Controller Based WLANs

Answer

The Apple Captive Network Assistant (CNA) feature is an overlay that appears and prompts users automatically to login to the detected captive portal network without the need to explicitly open a web browser. This type of login is useful on mobile devices where many of the common applications are not browser-based and these applications would otherwise fail to connect without the successful browserbased authentication. Examples of these nonbrowser-based applications are email, social networking
applications, corporate VPNs, and media streaming.
 
The Apple operating systems detect the presence of a network that has captive portal enabled by attempting to request a web page from the Apple public website. This HTTP GET process retrieves a simple success.html file from the Apple web servers and the operating system uses the successful receipt of this file to assume that it is connected to an open network without the requirement for captive portal authentication.
If the success.html file is not received, the operating system conversely assumes that a captive portal is in place and presents the CNA automatically to prompt the user to perform a web authentication task. When the web authentication has completed successfully, the CNA window is closed automatically, which prevents the display of any subsequent welcome pages or redirecting of the user to their configured home page. If the user chooses to cancel the CNA, the Wi-Fi connection to the open network is dropped automatically, which prevents any further interaction via the full browser or other applications.

Here an example of External Captive portal from Amigopod is used

The CNA can be identified easily by the lack of a URL bar at the top of the screen and typical menu bar items. For many customers, this behavior of their Apple wireless devices will be acceptable and a great usability enhancement for their user community. However for some guest access or public access designs, the use of this CNA and the lack of ability to control the entire web authentication user experience are not desirable. For these customer scenarios, Amigopod has developed a method of bypassing the display of the CNA on the Mac OS X Lion or iOS devices. The main driver for this implementation is to restore the ability to control the user experience and display post-authentication welcome pages or redirect the Wi-Fi users to their originally requested web page.

Configuration of CNA bypass
In a typical External Captive Portal deployment integrating with an ArubaOS controller, the captive portal profile is configured to redirect all unauthenticated users to the external captive portal page hosted on External Server. 

aaa authentication captive-portal "guestnet"