WLC 9800: detectportal.firefox and gstatic.com without HTTPS

[Bolivar]

Hello,
I'm using the Cisco Catalyst 9800-CL Wireless Controller, with Web Auth and captive portal. The captive portal is hosted on an external server, within my network, with https.

on some devices, when I try to access the internet, I am redirected to the captive portal, using https, as it should.
However, in some cases I am redirected to portals like detectportal.firefox and gstatic.com (depending on browser) , which use http (no security).
Is there any way to force the use of the correct portal, ie the portal with https?

Thank you in advance for your help

[marce1000 · Accepted solution]

 - For starters have a   review the 9800-CL  configuration with the CLI command : show  tech wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer

 M.

[Bolivar]

Thanks for the tip. I found and fixed some bugs, as well as adjusting some best practice tips.
However, nothing related to the problem I'm facing

[marce1000]

   - Make sure the destination portal offers (secure) https  access as default , and or disable simple http access (if configured)

 M.

[Bolivar]

The external captive portal page is configured to operate with https. It is an apache server. That part is working without problems.

I noticed that the problem occurs in two cases:

1st when the captive portal "default" (detectportal.firefox or gstatic.com) is opened in the browser, with http;

2nd when the user tries to access a website with https, before authentication. In this case, the request is forwarded to Cisco's default captive portal, from wlc controller, without https.

When trying to access any website that uses http, I am correctly redirected to the secure captive portal (external with https)

Here at the institution, we have a WLC 5500 series, which works correctly for all cases. Besides the version, another difference is that the older wireless cisco controller is physical while the new one (wlc 9800) is virtualized (KVM).

[Rich R]

@Bolivar please clarify?
You say it does NOT work for http captive portal requests to detectportal.firefox or gstatic.com but then you say "When trying to access any website that uses http, I am correctly redirected to the secure captive portal (external with https)" which contradicts that!
Is your apache server using a valid public certificate with matching fully qualified domain name?
Does your WLC also have a valid DNS name and cert installed?

Note that http URLs for captive portal detection and redirection are the ONLY way to reliably trigger a captive portal redirection without security/cert warnings or outright failure as some OS/browsers will now block invalid https redirects altogether without any warning.  That is the industry standard now, used by all major browsers and OS on all devices.  Trying to block that will break the service or at least make it a horrible experience for most users.

[Bolivar]

Thanks for your reply.

"Is your apache server using a valid public certificate with matching fully qualified domain name?"
Yes, the certificate was signed by the same CA of other services that we already use in the institution.

"Does your WLC also have a valid DNS name and cert installed?"
Yup. Registered in the institutional DNS server

When I try to access an http page, I am correctly redirected to the captive secure portal page. On the other hand, in some cases, where the access attempt (before authentication) is performed through a website with https (example: https://www.google.com), I am redirected to detectportal.firefox or gstatic.com .

To work around this problem, I added a static page, which has the sole purpose of forcing redirection to another page with http. On the other hand, when being redirected to a non-secure page (with http) the WLC manages to redirect me to the correct captive portal (with https).

Here in Brazil, we call this type of procedure a "gambiarra". I believe in English it's "jerry-rig"