Web portal cisco C9800 does not appear

[Aimad Ghoudane]

Hi

I have an issue with my Guest portal in my Cisco C9800.

Weh i try to connect to my SSID Guest, I have

An Ip

I can lunch the web portal by https://192.0.2.1

but the Web Portal not appear mannually or maybe 1 time / 5.

Do you know how to resolve it ?

Regards

[balaji.bandi]

check below guide and check the config :

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/wireless-web-authentication.html

[Aimad Ghoudane]

but the Web Portal not appear AUTOMATICALLY (soory) or maybe 1 time / 5.

[balaji.bandi]

maybe 1 time / 5.

You mean 1 works out of 5 times ?

on same device ?

[Aimad Ghoudane]

Hi

You mean 1 works out of 5 times --> Yes exactly

on same device --> No, Multiple device (W10 / Iphone)

Regards

[Arshad Safrulla]

Are you using CWA or LWA? If CWA please post the ACL.

Can you post your web auth parameter map and also the http server configuration from the WLC. I would recommend having something similar. 

parameter-map type webauth global
type webauth
virtual-ip ipv4 192.0.2.1
virtual-ip ipv6 2001:DB8::1
webauth-http-enable

!

no ip http server
ip http secure server

!

[Aimad Ghoudane]

Hello 

This is my config

parameter-map type webauth Web_Portal_MYNAME
type webauth
redirect on-success https://www.MYWEBSITE.ch/accueil
max-http-conns 120
cisco-logo-disable
!

I try 

it's seem to be better when i add

ip http server  ( iknow that normally is better when we desactivate http server).

Now I have a better situation ... I don't know how

The user has the web portal login but with an certificate error and he has to validate the connection before to connect to the web portal.

[Arshad Safrulla]

You can avoid enabling the http server in the WLC by adding "webauth-http-enable" under the web auth parameter map. Certificate is important, it is recommended to use publicly signed certificate. Please consider adding the parameter map config I shared before.

[Aimad Ghoudane]

Thanks for your help

"webauth-http-enable" does not seems to exist on my WLC.

conf t

cwlc(config)#parameter-map type webauth Web_portal_MYNAME
wlc(config-params-parameter-map)#webauth-http-enable
^
% Invalid input detected at '^' marker.

wlc(config-params-parameter-map)#

[Arshad Safrulla]

Hi Aimad,
Looks like you are running a older code in box. Please consider upgrading your boxes to the latest Cisco TAC recommended code ASAP. Refer the signature for the links.
For the moment I would suggest that you have the "ip http server" configured in your WLC, as this is somewhat compulsory in the older codes for Web Auth to work properly. Also write your pre-auth ACL's properly to allow required communication to DNS, DHCP etc.

[Rich R]

As @Arshad Safrulla said you're running an old version of IOS-XE - update to current release.
webauth-http-enable was a feature enhancement to allow webauth to use http while disabling http server for GUI access.

To avoid certificate errors your splash/landing page must have a valid public certificate matching the DNS name of the URL for the page.

[Aimad Ghoudane]

Hello
Thanks for your return.
Except error on my part, I use the last firmware available on cisco web site.

But now, my spalh page arrive quickly when I change my certificat.

But i would like to understand (for my understanding) the relationship between the certificate and the automatic launch of the splah page.

[Rich R]

Modern devices and browsers implement strict security protocols now.

That means any secure web page must have a valid certificate before it will load.  If you don't provide a valid certificate the page is considered insecure (= DANGEROUS/MITM/HACKERS/MALWARE) and will not load for the safety of the user and device.

[Aimad Ghoudane]

Great ! many thanks for your return !