Troubleshooting: Portal Redirection Failures

Portal redirection enables the system to automatically display the authentication page to control STA access to HTTP or HTTPS websites if the authentication fails. To implement this function, the device intercepts HTTP (TCP port 80) or HTTPS (TCP port 443) traffic, establishes a TCP connection with the terminal by pretending to be the destination IP address that the terminal attempts to access, and redirects the terminal to an authentication page. Portal redirection is the first phase of Portal authentication. However, some clients can directly submit the user names and passwords to the Portal server without having to undergo Portal redirection.

In wireless scenarios, Portal redirection is implemented by APs.

Portal redirection can be implemented in either of the following modes:

• Method 1: HTTP 200 OK

  As shown in the following information, 42.1.1.19 is the IP address of the STA, and 1.1.1.1 is the destination IP address accessed by the STA.

  Figure 6-1 Packet exchange (HTTP 200 OK)
  
  Figure 6-2 Packet content (HTTP 200 OK)
  

  After you enter http://1.1.1.1 in the address box of a browser, the device intercepts the packet, and pretends to be the destination address 1.1.1.1 to establish a TCP connection with the terminal. The first to third packets in Figure 6-1 show the packet exchange process. After the TCP connection is established, the terminal sends an HTTP GET packet (the fourth packet in Figure 6-1), and the device replies with an HTTP 200 OK packet (the fifth packet in Figure 6-1). The HTTP 200 OK packet sent by the device carries the IP address of the redirection authentication page (the information in the red box in Figure 6-2). After the STA receives the HTTP 200 OK packet, it accesses the redirection authentication page.

• Method 2: HTTP 302 Moved Temporarily

  As shown in the following information, 42.1.1.76 is the IP address of the STA, and 1.1.1.1 is the destination IP address accessed by the STA.

  Figure 6-3 Packet exchange (HTTP 302 Moved Temporarily)
  
  Figure 6-4 Packet content (HTTP 302 Moved Temporarily)
  

  This mode differs from the HTTP 200 OK mode in that the device replies with an HTTP 302 Moved Temporarily packet that carries the address of the redirected authentication page.

WLAN V200R010 and earlier versions support only HTTP 302 Moved Temporarily redirection. V200R019 and later versions use HTTP 200 OK redirection by default. If HTTP 302 Moved Temporarily redirection is required (for example, some customized STAs do not support HTTP 200 OK), you can run the portal redirect-302 enable command to configure this function.

After a STA connects to a wireless network, it first uses an internal tool to send an HTTP sniffing request to a specified server to check whether the wireless network has the network access permission. For a Portal authentication network, the device intercepts the HTTP sniffing request sent by the internal tool of the STA and sends a redirection page to the STA, the internal tool of the STA determines that the response is not the expected one and considers that the wireless network is under control. Then, the tool invokes the default browser of the system to resend an HTTP sniffing request. The device continues to intercept the request and sends a redirection page to the STA. The browser is redirected to the Portal authentication page, that is, the Portal authentication page is automatically displayed after the STA connects to the wireless network.

The following uses an iOS terminal as an example. The process of automatically displaying the Portal authentication page on the iOS terminal is as follows:

1. An Apple terminal sends an HTTP 1.0 request to http://captive.apple.com. The User-Agent field in the request is CaptiveNetworkSupport.

2. If the pushed page is not the expected http://www.apple.com/library/test/success.html, the terminal considers a network connection failure and invokes the browser to send an HTTP 1.1 request to http://captive.apple.com. The User-Agent field in the request is Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_3 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13G34, which may slightly vary depending on Apple terminals and versions.

3. In this case, the Portal authentication page is automatically displayed on the terminal, where users can enter the account password to connect to the wireless network.

The preceding describes the implementation of Apple's Captive Network Assistant (CNA) mechanism. Whether the browser can re-send an HTTP request is the key to automatically pushing the Portal authentication page in 2. If the browser is not invoked or is invoked with a long delay, the Portal authentication page will fail to be pushed or will be pushed after a long time.

Find the corresponding VAP profile based on the SSID, and check the configurations of the VAP profile, including the configuration of the authentication profile.

1. Run the display vap-profile all command to check all VAP profiles and find the corresponding VAP profile based on the SSID.

   [Huawei] display vap-profile all
   FMode   : Forward mode
   STA U/D : Rate limit client up/down
   VAP U/D : Rate limit VAP up/down
   BR2G/5G : Beacon 2.4G/5G rate
   ---------------------------------------------------------------
   Name         FMode    Type     VLAN       AuthType     STA U/D(Kbps)  VAP U/D(Kbps)  BR2G/5G(Mbps)  Reference  SSID
   ---------------------------------------------------------------
   default      direct   service  VLAN 1    Open         -/-            -/-               1/6              0           HUAWEI-WLAN
   vap_portal  tunnel    service  VLAN 200 Open+Portal -/-            -/-               1/6              3           portal_test
   ---------------------------------------------------------------
   Total: 2

   It is not recommended that the same SSID be bound to multiple VAP profiles because exceptions (such as access failures) will occur when multiple VAP profiles with the same SSID are bound to the same AP.

