Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 1000 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Firewall and BYOD WiFi on VLAN in a school

Jeremy Woodham

New install of XG Firewall in a UK school and I am really struggling to get the Capture Portal to work on IOS and Android devices.

  • It works for Windows devices, as soon as I connect to the network, a logon window appears (not the sophos one) and I can authenticate and browse the internet.
  • On IOS when connected to the WiFi it gets an IP on the correct VLAN, however the Capture Portal does not appear, it will only appear if we browse to it in safari or chrome. Once logged in, I can access the internet with no issues
  • Android pops up a certificate error page, again if I get to the portal by typing in the URL it works. I have purchased a globally signed certificate but still fails if HTTPS is on or off

Sophos support have spent most of the week on it, to finally tell me that I need to get a certificate for the IP address and not the URL, or install the client. The Client is not an option for over 1000 students and 90+ staff.

If I was to get another certificate, what do I need and which IP address do I use? Or is there a another solution?

I am desperate for a solution and under huge pressure to get this resolved ASAP.

Thanks



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Jeremy Woodham

    And this hostname, you are using. Is this the hostname, somebody can publicly resolve? 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Ah, right, support didn't tell me that.

    Back to square one!

    Thanks

  • 0 in reply to Jeremy Woodham

    Let me put something in perspective: 

    You are using a Hostname for the firewall and the firewall is using a Certificate for this hostname. 

    Let say: XG.customer.local

    if a client connects to your firewall, it will do the check to get the captive portal. If this resolves to XG.customer.local, it will ask the DNS (which could be the firewall or not). The IP will be resolved and connected to. 

    In case of connection, the firewall will use the hostname, the client was provided. So you could have a problem here. Internal DNS is not resolving to the original IP. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Thanks for staying with me on this, I really appreciate it as this is outside of my understanding, but I have setup the following.

    The firewall is know internally as XG.int.domain.com (int is our internal sub domain and not externally resolved)

    The Firewall has two internal IPs Corporate - 10.0.0.XX1, WiFi 10.0.40.xx1, both IPs are resolved internally via internal DNS

    The external IP does not resolve to that url. 

    The CSR was made with the two internal IPs and the internal URL.

    So would the best practice be that I need to rename it to XG.domain.com, create a new CSR for the two internal IPs and the external IP, and add the host name to the internal DNS for the two internal IPs?

Unfiltered HTML