AC6508 built-in Portal

Possible Causes

1. The terminal cannot access the DNS server using the browser.

   After connecting to a Wi-Fi network, some terminals send HTTP Probe Request packets to the DNS server to detect network connectivity before passing Portal authentication. When an access device receives an HTTP connection request packet from a terminal:

• If the packet is destined for the Portal server or authentication-free resources, the access device permits the packet, and the terminal can directly access the Portal server or authentication-free resources.

• If the packet is destined for other addresses, the access device redirects the HTTP packet to the Portal authentication page. By default, the access device does not add the domain name of the DNS server to the authentication-free network resources. Therefore, the Portal authentication page cannot be displayed on the terminal browser. You can configure an authentication-free rule to solve this problem. For details, see Configuring an authentication-free rule.

  

  Typically, the domain name of the DNS server is www.msftconnecttest.com or www.msfgncsi.com for Windows PCs, connectivitycheck.platform.hicloud.com for Android mobile phones, and captive.apple.com for iOS terminals.

  These DNS server domain names are for reference only.

The root certificate authority is not trusted.

For security purposes, the access device provides the Portal authentication function in HTTPS mode. When accessing the HTTPS-based Portal server through the web browser, a terminal checks whether the certificate of the Portal server is issued by a trusted certification authority (CA). The web browser contains some certificates issued by trusted CAs by default. You can also import the root certificate of a CA to the web browser to increase the trusted CAs.

If the certificate carried by the website is issued by an untrusted CA:

You can try the following methods to solve the problem: Using another browser, Importing certificates, and Changing the mode of Portal authentication.

• Some browsers (such as Chrome) directly interrupt the Portal server access process if the network connection is abnormal and the certificate is invalid. As a result, the Portal authentication page cannot be displayed on the terminal browser.

• Some browsers (such as Internet Explorer) display a message indicating that the web page is insecure. However, you can ignore the alarm and continue to access the Portal server page.

Solution

In built-in Portal authentication scenarios, the following solutions are recommended (in descending order of priority): changing the mode of Portal authentication > importing a certificate > using another browser > configuring an authentication-free rule.

In external Portal authentication scenarios, the following solutions are recommended (in descending order of priority): importing a certificate > using another browser > configuring an authentication-free rule.

In external Portal authentication scenarios, changing the mode of Portal authentication is not recommended.

Importing certificates

You need to import a trusted certificate to the Portal server.

• For details about the solution to the security certificate problem in built-in Portal authentication scenarios, see How Can I Handle a "Security Certificate Problem" Message During Built-in Portal Authentication?.

• In external Portal authentication scenarios, import a trusted certificate to the Portal server.

Using another browser

• You are advised to use Internet Explorer.

Changing the mode of Portal authentication

Configure the Portal server to provide Portal authentication in HTTP mode rather than in HTTPS mode.

• In built-in Portal authentication scenarios, configure the built-in Portal server to exchange authentication information with users using the HTTP protocol.

  <HUAWEI> system-view
  [HUAWEI]portal local-server ip 10.1.1.1
  [HUAWEI-url-template-huawei]portal local-server http port 8080
  

• In external Portal authentication scenarios, configure the Portal server to exchange authentication information with users using the HTTP protocol.

Configuring an authentication-free rule

Configure an authentication-free rule on the device to allow terminals to access the DNS server without authentication.

When this method is used, the Portal authentication page cannot be directly displayed when a terminal accesses the network. You need to enter any URL except the authentication-free domain name in a browser to forcibly redirect to the Portal authentication page.

1. If the domain name of the DNS server is www.msftconnecttest.com, create a global domain name whose name is www.msftconnecttest.com and ID is 0.

   <HUAWEI>system-view
   [HUAWEI]passthrough-domain name www.msftconnecttest.com id 0
   

2. Add a rule to ACL 6001 to match packets destined for www.msftconnecttest.com, create an authentication-free rule profile default_free_rule and configure the authentication-free rule defined by ACL 6001.

   [HUAWEI]acl 6001
   [HUAWEI-acl-ucl-6001]rule 5 permit ip destination passthrough-domain www.msftconnecttest.com
   [HUAWEI-acl-ucl-6001]quit
   [HUAWEI]free-rule-template name default_free_rule
   [HUAWEI-free-rule-default_free_rule]free-rule acl 6001