Web auth redirect on chromeOS and 9800 wlc

[Janne K.]

I am having trouble getting chromebooks to work on my new guest network with central web auth.

I can connect fine to the ssid, and the prompt to log in opens a window to "connectivitycheck.gstatic.com/generate_204"

After that nothing happens.. it is just stuck there, and after it times out or stops trying i can see that the gstatic url gets replaced with the correct redirect url in my policy. (I cant click on anything though)

The strange thing is that any other device works flawlessly. and the chromebook works flawlessly on my older 8540 guest ssid with the exact same auth and authz profiles...

Is there any special sauce on the 9800 that i need to turn on?

[MHM Cisco World]

I will send you PM

Thanks 

MHM

[marce1000]

 - What software version is the 9800 running ?

 - Checkout and use : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA
                                  https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
    for troubleshooting ; the latter (full client debugs) can be analyzed with Wireless Debug Analyzer)
    Also have a look at https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#toc-hId-866973845
    especially when changes are made , for instance.

   - Always advised : have an overall checkup of the 9800 wlc's configuration using the 
     CLI command show tech wireless (not a simple  show tech ) and feed the output from that into Wireless Config Analyzer

   - Also found : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw49225

  M.

[Janne K.]

I am running version 17.12.4, and hw is 9800-80

I'll have a look at the material.

[Flavio Miranda]

@Janne K. 

 On the release notes. there are some recommendations for Chromebooks

Dell Inspiron 2020 Chromebook	Chrome OS 75.0.3770.129
Google Pixelbook Go	Chrome OS 97.0.4692.27
HP chromebook 11a	Chrome OS 76.0.3809.136
Samsung Chromebook 4+	Chrome OS 77.0.3865.105

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/release-notes/rn-17-12-9800.html

[Janne K.]

We have acer chromebooks running the newest 131.0.6778.241 

[Flavio Miranda]

@Janne K. 

Any security feature or Tool installed on the device? 

Did you try with different browser ? Incognito mode? 

[Haydn Andrews]

Do you have a publicly signed certificate for the trustpoint attached to the webAuth redirect URL on the WLC

Found for some reason on the 9800 I hit more issues with clients not displaying captive portals due to self signed, invalid, expired certificates than on the 8540

[Janne K.]

@Flavio Miranda Not that I know of, on chrome there are a number of extentions installed as the machines all are for school use only.

Extentions are: TxTAnalyser, SubReader, Wizkids Device Agent, Ysoft SAFEQ Chrome Print, Geogebra klassisk, SPARKvue, MathSolver,

In incognito it is the same problem.

@Haydn Andrews We do have a publicly signed cert on the external portal thats valid, so there should be no problems there.

[Janne K.]

I just got my hand on a brand new lenovo chromebox to test, and lo and behold it connects fine through the captive portal...

Im not sure what to make of it..

[Flavio Miranda]

Seems the problem is specifically with that device?   If that is the case you probaably need to reinstall the OS on it.