Security

Reply
Occasional Contributor II
Posts: 16
Registered: ‎07-28-2015

Captive Portal - Guest Access - problem with IE

[ Edited ]

Hello all,

 

I have a problem with guest access captive portal on Internet Explorer.

When guest put web page he should be redirected to Captive Portal on Clearpass. It works fine with Google Chrome/Opera and mobile devices. Only on IE it looks like web page hostname isn’t switch on captive portal.

Browsers go in to the loop because add some information to requested site and do not change hostname:

Request on IE when we put www.msn.com looks like this:

http://www.msn.com/guest/login.php?cmd=login&mac................

 

Other browser correct requst:

https://captiveportal.mydomain.com/guest/login.php?cmd=login&.............

 

We start to debug IE and workstation but on other captive portal solution it works fine.

Any ideas?

 

IAP ver: 6.4.2.6-4.1.1.11_52666

CPPM:6.5.3.75367

MVP
Posts: 4,307
Registered: ‎07-20-2011

Re: Captive Portal - Guest Access - problem with IE

[ Edited ]

Can you share the ACLs under your Captive Portal Role?

show access-rule <RULE-NAME> 

Thank you

Victor Fabian
Lead Mobility Engineer @ Integration Partners
AMFX | ACMX | ACDX | ACCX | CWAP | CWDP | CWNA
Occasional Contributor II
Posts: 16
Registered: ‎07-28-2015

Re: Captive Portal - Guest Access - problem with IE

[ Edited ]

I found also that there can be issue with redirection page. For IE should be tag closed </base>:

 

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">

<HTML>

<HEAD>

<base href="http://captiveportal.mydomain.com/guest/login.php" />

<TITLE>Login</TITLE>

<SCRIPT><!--

window.top.location.href = "\/guest\/login.php?cmd.......

 

On some dev php forum I found: 

You have to use closer tag for base in IE, other browsers require only self-close. So it should be:

<base href="/My_Site/" /><!--[if IE]></base><![endif]-->

(Assuming that href value is correct)

 

Can someone verfiy that request on IAP with other version?

Occasional Contributor II
Posts: 16
Registered: ‎07-28-2015

Re: Captive Portal - Guest Access - problem with IE

Access Rules
------------
Dest IP Dest Mask Dest Match Protocol (id:sport:eport) Application Action Log TOS 802.1P Blacklist App Throttle (Up:Down) Mirror DisScan ClassifyMedia
------- --------- ---------- ------------------------- ----------- ------ --- --- ------ --------- ---------------------- ------ ------- -------------
any any match dhcp permit
ClearPassPortal 255.255.255.255 match http permit
ClearPassPortal 255.255.255.255 match https permit
any any match dns permit
Vlan Id :0
ACL Captive Portal:disable
ACL ECP Profile :default
CALEA :disable
Bandwidth Limit :downstream disable upstream disable

MVP
Posts: 1,414
Registered: ‎11-30-2011

Re: Captive Portal - Guest Access - problem with IE

which internet explorer version?

 

can you try just going to the clearpass yourself? does that work?

Occasional Contributor II
Posts: 16
Registered: ‎07-28-2015

Re: Captive Portal - Guest Access - problem with IE

Hi we have tested IE 9 and above.

I try to solve that issue with TAC but the case is still in progress.

 

We have done some search and I don’t know is it right trace but:

 

According to html specs: http://www.w3.org/TR/html401/struct/links.html refer: Path information: the BASE element section - This attribute specifies an absolute URI that acts as the base URI for resolving relative URIs.

Chrome and Firefox supports relative paths in this tag but IE does not. IE is following the specs strictly.

And other info form web developers:

 

top.location.href= "URL" works fine, just make sure that the URL is absolute.

 

And Webpage serving for Instat is relative:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<base href="http://guestportal.mydomain/guest/login.php" />

<TITLE>Login</TITLE>
<SCRIPT><!--
window.top.location.href = "\/guest\/login.php?cmd=login&mac=ac:fd:ce:7f:af:9e&essid=Guest-
Aruba&ip=172.31.99.101&apname=9c%3A1c%3A12%3Acd%3A34%3Aea&vcname=instant-CD

............................

 

Occasional Contributor II
Posts: 16
Registered: ‎07-28-2015

Re: Captive Portal - Guest Access - problem with IE

[ Edited ]

Turns out that there was misconfiguration on Captive portal profile.

Instead of Radius Authentication type I had set up Authentication Text type.

Strange thing is that only IE doesn't work with that but anyway it was my fault.

Occasional Contributor II
Posts: 27
Registered: ‎06-14-2012

Re: Captive Portal - Guest Access - problem with IE

I was encountering the same issue where Firefox and Chrome were working but IE wasn't redirecting properly.  In my captive portal profile on the IAP it was set to use HTTP and port 80 and I was relying on ClearPass to redirect to HTTPS.  After changing the captive portal profile on the IAP to use HTTPS and port 443 IE would properly redirect to ClearPass.

Search Airheads
Showing results for 
Search instead for 
Did you mean: