Apple Captive Portal CNA behaviour for Wi-Fi?

[gshaw]

I'm rejigging our Wi-Fi at the moment with a captive portal for Guest users, which is working great on Windows and Android but Apple (quelle surprise) is proving to be a problem.

 

On the other devices the captive portal detection kicks in after login and auto opens the sign-in page but on iOS \ macOS nothing happens and the user has to trigger a web page from the browser.

 

I've seen various theories around how it works as Apple doesn't seem to provide documentation

 

• CNA changed in 10.3.1 and no-one knows what the new behaviour is
  
• DNS must be working on initial connect (seems to be OK)
  
• access to captive.apple.com must not be allowed before auth (it redirects to login page)
  

I've tried all those but no joy, has anyone found a workaround?