If a guest sees a “Bağlantı kurulamadı” (connection could not be established) or “Bu portal için internet erişim grubu tanımlı değil” (no internet access group is defined for this portal) message instead of the captive portal login page, the screen also shows an error code starting with CP-. This document explains what each error code means, how to find the cause in the appliance log and how to resolve it.
This document is for system administrators who manage SignLogger. For all captive portal settings, see the Captive Portal Management User Guide.
What the guest sees
When the firewall redirects a guest to the portal and SignLogger cannot match the request to a defined portal, the guest sees the following card:
Bağlantı kurulamadı — Şu anda internet bağlantınız açılamadı. Lütfen birkaç saniye sonra tekrar deneyin. Sorun sürerse aşağıdaki kodu görevliye iletin.
Hata kodu:
CP-107· Destek kodu:6064350a-9212-4a6f-a320-d3dc8e28d0e5
Translation: “Connection could not be established — Your internet connection could not be opened right now. Please try again in a few seconds. If the problem persists, give the code below to the staff. Error code · Support code.”
For security reasons, no details are shown to the guest; the details are written to the appliance log. Ask the guest to give you both codes shown on the screen (Hata kodu = error code, Destek kodu = support code).
Error code and support code
- Error code (
CP-101…CP-112): a short and permanent identifier of the cause. The same cause always produces the same code, and the numbers do not change between versions. In most cases you can find the cause directly in the table below.CP-100indicates an undefined cause; report it to the support team. - Support code: an identifier generated anew for every request; it is not the error itself. If the same problem occurs twice, two different support codes appear. Its purpose is to let you find the line belonging to that request in the appliance log.
Error code summary table
Portal matching checks are performed in the order of the table; the code of the first failed check is shown.
| Error code | Cause in the log | What happened? | Where to look |
|---|---|---|---|
CP-101 | database_connection_failed | The portal settings could not be read. | Restart the service; if it persists, support team |
CP-102 | invalid_post_url | The login address sent by the firewall cannot be read. | Firewall redirect settings |
CP-103 | database_query_failed | An error occurred while reading the portal settings. | Restart the service; if it persists, support team |
CP-104 | ssid_not_found | No portal is defined with the portal name received in the request. | Portal Name |
CP-105 | missing_post_host | The login address sent by the firewall does not contain the firewall address. | Firewall redirect settings |
CP-106 | invalid_user_ip | The guest IP in the request is not a valid IPv4/IPv6 address. | Firewall redirect settings |
CP-107 | firewall_host_mismatch | The portal was found, but the address of the redirecting firewall does not match the portal's Firewall IP or FQDN setting. | Firewall IP, FQDN |
CP-108 | guest_network_mismatch | The portal and firewall matched, but the guest's IP is not in the portal's Guest Network range. | Guest Network |
CP-109 | unexpected_lookup_failure | The portal could not be opened although all matches appear to be satisfied. | Restart the service; if it persists, support team |
CP-110 | portal_user_group_missing | No RADIUS group is selected on the portal. | RADIUS Group |
CP-111 | portal_user_group_not_found | The group selected on the portal does not exist (deleted or renamed). | RADIUS Group |
CP-112 | portal_user_group_disabled | The group selected on the portal is disabled. | RADIUS Group |
Finding the cause in the appliance log
The error code usually explains the cause on its own. If you need details, log in to the SignLogger CLI from the appliance console or over SSH and search the log with the first part of the support code the guest gave you:
get log service-filter captive-portal 500 6064350aThe output contains a line similar to the following:
[PORTAL-TANI] istek_id=6064350a-… kod=CP-107 neden=firewall_host_mismatch ssid="Misafir" post="https://10.0.0.9:1003/fgtauth?…"
userIP="192.168.50.7" ssid_kaydı_var=true host_eşleşti=false guest_net_eşleşti=false aday=1 …| Field | Meaning |
|---|---|
kod | Error code shown on the screen |
neden | Cause (the “Cause in the log” column of the summary table) |
ssid | Portal name received in the request |
post | Login address to which the firewall will send the guest back; the host part of this address is the firewall's address |
userIP | IP address of the guest device |
ssid_kaydı_var | Whether a portal with this name was found |
host_eşleşti | Whether the firewall address matched the portal's Firewall IP / FQDN setting |
guest_net_eşleşti | Whether the guest IP is in the portal's Guest Network range |
aday | Number of portals found with this name |
If the support code cannot be found in the log, the request may be old; increase the number of lines (e.g. 2000) or ask the guest to try again and send the new code. To see all captive portal diagnostic lines, use PORTAL-TANI as the pattern.
