CWP gives page cannot be displayed

  • 3
  • Question
  • Updated 4 years ago
  • Answered
I tried to enable a CWP page for an SSID and receive a "page cannot be displayed" message when I open my browser. I verified my ip settings (DHCP) and can ping both ip and hostnames from command prompt. The only thing this CWP page displays is the acceptable use policy and a "I accept" and "I decline" button.
Even though I can ping to the outside I cannot get my browser to browse.
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes
  • confused as to why I am giving this much thought to a "how do you feel" question.

Posted 4 years ago

  • 3
Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Andy,

By chance have you disabled the web server on your AP(s)? When you say that your are receiving a valid IP address and can ping resources (presumably) behind the AP this is the only thing I can think of to explain your problem, other than something uncommon.

To confirm that the web server is enabled, open the Network Policy which has been pushed to your APs, navigate to "Additional Settings > Service Settings" and ensure that there is a checkbox next to "Enable the web server".


Hope this helps
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes

I checked, the webserver is enabled.  But its funny that you mention the webserver, because it acts like that would be the problem.  The page sits there and tries to load, but to no avail.  I did figure out that if I put the ip address of the AP into the browser, I get the CWP page, I can click accept, and then I can browse the internet.  I was hoping that I wouldn't have to do that.  Any suggestions?
(Edited)
Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Andy,

The fact that you mention that you can manually pull up the CWP by the AP's Mgt0 address, could you tell me whether you have External or Internal DHCP and DNS set on the CWP?


Thanks in advance
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes

I assume the external DHCP and DNS server setting means that the DHCP and the DNS are not held on the AP itself.  They are hosted on a corporate DHCP and corporate DNS server, but not on the AP.

Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Andy,

Correct, in this case External DHCP/DNS means that the AP is not hosting those services specifically for the CWP, which is a common configuration.

Unfortunately I am running out of ideas, hence the basic nature of the following questions:
  1. Have you tried another browser other than Internet Explorer or a different version of IE (on another machine)
  2. Have you tried a different client other than yours to see if the behavior follows the client change?
If none of the above helps you out it may be easier to open a support ticket either with Aerohive Support or your supporting partner as troubleshooting this issue may become more in-depth than I can provide here. If you do contact support, could you come back and post a solution here? This way if anyone searches for this question they could find an answer.

I'll go ahead and leave this thread open in case one of my colleagues or another community member may have any ideas that I have missed.




Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes

is there a specific DNS entry I should add?

Photo of Eastman Rivai

Eastman Rivai, Official Rep

  • 146 Posts
  • 17 Reply Likes
Andy,

On your machine can you do nslookup and look for a web address. It will saw you your DNS server. 
http://prntscr.com/3n4pjr
Can you also check if you have an IP Policy applied to the user profile? If you do, ensure that DNS is allowed.

Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes
the nslookup completes.  And under IP Policy DNS is set to any any permit.
Photo of Eastman Rivai

Eastman Rivai, Official Rep

  • 146 Posts
  • 17 Reply Likes
Is it possible to share your running config? Have you tried the points suggested by Brian?
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes
It is an IE problem.  Firefox redirects without issue.  I even tried it with the 302 redirect option, but that didn't work either.  If your IE has a home page, the redirect will not work.  I had to manually type in the address of the AP to get the CWP page to come up.  If your home page is "about:tabs", then  you can type in an address or you can choose a previous tab, and the redirect works fine.  Does anyone have any ideas on how to work around this?  And remember, this is for a guest network, so not using IE is not an option.
Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Andy,

I took another look after what you said but unfortunately I have not been able to reproduce your issue. May I ask what version of HiveOS, model of AP and whether or not you are using the default CWP or a custom uploaded pages? I am curious, if you are using customer HTML for your CWP would you be able to try with the default CWP UPA web pages?

When I tried this on both an AP330 running 6.1r3b as well as an AP230 running the latest beta code, with a homepage of google.com set in IE 11 on Windows 8.1 I was successful. When I brought up IE I was redirected to the CWP when the browser tried to navigate to google.com and after I accepted the T&C I was able to browse to the internet.

Screencap of my Internet Options settings in IE 11:


Screencap of my CWP settings, note that I am using the default web pages:


Screencast of this test at home (please forgive the HTTPS untrusted cert errors, I did not properly configure a valid certificate as this was just a quick test):
http://screencast.com/t/05qDZqTa6j

Hope this helps
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes

Hive Ver. Enterprise   6.1r2b.

AP 121

Windows 7 SP1 x64

IE 11.0.8



Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes
the only change I made to the redirect page was an upload of our company logo.  Everything else is the same.
Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi andy,
Can you please share the version of HiveOS which you are running on your AP121s? I see that you are running HiveManager 6.1r2b, are you also running HiveOS 6.1r2 on your APs?

I'll be honest, I'm not quite sure where to have you go from here; I ran another series of tests in the office this afternoon and I have not been able to replicate the IE failure. I have tried the following iterations but each time have seen a successful test:



On both client PCs Internet Explorer was set to use a homepage (http://google.com"), not the new tabs page:


Once I get home I can post the exact version of IE 11 used on my Windows 8.1 machine but as I have automatic updates enabled there as well I expect they are the same.


