iOS 26 and mobile Safari issues with some websites on WLAN on 9800

[panderson25]

This is super-specific to iOS 26, mobile Safari, and 9800-L controllers (17.3.7).  2802i access points.  Some external sites and some of our internal sites, are very very slow to load.  WLAN with basic PSK 2 or even captive portal.  Fast Transition Disabled, Adaptive, Enabled, no difference.  Switch to Chrome mobile, no issues.  iOS 18?  No issues.  Anyone else?

[Mark Elsen]

  - @panderson25   The software version on the controller is very old. Consider upgrading to latest advisory (17.15.3)

  M.

[Rich R]

As @Mark Elsen says you are using a very old version of code which has numerous known bugs!
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-3-x-eol.html
Cisco stopped testing and fixing that code more than 2 years ago and even security vulnerabilities are no longer fixed.

More generally - have you tried turning off iCloud Private Relay (either globally or on the SSID options) which Safari uses and Chrome does not?

As per the Best Practices guide (link below) have you checked your TCP MSS setting?

Note changing Fast Transition settings would only affect device association (it either works or doesn't) not device performance once connected.  And Adaptive is not recommended anymore (again that's in the Best Practices guide).

[panderson25]

Thank you!

We are a few weeks away from updating the code because of some older WAPs. We disabled all security protections in iOS but only disabling Limit IP Address Tracking made a difference. Case is open with TAC as well.

[Rich R]

> only disabling Limit IP Address Tracking
So that confirms that the problem is related to iCloud Private Relay.

Have you checked the TCP MSS setting? (recommended value 1250)
Is it small enough to avoid fragmentation on all intervening links? (taking into account CAPWAP encapsulation + anything else in the path like GRE or IPSEC or both).

Also is there anything else in the path (like a router or firewall) which might be overriding with a larger TCP MSS setting than what the AP sets?

Have you done packet captures to see what's actually happening when that slow performance happens?
eg: do you see fragmentation/retransmissions/lost packets etc?