Guest Access via Captive Portal - problem with page not always appearing

[cenders]

I have set up a guest wifi network with an access point on an ethernet port of the PAN firewall.  The guest wifi network is unsecured.  I am using a web-form to ensure the guests see our logo, terms, and type in the correct password to proceed.

The setup works most of the time.  On occasion when using this setup via an Apple iOS device (iPhone, iPad) I don't get the portal page and instead receive an error on the idevice, "Hotspot login cannot open the page because the network connection was lost".  I can then only press cancel and it disconnects me from that wifi network.  If I hit cancel and try again, the same problem appears.  When hitting cancel on this the second time, I get presented with "use without internet or use other network".  Now if I click use without internet, and then open Safari and a website I do indeed get the captive portal.

I do not have this problem on any non iOS device (windows laptop, etc).

So, why sometimes does this happen to me?  It is not always repeatable on an iOS device.  I believe this is because the apple device is trying to initially open an HTTPS page.  Does that require me to enable SSL decryption?

[hshah]

Hi Cenders,

Please refer bellow thread, may be that will help you.

Regards,

Hardik Shah

[BobW]

We battle this one quite often.  Here are a couple thoughts:

• The apple devices, when they attach a wireless, automatically call the "success" page (randomdomain/library/test/success.html) on the apple domain.  The idea is nice, because it should autoopen the captive portal page as it tries it's http "success" page call  To get there it chooses from multiple domains.  There is quite a large list, some are shown here:  ios - ios7 and captive portals-changes to apple request URL - Stack Overflow.
• Having said that, I have found that even minor changes in the OS act differently.  (example not necessarily correct) IOS 6.01 works, 6.02 doesn't, 6.03 works sometimes etc.
• As I recall, the primary issue is related to Safari.  I had a case with Palo Alto where we did packet captures, etc and Safari would try to get out but would never get any packets back.  As I recall, we never did figure out why.
• Firefox and Chrome work without a problem.

So what I ended up doing is

• Creating a rule to allow unknown user access to the apple subnet and the success page.  Effectively disabling the captive portal auto prompt.
• Made it clear to my users that if they have an issue with IOS devices, try using a browser other than Safari and it will work every time and they will not get any email, or apps, functioning until the open a browser window.
• When they open safari or chrome, make sure to go to an http page.  Google, for example tends to default to https.

I may not have the above 100% as it has been a while, but hopefully that will give you some starting points.

Bob

[Tijl]

Are you using a public certificate on your captive portal page?

If so, you will need to allow 'unauthenticated' CRL and OCSP checks to the CA of the certificate.

The exact URL's you need to allow are in the certificate.

[cenders]

That link seems to be restricted, I can't open it.