Configuring Captive Bypassing for WLAN in LWA and CWA (GUI), Configuring Captive Bypassing for WLAN in LWA and CWA
A captive bypass is a network behavior that
-
enables client devices to automatically determine Internet connectivity and initiate authentication flows,
-
may enable users to bypass captive portal splash pages through protocols such as WISPr.
-
involves interaction between devices (such as Apple iOS) and Controllers, affecting web redirection and authentication.
Additional reference information
WISPr is a draft protocol that enables users to roam between different wireless service providers. Devices like Apple iOS use HTTP WISPr requests to check if they are connected to the Internet.
When direct Internet connectivity is not detected, these mechanisms prompt the device to open a web browser so the user can enter credentials for Internet access. Authentication occurs in the background whenever the device connects to a new SSID.
When an Apple iOS device connects, it sends a WISPr request to the Controller, which checks the user agent details and then triggers an HTTP request with web authentication interception. After verifying the iOS version and browser details, the Controller allows the client device to bypass captive portal settings and access the Internet.
This HTTP request triggers web authentication interception on the Controller just as any other page requests do. This leads to the standard web authentication process. If web authentication uses splash page features (such as a URL from a configured RADIUS server), the splash page might not appear for the user because WISPr requests occur at short intervals. Once a query reaches the server, web redirection or splash page display running in the background is cancelled, and the device processes the page request, which may prevent the splash page from being displayed as intended.
Example
For instance, Apple introduced an iOS feature that detects captive portals by sending a web request upon connecting to a wireless network. On iOS 6 and earlier, the request is sent to http://www.apple.com/library/test/success.html. On iOS 7 and later, multiple possible URLs are used. If a response is received, Internet access is assumed and no further interaction occurs. If no response is received, Internet access is assumed to be blocked and the device’s Captive Network Assistant (CNA) auto-launches a pseudo-browser to prompt for portal login. The CNA may not function properly if it is redirected to an ISE captive portal. The Controller can suppress the pop-up of the pseudo-browser. Network administrators can configure the Controller to bypass WISPr detection. In this configuration, web authentication interception only occurs when a user intentionally requests a web page, ensuring the splash page is loaded in the user's browser context and not triggered by background connectivity probes.
Analogy: Sneaking into an amusement park
Captive bypassing is like someone sneaking into an amusement park through a side door, instead of showing their ticket at the main entrance. Some devices use automated checks to find shortcuts and access the internet without going through the intended login page, just as clever visitors might bypass security by finding an easier way in. Network controls are needed to make sure everyone enters through the main gate and checks in properly.