Splash page appearance

The normal user experience when connecting client devices to a Wi-Fi network with a Splash Page is that the Splash Page is opened automatically, thanks to the Automatic Detection of Captive Portal mechanism, known as CNA,  so that the user can see it and proceed with the authentication to get full access to internet.

 

What is CNA?

The CNA, Captive network assistant ( WiFi popup or overlay), is the actually limited browser that automatically opens on most mobile devices these days.

When smarhphone OS (iOS, Android, Windows…) detect that they are in a captive portal environment it will automatically open CNA browser.

By smartphone OS default, it is set to help users to navigate any potential captive portal process, and also there are no SSL cert warnings.

If the CNA is not present in smartphone OS, user will need to open a browser app and trigger the captive portal manually by typing some URL.

How CNA works?

When a smartphone connects to the WiFi network it pings connectivity URLs (iOS, Android, Windows…) and checks if there is a working Internet.

If the smartphone can’t connect to the connectivity URL it opens automatically limited CNA browser that provides login page.

Immediately after login, when user connects to the Internet, the smartphone automatically closes CNA browser, and for that reason a user may not be redirected to the URL configured or welcome page.

Users who ignore CNA and login to the Internet using their favourite browser app (Chrome, Safari, Opera…) will not have these issues.

It is important to state that the decision to automatically open or not the Splash Page is entirely taken by the OS on the client device.

Different Wi-Fi client devices implement this mechanism with different approaches:

When the Splash Page is not automatically opened by the client device, the reason might be one of the following:

 

If all the previous points have been verified and the client device does not open automatically the Splash Page, it might not support the Automatic Detection of Captive Portal.

In this case, the only solution is to manually open the Splash Page. It will be needed to inform the user about how to proceed:

Wi-Fi users are becoming every day more and more tech-savvy, and this procedure is becoming the equivalent of restarting the computer when something is not working properly.

The Splash Page is not triggered when iOS devices connect to WiFi

How iOS determine if it has an Internet Connection

• The iOS and Mac OS X devices check for the following domains which are hosted on Akamai network:

• If the domain is accessible and returns “Success”, the Captive Portal is not triggered automatically. “Success” response means the device is connected to the internet.

Some iOS devices are not redirected to the Captive Portal when the user gets connected to WiFi network with iOS device.

The Captive Portal is not triggered automatically when is the testing domain accessible.
If the testing domain is not accessible, CNA (Captive Network Assistant) popup is shown.

How to test it on iOS

Make sure you have no active internet session. If yes, wait until your active session expires.

• Check Auto-Join and Auto-Login settings

a. Launch the Settings app on your iPhone or iPad.
b. Tap on Wi-Fi
c. Tap on the info button next to the network name.
d. Turn Auto-Join and Auto-Login on

See the article at https://support.apple.com/en-us/HT204497 for more information

•  Forget a Wi-Fi network

a. Launch the Settings app on your iPhone or iPad.
b. Tap on Wi-Fi.
c. Tap on the info button next to the network name.
d. Tap on Forget This Network.

See the article at http://www.imore.com/how-forget-wi-fi-network-your-iphone-or-ipad for more information

•  Connect to your WiFi network

•  Do not connect through HotSpot Captive Portal

•  Open regular Safari browser and enter the “captive.apple.com” to the URL

•  If you get the “Success”, Apple’s domain is accessible

Possible solution

• Forget a Wi-Fi network

a. Launch the Settings app on your iPhone or iPad.
b. Tap on Wi-Fi.
c. Tap on the info button next to the network name.
d. Tap on Forget This Network.

• Restart your iOS Device. Based on our experiences, restarting the iOS device should resolve the issue with CNA (Captive Network Assistant)

• Check your Walled Garden settings or your Firewall Policy. The akamaihd.net and akamai.net domains and IP addresses have to be inaccessible to unauthenticated users

The Splash Page is not triggered when Android devices connect to WiFi

Some Android-based devices are not redirected to the Captive Portal when the user gets connected to WiFi network with Android device.

The Captive Portal is not triggered automatically when is the testing domain accessible. On some Androids is that feature missing.

How Android determine if it has an Internet Connection

• The Android devices check for the following domains which are hosted on Akamai network:

and other domains used for this purpose by Google.

• If the domain is accessible and returns “generate204” code, the captive portal is not triggered automatically. “generate204” response means the device is connected to the internet.

How to test it on Android

Make sure you have no active internet session. If yes, wait until your active session expires.

• Connect to your WiFi network

• Do not connect through Hotspot Captive Portal

• Open regular Android browser such as Google Chrome and enter the “clients3.google.com” to the URL

– Android DNS cache can influence the result. It is recommended to repeat procedure on desktop version of Google Chrome in incognito mode

• If you are redirected to the Google.com domain, the Google.com domain is accessible

Possible solution

• Check your Walled Garden settings or your Firewall Policy. *.google.com domains and/or corresponding IP addresses have to be inaccessible to unauthenticated users.

• If you won’t use or don’t use a Google Authentication method.
Remove all walled garden entries.

• If you’ll want to use or you use a Google Authentication method
Possible solution how to prevent this issue is to use following Google Walled Garden list and replace all *.google.com domains by the complete list of third-level domains Google use in your region.

The Splash Page is not triggered when Windows devices connect to WiFi

Some Windows devices are not redirected to the Captive Portal when the user gets connected to WiFi network with Windows device.

The Captive Portal is not triggered automatically when is the testing domain accessible. Network Connectivity Status Indicator (NCSI) service testing internet connectivity has been introduced in Windows Vista at first.

How Windows determine if it has an Internet Connection

Windows does indeed check a Microsoft site for connectivity, using the Network Connectivity Status Indicator site (NCSI).

There are a few variations of the connection checking process:

• NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt. This file is a plain-text file and contains only the text Microsoft NCSI

• NCSI performs a DNS lookup on www.msftncsi.com, then requests http://www.msftncsi.com/ncsi.txt. This file is a plain-text file and contains only the text Microsoft NCSI

How to test it on Windows

Make sure you have no active internet session. If yes, wait until your active session expires.

• Connect to your WiFi network

• Do not connect through Hotspot Captive Portal

• Open regular browser (Ie, Chrome, Firefox) and enter the “www.msftncsi.com” or “http://www.msftncsi.com/ncsi.txt” to the URL

• If the page above is accessible you are no redirected to the Hotspot Captive Portal

Possible solution

• Check your Walled Garden settings or your Firewall Policy.

The www.msftncsi.com domains and corresponding IP (131.107.255.255) address have to be inaccessible to unauthenticated users.

• Check the NCSI service is enabled in the registry settings:

a. Search for HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNlaSvcParametersInternet

b. Under the Internet key, double-click EnableActiveProbing, and then in Value data, type: 0.The default for this value is 1. Setting the value to 0 prevents NCSI from connecting to a site on the Internet during checks for connectivity.