Interesting issue with Apple devices and Portal

[u2637ps]

Environment

9800 wlc 17.9.6

Portal is set up for Guest access.

Portal works for Windows machines and Android devices with no issue. It just fails for Apple Mac's and Iphones. It fails when trying to get to the portal designated by external DNS. On the Apple if you add a host file entry to the portal it works fine. Used Safari Chrome and Firefox all have the same issue

Test Mac is running Mac OS 15 

When it is not working and i go to a terminal prompt and do a nslookup it retrieves the right address for the portal

[Haydn Andrews]

what happens on apple if u try and browse to http://neverssl.com does it trigger the portal?

without the host file is nslookup working?

Is this portal on the WLC or via ISE?

Do you have a public certificate for the portal loaded?

[u2637ps]

Hi the portal has a public cert. We have made a breakthrough though that I will test when I am in the office next. In the preauth acl we added access to captive.apple.com. When our test user on a browser did 1.1.1.1 the portal came up. We will test next week to see if we can force the logon to come up by adding that as a step before bringing up the signon portal url. We also need to check other versions of IOS

[Rich R]

You must not allow captive.apple.com in the redirect/intercept ACL because that is exactly what needs to be redirected to the captive portal!  The ACL should only be allowing DHCP, DNS and your captive portal.
See https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217457-configure-and-troubleshoot-external-web.html#toc-hId-306862272 Step 4 for example ACLs.

Also note that you must NOT use 1.1.1.1 for the WLC virtual IP - Cisco stopped recommending that years ago because it is now a valid public internet IP.
https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213535-wlc-virtual-ip-address-1-1-1-1.html
Use the other recommended subnets or your own registered (but not routable) public IP.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/web-authentication/b-configuring-web-based-authentication-on-cisco-catalyst-9800-series-controllers/m-external-web-authentication-configuration.html#Cisco_Task.dita_3b9b7765-...

[u2637ps]

Thanks for that as we use an external certificate I will wait until it renews to add the appropriate SAN to allow me to redirect via IP.

Thanks

[Rich R · Accepted solution]

I wasn't saying you should redirect to an IP - you should still be redirecting to a FQDN DNS name which matches your certificate, but that FQDN should not resolve to 1.1.1.1 and the IP traffic to that IP should be allowed by the ACL and not redirected.