AAA, NAC, Guest Access & BYOD

PROBLEM :

Blackberry devices give the following error when loading the captive portal profile: "The protocol specified is not supported by the handheld. Please try a different URL.".

This problem may also affect persistent URL functionality since the passed "url" attribute value pair will be corrupted.

DETAILS :
AOS versions 6.1.3.0 and 6.1.3.1 have a defect that causes malformed redirect URLs that Blackberry devices refuse to accept. Blackberry version 4 and 7 are known to generate this other although other versions may be affected. The specific problem with the redirect URL is extra %00 URL encoded characters after the essid attribute value pair.

6.1.0 redirect link:
https://10.162.110.37/ravi_logon.php?cmd=login&mac=e0:f8:47:15:d9:c6&ip=10.162.108.212&essid=Q&url=http%3A%2F%2Fwww%2Ecnn%2Ecom%2F

6.1.3 redirect link:
https://qnet.qcenter.com/complimentary.php?cmd=login&mac=a0:6c:ec:ac:2d:4e&ip=170.249.6.86&essid=Q%00%00%00%00%00%00%00%00%00%00%&url=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F

Notice the multiple %00 attached to the end of the essid value. A %00 is a valid encoding for a null character but the problem is that the last character ends in a % which causes a browser to think that "%&u" of "%&url=" is URL encoded data. This causes some browsers to error out when loading the captive portal page. Specifically, recent versions of Blackberry OS will give an error such as "The protocol specified is not supported by the handheld. Please try a different URL".

SOLUTION :
The issue is fixed in 6.1.3.2 AOS code.

A workaround is to set the SSID to 2 + (n * 3) characters, e.g. "AB", "ABCDE", "ABCDEFGH". This will make sure the URL encoded info lands on a complete %00 which is a valid URL encoded value.

=== WORKAROUND EXPLANATION ===

For example, take the following redirect URL:
http://10.150.120.35/Aruba_login.php?cmd=login&mac=40:6a:db::82:25&ip=10.152.152.2&essid=BMCC%2DGUEST%00%00%00%00%00%00%00%&url=http%3A%2F%2Fwww%2Eblackberry%2Ecom%2Fselect%2Fwifiloginsuccess%2F

The actual SSID is BMCC-GUEST and that is encoded as BMCC%2DGUEST%00%00%00%00%00%00%00%. The character count breakdown is as follows:

"BMCC" = 4 character
"-" == %2d = 3 character
"GUEST" = 5 character
Total no. of char = 12

The character count of 12 does not fall in the required length pattern of:

no. of char / 3 = X with remainder 2

So 12 / 3 = reminder 0 [non supported, incorrect encoding]. You would need to substract one alphanumeric (only) character or add 2 more which would make total number of characters 14. 14/3 = 4 with remainder 2

Note: Reason behind adding only alphanumeric characters is an alphanumeric characters do not get URL encoded. Any other characters outside of alphanumeric will get URL encoded and will be converted to 3 characters.