2. Check the configuration of the VAP profile, and find the authentication profile bound to the VAP profile.

   [Huawei] wlan
   [Huawei-wlan-view] vap-profile name vap_portal
   [Huawei-wlan-vap-prof-vap_portal]display this
   #
    forward-mode tunnel
    service-vlan vlan-id 200
    ssid-profile localportal
    authentication-profile authen_portal
   #

3. Check the configuration of the authentication profile. It must have a Portal access profile bound.

   [Huawei] authentication-profile name authen_portal
   [Huawei-authentication-profile-authen_portal] display this
   #
   authentication-profile name authen_portal
    portal-access-profile access_portal
    access-domain domain_test
   #

4. Check the configuration of the Portal access profile. It must have built-in Portal authentication enabled or have a Portal server template bound.

   For built-in Portal authentication, you need to enable built-in Portal authentication in the Portal access profile.

   [Huawei] portal-access-profile name access_portal
   [Huawei-portal-access-profile-access_portal] display this
   #
   portal-access-profile name access_portal
    portal local-server enable
   #

   For external Portal authentication, you need to bind a Portal server template to the Portal access profile.

   [Huawei] portal-access-profile name access_portal
   [Huawei-portal-access-profile-access_portal] display this
   #
   portal-access-profile name access_portal
    web-auth-server portal_test direct
   #

5. If an external Portal server is used, the server IP address and URL must be configured.

   The URL can be configured in either of the following methods: 1. Configure the URL on the Portal server; 2. Reference the URL template on the Portal server and configure the URL in the URL template. In addition, you can configure the required URL parameters in the URL template. If the Portal server requires specific URL parameters, you can configure the URL parameters only in the URL template.

   • Method 1: Configure a URL on the Portal server.

     [Huawei] web-auth-server portal_test
     [Huawei-web-auth-server-portal_test] display this
     #
     web-auth-server server_portal
      server-ip 12.12.12.1
      port 50100
      url http://12.12.12.1:8080/portal
      protocol http
     #

   • Method 2: Configure a URL template on the Portal server.

     [Huawei] web-auth-server portal_test
     [Huawei-web-auth-server-portal_test] display this
     #
     web-auth-server server_portal
      server-ip 12.12.12.1
      port 50100
      url-template url_test
      protocol http
     #

     Check the configuration in the URL template. The URL and required parameters need to be configured.

     [Huawei]url-template name url_test
     [Huawei-url-template-url_test] display this
     #
     url-template name url_test
      url http://12.12.12.1:8080/portal
      url-parameter device-ip ac-ip user-ipaddress userip ssid ssid
     #

6. Check the DNS bypass configuration.

   Check whether the portal pass dns enable command is configured in the system view. By default, this command is enabled in V200R010 but disabled in V200R19 and later versions. If this command is not configured, configure an authentication-free rule to bypass the DNS server address. The following shows how to configure an authentication-free rule to bypass DNS server address 8.8.8.8.

   [Huawei] free-rule-template name default
   [Huawei-free-rule-default] display this
   #
   free-rule-template name default_free_rule
    free-rule 1 destination ip 8.8.8.8 mask 255.255.255.0 source ip any
   #
   [Huawei] authentication-profile name authen_portal
   [Huawei-authentication-profile-authen_portal] display this
   #
   authentication-profile name authen_portal
    portal-access-profile access_portal
    access-domain domain_test
    free-rule-template default_free_rule
   #

1. Check the configuration of the URL template delivered to the AP.

   The URL template on the AP includes the built-in Portal server configuration, Portal server template configuration, and URL template configuration on the AC.

   1. Query the configuration of all URL templates on the AP.

      [Huawei-AP] display url-template all
      ---------------------------------------------------------------
      ID                 URL      Start    Assignment    Isolate
      Number   Mark     Mark           Mark
      ---------------------------------------------------------------
      0                  1         ?         =               &
      1                  0
      2                  1         ?         =               &
      ---------------------------------------------------------------
      Total 3

   2. Query the URL template configuration based on the URL template ID.
      • URL template 0 corresponds to the built-in Portal server configuration on the AC.

        [Huawei-AP] display url-template id 0
        ID   : 0
        Name : portal-local-server*
        URL  :
         1. http://12.12.12.76:2000/index.html
        Start mark      : ?
        Assignment mark : =
        Isolate mark    : &
        AC IP           :
        AC MAC          :
        AP IP           :
        AP MAC          :
        User MAC        :
        Redirect URL    :
        SSID            :
        User IP address :
        Sysname         :
        User VLAN       :
        AP Name         :
        AP Location     :
        AP Group Name   :
        Delimiter       :
        Format          :
        Http to ap      : 1
        Https to ap     : 1
        Server State    : 0
        Server ip       : 12.12.12.76
        Server ipv6     : ::
        Do not Redirect : 0
        URL cipher name :
        URL iv name     :
        URL cipher key  :
        AC IP Value     :
        AC MAC Value    :
        Sysname Text    :
        AP IP Value     :

      • URL template 1 corresponds to the Portal server template configuration on the AC.

