How to troubleshoot errors with the guest network and the captive portal service

In this topic, you will learn how to troubleshoot typical problems with the guest network and the captive portal.

HTTPS certificate errors

When guests connect to the guest portal on the NAS, they may see an error or may be unable to connect. Example errors: Your connection is not private; This site is not secure; Potential security risk ahead; Self-signed root certificate, or Internal server error.

Potential reason 1: This is not caused by Portnox Cloud. Your guests connect to your NAS device’s web portal first (to understand the process better, read this topic). Your NAS device’s internal web server uses a self-signed certificate for the guest server’s domain name.
Solution: Purchase a certificate for your guest network domain name and configure your NAS’s web server to use this valid certificate instead of the self-signed certificate. Refer to your NAS documentation for more information.
Potential reason 2: You set up your NAS virtual interface incorrectly by using a non-private IP address. This causes your router to connect you to the Internet instead of the virtual interface. As a result, your browser tries to access another website that requires a secure connection.

Solution: Use a private IP address for your virtual interface: 10.x.x.x, 172.16.x.x–172.31.x.x, or 192.168.x.x. Do not use an IP address that is already used by another device in your network. Do not use 1.1.1.1, it is no longer a private address.
Potential reason 3 (for Internal server error): The Portnox Cloud instance is managed by an MSP, and there is no organization administrator in the tenant. The captive portal was created and configured using an MSP administrator account.

Solution: Create at least one organization administrator account in the tenant.

If your browser does not allow you to proceed past the certificate warning, try a different browser. Different browsers handle self-signed certificate warnings differently:

Google Chrome: Click on Advanced and then click on Proceed to [site] (unsafe).
Mozilla Firefox: Click on Advanced and then click on Accept the Risk and Continue.
Microsoft Edge: Click on Details and then click on Go on to the webpage. If this option is not available, type thisisunsafe directly in the address bar while the warning page is open. For more information, see: Microsoft documentation.
Safari: Click on Show Details and then click on Visit this website.

Note:

There is no way to permanently disable certificate warnings in modern browsers for security reasons. The only way to prevent the warning from appearing at all is to install the NAS device’s self-signed certificate into the operating system’s trusted certificate store on each guest device. This is not practical for guest users on personal devices. For managed corporate devices, an IT administrator can push the certificate to all devices via an UEM/MDM solution or Group Policy on Windows.

Chrome tracing

To help us diagnose problems with your captive portal configuration, we need you to provide us with a Chrome trace. Here are the steps to create such a trace on a Windows computer.

Install Chrome Canary.
The Chrome trace must be done on a browser with out-of-the box configuration and no extensions. The best way to do it is to install Chrome Canary, which is a standalone browser.
1. Download the Chrome Canary installer from the Chrome Canary official website.
2. Run the downloaded installer. Chrome Canary will be installed and automatically started.
In the address bar, type: chrome:tracing, press Enter, and then click on the Record button.
In the Record a new trace window, select the Web developer option, and then click on the Record button.
Change your Wi-Fi configuration to the guest network, and then open the captive portal in Chrome Canary in a new tab.
When you’re done recreating the steps that need to be recorded for troubleshooting purposes, go back to the first tab, and then click on the Stop button.
When Chrome is finished with processing the trace, click on the Save button and save the .tar.gz trace file.
Send the .tar.gz file to Portnox Support by email or attach it to your support ticket.

Miscellaneous issues

Why does my guest portal still show the old organization name after I changed it in Portnox Cloud?

The name of the organization is included in the guest portal at the moment of its creation. If you change the organization name after the portal has already been created, the portal will continue to display the old name. This behavior is by design.

Workaround: Re-create the guest portal. The newly created portal will use the updated organization name.