Security

last person joined: 22 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Captive Portal - Guest Access - problem with IE

This thread has been viewed 6 times

  • 1.  Captive Portal - Guest Access - problem with IE

    Posted Dec 16, 2015 07:00 AM

    Hello all,

     

    I have a problem with guest access captive portal on Internet Explorer.

    When guest put web page he should be redirected to Captive Portal on Clearpass. It works fine with Google Chrome/Opera and mobile devices. Only on IE it looks like web page hostname isn’t switch on captive portal.

    Browsers go in to the loop because add some information to requested site and do not change hostname:

    Request on IE when we put www.msn.com looks like this:

    http://www.msn.com/guest/login.php?cmd=login&mac................

     

    Other browser correct requst:

    https://captiveportal.mydomain.com/guest/login.php?cmd=login&.............

     

    We start to debug IE and workstation but on other captive portal solution it works fine.

    Any ideas?

     

    IAP ver: 6.4.2.6-4.1.1.11_52666

    CPPM:6.5.3.75367



  • 2.  RE: Captive Portal - Guest Access - problem with IE

    Posted Dec 16, 2015 09:56 AM

    Can you share the ACLs under your Captive Portal Role?

    show access-rule <RULE-NAME> 



  • 3.  RE: Captive Portal - Guest Access - problem with IE

    Posted Dec 16, 2015 10:08 AM

    Access Rules
    ------------
    Dest IP Dest Mask Dest Match Protocol (id:sport:eport) Application Action Log TOS 802.1P Blacklist App Throttle (Up:Down) Mirror DisScan ClassifyMedia
    ------- --------- ---------- ------------------------- ----------- ------ --- --- ------ --------- ---------------------- ------ ------- -------------
    any any match dhcp permit
    ClearPassPortal 255.255.255.255 match http permit
    ClearPassPortal 255.255.255.255 match https permit
    any any match dns permit
    Vlan Id :0
    ACL Captive Portal:disable
    ACL ECP Profile :default
    CALEA :disable
    Bandwidth Limit :downstream disable upstream disable



  • 4.  RE: Captive Portal - Guest Access - problem with IE

    Posted Dec 26, 2015 09:51 AM

    which internet explorer version?

     

    can you try just going to the clearpass yourself? does that work?



  • 5.  RE: Captive Portal - Guest Access - problem with IE

    Posted Dec 29, 2015 04:54 AM

    Hi we have tested IE 9 and above.

    I try to solve that issue with TAC but the case is still in progress.

     

    We have done some search and I don’t know is it right trace but:

     

    According to html specs: http://www.w3.org/TR/html401/struct/links.html refer: Path information: the BASE element section - This attribute specifies an absolute URI that acts as the base URI for resolving relative URIs.

    Chrome and Firefox supports relative paths in this tag but IE does not. IE is following the specs strictly.

    And other info form web developers:

     

    top.location.href= "URL" works fine, just make sure that the URL is absolute.

     

    And Webpage serving for Instat is relative:

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
    <HTML>
    <HEAD>
    <base href="http://guestportal.mydomain/guest/login.php" />

    <TITLE>Login</TITLE>
    <SCRIPT><!--
    window.top.location.href = "\/guest\/login.php?cmd=login&mac=ac:fd:ce:7f:af:9e&essid=Guest-
    Aruba&ip=172.31.99.101&apname=9c%3A1c%3A12%3Acd%3A34%3Aea&vcname=instant-CD

    ............................

     



  • 6.  RE: Captive Portal - Guest Access - problem with IE
    Best Answer

    Posted Jan 04, 2016 07:36 AM

    Turns out that there was misconfiguration on Captive portal profile.

    Instead of Radius Authentication type I had set up Authentication Text type.

    Strange thing is that only IE doesn't work with that but anyway it was my fault.



  • 7.  RE: Captive Portal - Guest Access - problem with IE

    Posted Jul 25, 2016 07:41 PM

    I was encountering the same issue where Firefox and Chrome were working but IE wasn't redirecting properly.  In my captive portal profile on the IAP it was set to use HTTP and port 80 and I was relying on ClearPass to redirect to HTTPS.  After changing the captive portal profile on the IAP to use HTTPS and port 443 IE would properly redirect to ClearPass.



  • 8.  RE: Captive Portal - Guest Access - problem with IE

    Posted Dec 16, 2015 09:59 AM

    I found also that there can be issue with redirection page. For IE should be tag closed </base>:

     

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">

    <HTML>

    <HEAD>

    <base href="http://captiveportal.mydomain.com/guest/login.php" />

    <TITLE>Login</TITLE>

    <SCRIPT><!--

    window.top.location.href = "\/guest\/login.php?cmd.......

     

    On some dev php forum I found: 

    You have to use closer tag for base in IE, other browsers require only self-close. So it should be:

    <base href="/My_Site/" /><!--[if IE]></base><![endif]-->

    (Assuming that href value is correct)

     

    Can someone verfiy that request on IAP with other version?