Webauth - 405 Method Not Allowed error

[Y C]

We have an 8540 running 8.5.140.0. On our guest ssid we use simple webauth with an AUP and I accept button, no other input required. It's worked for the longest time just fine. It continues to work with windows clients and android phones. Recently IOS went from 13.6.1 to 14.0 to 14.0.1.

Somewhere in this transition webauth broke on iphones and produces the error "405 Method Not Allowed error" - the initial page with the AUP comes up fine but the moment "I accept" is selected the error comes up. I tried it on a phone that was still on 13.6.1 and it works fine, but multiple phones with 14.0.1 do not. Can't be certain about 14.0. The working phone, when hitting "I accept" takes you to a page that says "Success" at the top left which you can close and continue on your way.

I've seen various older threads mentioning the load.action() function. I've verified that's already in my code. Yes we're still using the 1.1.1.1 2.2.2.2 ip scheme for webauth but if that were the issue the phone wouldn't see the aup at all I imagine. Same phones with 14.0.1 work just fine on an ssid doing 802.1x/eap.

[Rich R]

Not familiar with the problem myself but have you read through these?

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtd66990

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj17640

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtq47337

iOS 14 has numerous privacy and security enhancements which could impact this type of content.

You should also think about updating to at least 8.5.161.0 to make sure you are running the latest recommended 8.5 release.

https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc10

[Y C]

Those ultimately lead back to that bit of code I was referring to. I would consider a code upgrade if we can tie it directly to this issue.

The two upgraded phones that were continuously failing yesterday are intermittently working and connecting normally today. There must be a specific state the phone needs to be in, or the client on the controller needs to be in, for this to trigger. Either that or it's some random fluke.

Speaking of ios14 enhancements - I just found that it randomizes macs for every ssid by default. Probably unrelated to this though.

[patoberli]

Also change the IP address, you will get more and more issues by abusing 1.1.1.1 as the virtual interface address. 

IOS 14 also randomized the MAC address of already connected SSID every 24 hours. 

Then there is also the possibility of another bug (for example FT related) with the release you are running.