[Update] here is the version information from my Windows 8.1 client used in the above tests


Can you confirm if you have tried multiple PCs? Unfortunately at this point it does not look like a systemic issue (unless you are running a different version of HiveOS, but I would recommend upgrading if you are older than the versions mentioned here). At this point I would recommend either reaching out to Aerohive Support as it looks like you are based in the US or contacting Microsoft to troubleshoot the client side, or both. I am certainly open to other suggestions, but at this point I am frankly stumped unless this is related to some obscure client setting that is interfering with the CWP behavior.

Hope this helps
(Edited)
Photo of andy

andy

  • 9 Posts
  • 0 Reply Likes

HiveOS 6.1r2.1359  AP  ver 3.0.9


Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Sorry Andy, I somehow missed seeing you reply earlier. As I was unable to find any systemic issues with IE 11 and our CWP, I was just curious if you had any luck with either Aerohive or Microsoft support? While I wasn't able to think of a reason for the incompatibility you were seeing on our side, I am still interested in knowing, just in case anyone else runs into this same issue, if you were able to determine the root cause of this problem?
Photo of Patience

Patience

  • 61 Posts
  • 0 Reply Likes
We are using AP230 in our test bench and all AP330, AP121 are good but 230 is showing issue popping our Custom CWP, and client end up getting APIPA IP address. I have open ticket with ATAC couple of weeks ago and still pending.
(Edited)
Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes
I have an AP230 working with CWP with external page and 3rd party certificates

CWP would occur after DHCP assignment from an open SSID
Open SSID
client authentication
client association
DHCP exchange - firewall rules apply here
client opens web browser
searches for url, hopefully not HTTPS - also browsers can make a difference

dns resolves and returns query, AP intercepts this query and provides client query pointing to 1.1.1.1
there is a whole lot of magic in the background
depending on the wifi interface and sub interface the CWP will have various virtual interfaces and clients will be assigned a virtual IP.
So client's real IP will be mapped to the clients virtual IP  etc...

based on what you describe above
the first issue is client not getting a DHCP address for your open SSID on the 230, which could be because the vlan is not present or reachable.
I would use the vlan probe on the 230 see if the AP can get an IP for that particular vlan.

If not I would verify the switch config

What sort of CWP are you running?

Photo of Patience

Patience

  • 61 Posts
  • 0 Reply Likes
Thanks, Andrew!
Your steps or say Life cycle of CWP helped me to find the problem. It was the Hive OS 6.1r5 I am using on AP230 is not backward compatible with 6.1r3b and below for Firewall rules that I was using to restrict traffic. 
It was not the vlans or switch port issue as other AP120, AP121, AP330 are working on same switch port with same network policy but different Hive OS versions.
I wonder when Aerohive really learn how to do clean QA testing before launch new firmwares. We always had issue whenever we upgrade new firmware something would break. I did firmware upgrade to 6.1r5 just to support SR2148P, and AP230 else I would never do and even discourage to renew support agreement cause all ATAC do is ask us to upgrade firmware because the problem is on current software.
Thanks again Camp.
Photo of Patience

Patience

  • 61 Posts
  • 0 Reply Likes
We use following firmwares:
Hive Manager: 6.1r5 
Hive OS AP230: 6.1r5
Hive OS AP121: 6.1r3b
Hive OS AP330: 6.1r3b
Hive OS AP170: 6.1r3b
Hive OS AP120: 5.1r5

Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Dhiraj,

I have tested this our CWP using both internal and external DHCP/DNS as recently as last evening on my AP230 at home and did not see the behavior you mention using a Galaxy S4, iPhone 4 and early-2013 MacBook Pro.

All this tells me is that there does not appear to be a systemic issue on the AP230, so I would suggest continuing to work with Support on your specific case or opening a new thread as this appears to be a completely separate issue than the one originally reported. The OP reported that his clients DID receive a DHCP address and would properly redirect when a browser other than IE was used, so this does not sound like what you are reporting.
Photo of Patience

Patience

  • 61 Posts
  • 0 Reply Likes
I have tested on AP121, AP330 and AP230 using same network policy and same switch port using iPhone 5 and it works on AP121 and AP330 but doesn't work on AP230. I even tried using default CWP pages with external DNS/DHCP and still the same. I am replying on this thread just to say that there is 100% systemic issue on the AP230.
Photo of Brian Ambler

Brian Ambler

  • 245 Posts
  • 126 Reply Likes
Hi Dhiraj,

Unfortunately I must disagree with you on your last comment about there being a systemic issue on the AP230 regarding CWP interoperability. While I certainly agree that you are seeing something of an issue on your end, there does not appear to be any trends of systemic issues with this functionality on the AP230 platform, something that my own personal tests have show as recently as the other day.

I would suggest continuing to work with the engineer assigned to your support ticket to determine why in this situation, your AP230s are exhibiting an issue on the same port/configuration as another working AP.
Photo of Patience

Patience

  • 61 Posts
  • 0 Reply Likes
It was the Hive OS 6.1r5 I am using on AP230 is not backward compatible with 6.1r3b and below for Firewall rules that I was using to restrict traffic. What do you consider this, a network config error, a systemic error or OS bugs? 
It was not the vlans or switch port issue as other AP120, AP121, AP330 are working on same switch port with same network policy but different Hive OS versions.
I wonder when Aerohive really learn how to do clean QA testing before launching new firmwares. We always had issue whenever we upgrade new firmware, something would break. I did firmware upgrade to 6.1r5 just to support SR2148P, and AP230 else I would never do and even discourage to renew support agreement cause all ATAC do is ask us to upgrade latest firmware because the problem is on current software.