Connecting Androids to Wireless Network

[ChosenHillIT]

Hi fellow geeks....

 

I am running into an issue where I'm having issues with my Android mobile phones on the wi-fi network.

 

I am running a Cambium Networks wireless network.  We take our internet feed from Exa and use the SurfProtect webfilter.  We need to install an SSL certificate on devices in order to get to the internet.  On Windows, Mac, iPhones, iPads, Chromebooks it all works fine.  Certificate is installed and access to the internet.

 

On Android devices, and it doesnt matter the version, you can connect to the wi-fi, install the certificate and browse the internet fine, but in the settings it say things like 'Limited Connectivity' or 'No Internet' when there is.  This then impacts the use fo apps like WhatsApp & Sign In App.

 

Has anyone come across somethnig simular in the past and if so did you resolve it and how?

[altecsole]

In my experience, mobile apps don't work well with SSL inspection, so good luck with getting this working. Our Sign In App devices connect to our BYOD network, which doesn't do SSL inspection - it then works fine. Same for WhatsApp, but that also need ports opening on our firewall. 

[ZeroHour]

Also if you deploy ipv6 unless you use SLAAC Android can have issues with DHCPv6.

[Davit2005]

To test whether it is the SSL decryption could you put a bypass/exclusion in for a specific IP address and test it?

 

The only issue I had with decryption was at a previous place when a piece of software did not work as it used SSL ports over 443, we created an AD group (our firewall was AD aware), we then put an exclusion in for those people members of that group that used the software then also added the destination address so those users would still have decryption but only when traffic was to that specific domain/destination.

[StephenPink]

Android devices are definitely a pain these days - more so if a 802.1x network! My notes regarding the "no internet" message are below; those URLs need to be excluded from filtering and ideally decryption too. HOWEVER be careful if you exclude the generic one, that as it contains google.com as if you the way it is excluded isn't specific to the exact URL, then there goes all your monitoring of Google searches... 

 

Below are the identified Connectivity Test URLs so far (these are required for devices to "think" they have internet access, regardless of if they actually do or don't have access to the rest of the internet)

 

These URLs require adding to the "Custom allowed content" category, which means no filtering, and no decryption

 

Android URLs

Generic - google.com/generate_204

 

Huawei - connectivitycheck.platform.hicloud.com

Huawei - connectivitycheck.cbg-app.huawei.com

 

Oppo - connectivitycheck.gstatic.com

Oppo - connectivitycheck.android.com

 

 

Cheers