WLC Guest Hotspot Login & Windows 11

[Heinz]

Good Day,

Having an issue with Windows 11 laptop(s) trying to connect to the Guest portal: 

1. Attempt to navigate to the 2.2.2.2/logon page from Edge <unsuccessful>
2. Attempt to navigate to the 2.2.2.2/logon page from Edge <unsuccessful>
3. Add 2.2.2.2/logon to Trusted Sites in Internet Settings in Windows and re-attempt logon from both Edge and Chrome. <unsuccessful>

(Windows 11 no longer supports Internet Explorer)

Anybody know if this is a know issue

WLC Firmware ver:  8.2.161.0 (Quite a dated version I know)

Any feedback will be appreciated 

[Leo Laohoo]

IF the laptop's OS gets downgraded to Win10, does it work?

[Heinz]

Hello,

As this is clients of my clients connecting to the Guest portal a downgrade is not possible, however other Windows 10 laptops do work

Regards

[Leo Laohoo]

---

@Heinz wrote:

As this is clients of my clients connecting to the Guest portal a downgrade is not possible, however other Windows 10 laptops do work

---

No, it has to be the same laptop having issues.  
Windows 11 is not yet "fully" released.  It is raw and untested in the wild.  
First thing is to eliminate this is due to an OS issue (or not). 

Finally, this is a BYOD.

[Heinz]

Leo,

Thanks for your feedback.

I'll take it up with the Client Operations Manager.

Regards

[Rich R]

In my opinion the problem here is "2.2.2.2".

It's well known by now that every OS and browser is strengthening security with every new release - this has been happening for years now.  The days of using IP addresses and/or self-signed certificates are gone.

If you want your portal to work properly with all devices you need to have a registered DNS host name with a valid public (trusted) certificate which matches that domain name otherwise you will only have problems. 

The fact that you needed to add it to trusted sites tells me this is probably what the problem is.  You are trying to use UNTRUSTED content and Windows is PROTECTING the user.  You've chosen to override that protection by making it a trusted site.  Why not do it correctly?

[Heinz]

Thank you,

We will go the registered DNS host name with a valid public (trusted) certificate route.

One question surely there is a quicker "easier" way to convert the cert than this:? 

https://www.rogerperkin.co.uk/wireless/how-to-install-ssl-certificate-on-cisco-wlc-for-guest-access/

[Rich R]

short answer is no.

Cisco official guide is at https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

If/when you move to 9800 WLC it's slightly different because it requires a different certificate format.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213917-generate-csr-for-third-party-certificate.html