Changing Virtual IP from 1.1.1.1 for CWA registration

[j656]

We are running CWA wireless guest in a Foreign/Achor setup using two 9800 pointing to ISE 2.3.  We have been using 1.1.1.1 as the virtual IP address, left over from our 5508 WLCs.  Now that browsers seem to be using 1.1.1.1 to resolve to Cloudflare, we are seeing issues on some devices as they go through the portal registration process.

So, I am looking at changing the Virtual IP address to the recommend 192.0.2.1 address under the Global Web Auth settings.  I have changed the IP on both the Foreign and Anchor WLCs, but the redirect is still going to 1.1.1.1.  

Any thoughts on why we can't get devices to use the 192.0.2.1 address instead of the 1.1.1.1?

[marce1000]

 - Make sure that clients are not suffering from browser caching effects , or try browser that was not used until today , also check all WLC logs for sanity check.

 M.

[Rasika Nayanajith]

Hi

I hope you followed below document guidelines when configuring it. Check DNS entries configured for 1.1.1.1 vs 192.0.2.1 to make sure old entries for guest portal redirection updated to new IP address.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html 

HTH
Rasika
*** Pls rate all useful responses ***

[j656]

We never had a any DNS entries specifically for 1.1.1.1.  It would always just redirect to the correct portal once the browser loaded the 1.1.1.1 URL.  BTW, on the devices now, if we manually change the 1.1.1.1 in the URL to 192.0.2.1 , then it does successfully redirect to the portal pages.  We just cant get the devices to go to the 192.0.2.1 instead of the 1.1.1.1 when they connect.  its like the devices don't know to use 192.0.2.1 instead of 1.1.1.1.

[Rich R]

Then it's your config on the WLC or ISE still redirecting to the wrong IP.
You should be using fully qualified domain names with CA issued certs rather than raw IP addresses for a reliable solution since by default captive portal handlers on most modern devices will not trust those pages.