leo Laohoo]

FYI:  The IP address 1.1.1.1 is Cloudflare's DNS service.  

[SandrienA]

Since the setup isn't connected to the internet this shouldn't be a problem.

[m.bisoen]

Hi,

Actually this is the problem. For this you have not to be connected to the Internet. As of April 11th 2018 most of the browsers incorporate the IP address 1.1.1.1 in the HSTS pre-load list which forces the clients to connect to HTTPS instead off HTTP (see https://chromium.googlesource.com/chromium/src/+/24afe0da3135fa56fcf7e87f75b6b676c9b23ea9/net/http/transport_security_state_static.json line 49156). The captive portal redirect to HTTP://1.1.1.1/login.html will fail.