Captive portal NAC + Apple Devices OSX

[Tiago_Molinos]

Hi there,

we've been setting up a wireless lan solution with NAC + a couple of identify controllers.
At the moment we're fine tunning the guest network.

I'm running the latest NAC appliance software and version 9.21.04 on the controllers (5110 + v2110).

Right now I'm concerned with two different problems:

1 - Whenever I try to connect an Apple OSX device, it pops up an error:

If I ignore the error and go straight to the browser and open a random page then the portal appears and I can register a device. After the registration is successful I end up in problem #2.

2 - On all Apple devices, after the registration is successful the device never renews the IP address and the eventually an error in the portal is displayed. If I manually reconnect to the network than it gets the correct IP address.

Any suggestion?

Best Regards,

Tiago

[Joseph_Burnswor]

Please do, I have tested with an OSX 10 machine that I have here and I cannot replicate what you have going on. One last question if I may, When that device is connected, can it resolve apple.com if you try to ping it? I do not expect you to get a ping response, but rather just resolve the address.

If it does not resolve the IP, the we have a DNS issue and that will cause your problems you are seeing

[Tiago_Molinos]

Hello,

just a few updates...

The popup now shows even if the "apple.com" allowed domain is removed. The problem is that it still pops up with the error.

I've added a policy for allowing DHCP Client, but it didn't solve the pop up issue.

I'm thinking of involving TAC on this on. I'll let you know how it goes!

Thanks!

Tiago

[Tiago_Molinos]

That's already enabled. It works for iDevices, Android Phones, Windows PCs... It doesn't work on MAC OSX (at least version 10 El Capitan). The popup shows, but with the error on the screenshot on post #1.

[Joseph_Burnswor]

One thing that I have ran into is that with OSX, for some reason, you have to allow a DHCP client and DHCP server. It looks to be you have let the server through but not the client or am I reading this wrong?

[Tiago_Molinos]

No problem...

The first two blurred IPs are the IP Addresses of the remediation network on each controller, and the third one is the IP address of the NAC Appliance.