Web Authentication Error WLC2504 8.2.166

[Dirt_Devil]

We are experiencing issue with Chrome and Edge browser where guests are not able to see the login page.

Firefox is working fine as the advance option is visible. Clicking the "Advanced" then it will redirect to the login page seems to be the workaround.

Anyone experiencing the same issue and what is the solution?

Thanks

[patoberli]

Very old software on the WLC, out of support since a while.

Regardless, what is the IP address of your virtual interface?

[Dirt_Devil]

hi,

my virtual interface ip is 1.1.1.1

Does upgrading the software to 8.2.170 or 8.3 fixes the issue?

Thanks

[patoberli]

No, this is a safety feature of newer Chrome based browsers. You need to change your virtual interface IP Address to a private one, for example 192.0.2.254.

[Dirt_Devil]

Hi Patoberli,

Thanks, will give this a try and let you know. Will this need to be done after hours or can be done during business hours without breaking any connection?

Cheers

[patoberli]

I don't remember it, but I think there was something about a reboot involved, but I tend to say no.
Important, if you need to reboot, read this first (you should read this anyway): https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html and implement the workaround before you reboot.

[Dirt_Devil]

The MIC in WLC will expire on 2025.

Certificate Name: Cisco SHA1 device cert

Subject Name :
C=US, ST=California, L=San Jose, O=Cisco Systems, CN=AIR-CT2504-K9-dceb94954f80, emai lAddress=support@cisco.com
Issuer Name :

--More-- or (q)uit
O=Cisco Systems, CN=Cisco Manufacturing CA
Serial Number :
66EFC96400000009E09D
Validity :
Start : Jul 20 06:03:16 2015 GMT
End : Jul 20 06:13:16 2025 GMT
Signature Algorithm :
sha1WithRSAEncryption
Hash key :
SHA1 Fingerprint : 4f:04:96:90:c3:63:1e:27:53:df:90:31:90:62:6f:8b:69:34:f0:e3
MD5 Fingerprint : 64:5e:d6:04:ac:f1:77:27:24:6a:49:7f:b1:d2:30:ca

[Dirt_Devil]

Hi,

Changed the virtual IP to 192.0.2.254 didn't work for me. Strange the certificate details still is pointing to 1.1.1.1

I have attached the capture for reference.

[Dirt_Devil]

I have regenerated a new certificate from WLC but still doesn't work. Steps below.

Security>Web Auth>Certificate>Regenerate Certificate>Reboot WLC

[Haydn Andrews]

needs to be a public cert, not a self signed certificate.

[Rich R]

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

[Haydn Andrews]

need a public certificate on installed for the webauth portal

[Rich R]

1. @patoberli - if by private you mean RFC1918 then 192.0.2.254 is not! https://datatracker.ietf.org/doc/html/rfc1918

2. Like @Haydn Andrews says you should use a public cert with a resolvable DNS name for your IP which matches your cert.

Even if you do that you can still see cert errors because that's an unavoidable effect of browser security and all web sites switching to https.  So the only way to avoid that is to access a http site then the redirect will not trigger cert errors/warnings.  http://neverssl.com is a good one to use.  All modern browsers and OS already use http captive portal detection for exactly this reason.

eg: https://support.mozilla.org/en-US/kb/captive-portal uses http://detectportal.firefox.com/canonical.html 

[patoberli]

@Rich R Based on this newer RFC it is reserved for “documentation” purposes:
https://datatracker.ietf.org/doc/html/rfc5737

[Rich R]

Noted thanks @patoberli but the RFC (which is still draft not standard) does say

These blocks are not for local use

so they should not actually be deployed in networks, even privately.

But granted that using them in the same way as RFC1918 is unlikely to cause any problems within a private network.

Regardless of that the problem here is with the cert not the IP - it needs a resolvable DNS name with a matching PUBLIC (not self signed) cert.