        [Huawei-AP] display url-template id 1
        ID   : 1
        Name : portal_test
        URL  :
        Start mark      :
        Assignment mark :
        Isolate mark    :
        AC IP           :
        AC MAC          :
        AP IP           :
        AP MAC          :
        User MAC        :
        Redirect URL    :
        SSID            :
        User IP address :
        Sysname         :
        User VLAN       :
        AP Name         :
        AP Location     :
        AP Group Name   :
        Delimiter       :
        Format          :
        Http to ap      : 1
        Https to ap     : 1
        Server State    : 0
        Server ip       : 12.12.12.1
        Server ipv6     : ::
        Do not Redirect : 0
        URL cipher name :
        URL iv name     :
        URL cipher key  :
        AC IP Value     :
        AC MAC Value    :
        Sysname Text    :
        AP IP Value     :

      • URL template 2 corresponds to the URL template configuration on the AC.

        [Huawei-AP] display url-template id 2
        ID   : 2
        Name : url_test
        URL  :
        1. http://12.12.12.1:8080/portal
        Start mark      : ?
        Assignment mark : =
        Isolate mark    : &
        AC IP           : ac-ip
        AC MAC          :
        AP IP           :
        AP MAC          :
        User MAC        :
        Redirect URL    :
        SSID            : ssid
        User IP address : userip
        Sysname         :
        User VLAN       :
        AP Name         :
        AP Location     :
        AP Group Name   :
        Delimiter       :
        Format          :
        Http to ap      : 0
        Https to ap     : 0
        Server State    : 0
        Server ip       : 0.0.0.0
        Server ipv6     : ::
        Do not Redirect : 0
        URL cipher name :
        URL iv name     :
        URL cipher key  :
        AC IP Value     :
        AC MAC Value    :
        Sysname Text    :
        AP IP Value     :

2. Check the Portal authentication configuration delivered to the AP.

   [Huawei-AP] display portal config
   Portal CnaBypass  : disable
   Portal CnaAdaptive: enable
   Portal User Agent : enable
   Portal URL Encode : disable
   Portal Https redirect : enable         port 64443
   Portal JS Redirect: disable
   Portal 302 Redirect: disable
   Portal DNS Permit: disable
   Vlan config info:
   --------------------------------------------------------------
   Vlanid   main web index   main url index   back web index   back url index
   --------------------------------------------------------------
   Bssid config info:
   --------------------------------------------------------------
   Vapid Bssid main web index main url index back web index back url index
   1     27    0              0               255            255
   2     28    1              2               255            255
   17    30    0              0               255            255
   18    31    1              2               255            255
   --------------------------------------------------------------

   main web index indicates the active Portal server, main url index indicates the active URL template, back web index indicates the standby Portal server, and back url index indicates the standby URL template.

   You can check whether the binding relationship delivered to the AP is correct based on the global Portal authentication on the AP. If not, unbind the authentication profile from the AC VAP profile and then bind the authentication profile again.

   To view authentication-free rules on the AP, run the display portal free-rule command in versions earlier than V200R010 or run the display wsrv portal free-rule command in V200R010 or later.

   [Huawei-AP-diagnose] display wsrv portal free-rule
   ----------------------------------------------------------------
   Dynamic IPv4 free rule
   destination IP 12.12.12.6 mask 255.255.255.255
   destination IP 50.1.1.1 mask 255.255.255.255
   Total 2
   ----------------------------------------------------------------
   Profile ID 0
   Rule   1:  destination IP 8.8.8.8 mask 255.255.255.0
   Total 1
   ----------------------------------------------------------------
   Profile ID 1
   Rule   1:  destination IP 8.8.8.8 mask 255.255.255.0
   Total 1
   ---------------------------------------------------------------

According to the Portal redirection mechanism, when a STA accesses an HTTPS web page, the device intercepts the traffic of the HTTPS (default port 443) TCP fixed port and forges the destination address to be accessed by the STA to establish a TCP connection with the STA. After the TCP connection is established, the SSL handshake is performed. The SSL handshake uses the built-in signature certificate of the device, but the built-in certificate of the device from the signature certificate is not issued by a legitimate organization. Therefore, whether the redirection can be successful depends on the security policy of the browser. Some STA browsers generate alarms when verifying the server certificate. After you click Trust, the Portal page can be displayed. Some browsers do not display the prompt page and directly interrupt the access.

When the HTTP Strict Transport Security (HSTS) function is enabled for a website, a browser must use HTTPS and a valid certificate to access the website. During HTTPS redirection, the device uses a self-signed certificate (this is because the device cannot have the certificate of the target website) to pretend to be the target website and establish an SSL connection with the browser. If the website has the HSTS function enabled, the browser will detect that the certificate is untrusted. As a result, redirection fails, as shown in the following figure (in this example, Google Chrome is used).

The HTTP proxy or a port other than port 80 or 443 is used on the network. If this problem occurs, obtain packets on the STA or check the browser configuration on the STA. For example, on Internet Explorer of a Windows STA. Choose Internet Properties > Connections > LAN settings.