Skip to main content

Search

Cloudi-Fi Knowledge Base

The captive portal does not appear automatically on Cisco Meraki

Simon Mesnage
  • Updated

Use this article when devices connect to the guest SSID on Cisco Meraki, but the Cloudi-Fi Captive Portal does not open on its own. 

Estimated time: 15 minutes.

The steps apply to the click-through setup described in How to enable Cloudi-Fi with Cisco Meraki MX/MR (API). For MR with RADIUS, the walled garden and DNS checks also apply. See How to enable Cloudi-Fi with Cisco Meraki MR with Radius for its splash page settings.

Prerequisites

Before starting, ensure that you have the following prerequisites:

  • Access to Cloudi-Fi's admin console
  • Access to the Cisco Meraki dashboard
  • A test device connected to the affected guest SSID
  • Synchronization of Meraki networks with Cloudi-Fi

1. Check whether the portal opens manually

  1. On the test device, forget the guest SSID, then reconnect to it.
  2. Confirm that the device receives an IP address in the guest subnet.
  3. Open a browser and go to a plain HTTP page, for example, http://neversslcom. HTTPS pages cannot be redirected.

Use the result to choose the next step:

  • The portal appears. The redirection works, and the device does not detect the portal on its own. Go to step 3.
  • The browser shows an error, stays blank, or loads the requested site without the portal. Go to step 2.

2. Check the splash page settings

  1. In the Meraki dashboard, select the network that has the issue.
  2. For MR/CW devices, go to "Wireless" > "Configure" > "Splash page". For MX devices, go to "Security & SD-WAN" > "Configure" > "Splash page".
  3. Select the SSID (or the VLAN for MX).
  4. Confirm that the "Custom splash URL" option is selected and that the field contains a Cloudi-Fi URL.
  5. In the Cloudi-Fi admin console, go to "Configuration" > "Integrations" > "Meraki". Click the three-dot button, select "Configure SSIDs", open the "Manual" tab, and copy the splash page URL.
  6. Compare it with the URL in Meraki. If they differ, for example because the URL contains an access point identifier that no longer exists or was copied from another site, replace it with the URL from Cloudi-Fi. See Splash page configuration update for Meraki's captive portal.
  7. Paste the URL in a browser. The captive portal should open. This confirms that the URL is valid, not that Meraki redirects to it.

3. Check the walled garden

  1. In the Meraki dashboard, go to "Wireless" > "Configure" > "Access Control" for MR/CW devices, or "Security & SD-WAN" > "Configure" > "Access Control" for MX devices.
  2. Select the SSID (or the VLAN for MX).
  3. Confirm that "Captive portal strength" is set to "Block all access until sign-on is complete" and that the walled garden is enabled.
  4. Confirm that the walled garden ranges include *.cloudi-fi.net and the domains required by the authentication methods enabled on the portal. The full list is in Set up a Walled Garden for your captive portal.
  5. Remove any entry added for the connectivity checks that devices use to detect a captive portal, such as captive.apple.com, msftconnecttest.com, or connectivitycheck.gstatic.com. If a device can reach these addresses before sign-in, it assumes that Internet access is available and does not open the portal.
  6. Save the changes, then forget and reconnect to the SSID on the test device.

4. Check DNS, HTTP, and HTTPS flows

The guest subnet must be able to resolve names and reach the Cloudi-Fi servers before sign-in. Confirm that the firewall allows the following flows.

Source Destination Port Protocol Action Comment
Guest subnet Any 80 TCP Allow HTTP traffic
Guest subnet Any 443 TCP Allow HTTPS traffic
Guest subnet Any 53 UDP/TCP Allow DNS resolution
* * * * Deny To be adjusted according to your needs


Then test DNS from a laptop connected to the guest SSID. Open a terminal or command prompt and run:

nslookup login.cloudi-fi.net
  • The command returns an IP address. DNS works. Go to step 5.
  • The command times out or returns an error. The guest subnet cannot reach a DNS server. Check the DNS rule above and the DNS servers distributed to guest clients.

5. Verify the Cloudi-Fi Integration

If you have done the integration through the API with this article; make sure you have selected the appropriate SSID.

 

6. Retest on several devices

  1. Forget and reconnect to the guest SSID on an iOS device, an Android device, and a laptop.
  2. Wait for the portal to open on its own.
  3. Note which devices fail. If the portal opens manually (step 1) but not automatically on one operating system only, include this in the information sent to support. 

7. Contact your support

If the portal still does not appear, contact the Cloudi-Fi support team and share the following information:

  • The SSID name and the Cloudi-Fi location
  • The name or MAC address of the access point used
  • The date and time of the test, with the time zone
  • The device model and operating system
  • The result of the manual HTTP test (step 1) and of the nslookup command (step 4)
  • A HAR file of the failing connection: web browser, Android, or Apple iPhone and iPad

What's next?