Endpoint Blocking Public WiFi Splash Pages

Hi Burdett MacLean,

Can you share the Sophos Block message details? Maybe a screenshot would help.

One of our user had the same issue. Had to disabled the Sophos endpoint to enable the hotel Internet.

I could not upload the screen shot because it is over the size limitation.

Hi Philip,

Could you check if this  work around would work by adding IP/URL of the spash Page. to web protection exceptions. 

If you did not know the Spash page URL , Disable Web Protection and the URL will be revealed on your Hotspot. 

Could you let us know which Specific Product and Version was affected so we would investigate the issue. Kindly let us know the OS and Version on your machine.

We experience this as well with our instance of Sophos Endpoint (Cloud)

Issue: Splash login opens i.e. the Captive Network Assistant app and displays "A problem occurred. The webpage couldn't be loaded." 

URL: Initially: http://captive.apple.com/hotspot-detect.html then redirects to nXX.network-auth.com

OS: macOS 10.14 & 10.14.1 - High Sierra(10.13) and Sierra(10.12) are not effected nor are Windows 10 clients.

Meraki wireless APs

Backstory: This issue has been plaguing me for two weeks and the culprit was found yesterday after I temporarily moved all of the Sophos launch agents and daemons on a test client so they would't start. The issue went away immediately then returned after the Sophos plists were returned to those two directories. The splash login we have for this particular SSID doesn't allow http traffic through until signing in unless I add it to the walled garden list. While I've added the Sophos url's I know of to this list let me also point out that another SSID was created without blocking http traffic turned on and this issue still occurs.

I've turned off everything I saw with a checkbox or switch in the base policies to no avail. If I could leave the endpoint client installed/enabled and simply exclude the computer from all policies I'd know if it was a policy setting and not the client itself, but .... doesn't appear as though you can. Someone correct me if I'm wrong.

Until this issue is resolved I've halted deployment and or uninstalled Sophos on clients that have 10.14 and above.

We are using Endpoint Advanced on MacOS 10.14.1. Always using the latest update, now is on 9.8.1.

Hi Philip , 

Workaround.  

*Option 1*. Ask the client to use an https website e.g. https://Google.com on another Browser besides Safari and there should be a security Error which is normal as the client machine does not have that certificate .Make sure the Safari page is closed before attempting on another browser as the Server/Router will expect the same connection and by doing so with another browser a new connection request is sent.
*Option 2*. If the URL hostspot URL is known , ask to try to connect using a Mobile device and check URL/IPaddress of the first page it pops up and add that to Web Protection Exclusions. Only the Domain/IP would suffice as that would only be considered for an exclusion to take Place.
*Option 3*. If the path is Unknown ask the customer to run the command in terminal -> *sudo tcpdump -vv | grep href* and when the splash page fails to load close the tab and check the output on the terminal . It will give the redirect URL which should be added in Web Exception in this case 10.255.0.1 or domain only. <Attached Snapshot>
*KIndly Note* , Any web exceptions will only work if the system is connected to the internet . If You have only safari , copy the link from the output in the terminal and run the command *open <URL>* and it will open in Safari. in this example use command-> *open 10.255.0.1:4501/index.cgi* to make it simpler run the command *sudo tcpdump -vv | grep href* first exit the dump using ctrl +c and type *open <paste the URL>* ENTER or use the same URL in the Safari Browser directly.
*Option 4:* Open Terminal run the command > *open http://google.com* and captive portal will show on Safari .

Hi Philip , 

Workaround.  

*Option 1*. Ask the client to use an https website e.g. https://Google.com on another Browser besides Safari and there should be a security Error which is normal as the client machine does not have that certificate .Make sure the Safari page is closed before attempting on another browser as the Server/Router will expect the same connection and by doing so with another browser a new connection request is sent.
*Option 2*. If the URL hostspot URL is known , ask to try to connect using a Mobile device and check URL/IPaddress of the first page it pops up and add that to Web Protection Exclusions. Only the Domain/IP would suffice as that would only be considered for an exclusion to take Place.
*Option 3*. If the path is Unknown ask the customer to run the command in terminal -> *sudo tcpdump -vv | grep href* and when the splash page fails to load close the tab and check the output on the terminal . It will give the redirect URL which should be added in Web Exception in this case 10.255.0.1 or domain only. <Attached Snapshot>
*KIndly Note* , Any web exceptions will only work if the system is connected to the internet . If You have only safari , copy the link from the output in the terminal and run the command *open <URL>* and it will open in Safari. in this example use command-> *open 10.255.0.1:4501/index.cgi* to make it simpler run the command *sudo tcpdump -vv | grep href* first exit the dump using ctrl +c and type *open <paste the URL>* ENTER or use the same URL in the Safari Browser directly.
*Option 4:* Open Terminal run the command > *open http://google.com* and captive portal will show on Safari .

I tried all those options but all not work.

So far the only way to make the connect through is disabling the Sopho Services, not only the Web Control, but especially the Real Time Scanning.

It is not acceptable because we have to disable the Temper protection also.

Aditya,

We have tried this as well. The url's open fine in Safari and Chrome. Additionally if this were a policy why wouldn't the same policy block the pages on macOS 10.12 or 10.13? Something in the Endpoint software is not playing nice with the application itself.

I have turned tamper protection off and or entered the password then proceeded to turn off all of the switches for scanning and policies on the endpoint. Still nothing. I have to completely disable the launch agents and launch daemons so the endpoint isn't running when the system is restarted. 

I do have an open ticket for this but nothing has transpired since I put it in ~2-3 weeks ago.

Hi Steven ,

This issue is related to the 10.14 , this issue is not affected on 10.12 or 10.13. We have cases which is open and still under investigation.  We will let you know if we have an ETA.

We are also being affected by this. Unbeknownst to us, we were troubleshooting this with Aruba for the last month+ only to realize it's Sophos that is affecting this. This is a huge problem for all of our users, primarily our entire sales and customer engagement teams who frequently travel. Any of the workarounds are not acceptable (nor do they work) as I cannot field 10, 20, 30 calls a day related to wifi splash portals not working.

Is there an ETA on this fix?

Finally I figured out the walk around and successfully tested it on different Mac and public wifi:

When the error message come up, you need close that window and open a new browser.

Type in this link: http://captive.apple.com/hotspot-detect.html

The splash page will show up and you can get the Mac connected with wifi.

You can ask your users keep this link as a bookmark. But please remind them they have to close the windows which show the error message. Otherwise it doesn't work.

Hope Sophos can work with Apple to figure out a permanent fix soon.

I have several clients with this issue. Do we have an actual fix or follow up? 

Hello Andrew,

At the moment we are working on the fix as this issue's priority is high. We do not have an ETR at the moment for such resolution.

All our employees depend on being on public networks across the city. This is affecting our business. Can you please tell us when you have the solution? Thanks! 

I wanted to know if there was an ETA or something to follow for progress?

Hi Sophos Support Team,

we have the same issues. Problem is, that is impact the Mac Books of our top management and that they really need an solution. Otherwise I will have no arguments to continue with Sophos.

Your recommended solution with the site site captive.apple.com/hotspot-detect.html is not working.

Is there in the meantime a fix available?

Thanks for your support in advance,

Marcus