Note: The
get log service-filtercommand requires permission to view services and logs on your account. For details of the command, see the SignLogger CLI User Guide.
Resolution steps
Portal settings are on the Captive Portal page of the management panel.
CP-104 — Portal name not found
- Compare the
ssidvalue in the log with the portal's Portal Name. Differences in letter case, spaces and Turkish characters also count as a mismatch. - The captive portal address on the firewall must be the same as the portal link:
http://<appliance address>:8080/<Portal Name>. - If the portal name was changed on the firewall or a new SSID was added, define a portal with the same name in the panel.
CP-107 — Firewall address did not match
- Look at the host part of the
postaddress in the log (e.g.10.0.0.9forhttps://10.0.0.9:1003/…). This is the address of the firewall redirecting the guest. - The portal's Firewall IP setting must include this address. You can enter a single IP, a CIDR range or a comma-separated list. In a high-availability (HA) pair, add the addresses of both members.
- If the firewall sends a domain name instead of an IP address, that name must be the same as the portal's FQDN setting.
- If the firewall's IP address changed (e.g. a new interface or a new device), update the Firewall IP setting.
CP-108 — Guest network did not match
- Verify that the
userIPvalue in the log is within one of the portal's Guest Network ranges (e.g.192.168.50.0/24for192.168.50.7). If there is more than one guest network, add them all separated by commas. - If
userIPis the address of a proxy server or of the firewall itself, the firewall is not sending the guest's real address; check the firewall's captive portal redirect settings.
CP-102, CP-105, CP-106 — Firewall redirect is incorrect
The firewall redirect arrives with missing or incorrect parameters. In the external captive portal settings on the firewall, check that the portal address and firewall type are selected correctly and that the guest IP and login address are added to the redirect. For firewall-specific settings, see the Firewall Integrations documents. If the firewall software was recently updated, the redirect format may have changed; contact the support team.
CP-101, CP-103, CP-109 — Temporary problem on the appliance
These are not configuration errors; they indicate a problem on the appliance side. Restart the captive portal service and ask the guest to try again:
enable
execute restart captive-portalIf these codes recur frequently although the portal settings are correct, first upgrade the appliance to the latest version. If the problem persists, contact the support team with the information listed in Information for a support request.
CP-110, CP-111, CP-112 — Guest entered the code but could not connect
The SMS and Turkish ID (TC Kimlik) verification methods create an account for the guest and add it to the group set in the portal's RADIUS Group setting. Internet access rules are bound to this group; the firewall rejects the login of a guest without a group. Therefore, if the portal's group cannot be used, no SMS is sent to the guest, no verification is performed and the following message is shown: “Bu portal için internet erişim grubu tanımlı değil. Lütfen görevliye başvurun. Hata kodu: CP-11x” (No internet access group is defined for this portal. Please contact the staff. Error code: CP-11x).
| Error code | Solution |
|---|---|
CP-110 | Edit the portal and select the guest group in the RADIUS Group field. |
CP-111 | Recreate the group or select an existing group on the portal. |
CP-112 | Enable the group. |
In the log, this case looks like this:
[PORTAL-TANI] kod=CP-110 neden=portal_user_group_missing ssid="Misafir" grup="" yöntem=sms — SMS gönderilmediIn the current version, the panel does not allow a portal to be saved without a group while SMS, Turkish ID or Form login is enabled.
Information for a support request
- The error code and support code the guest gave you
- Output of
get log service-filter captive-portal 500 <first part of the support code> - A screenshot of the portal's Portal Name, Firewall IP, FQDN and Guest Network settings
- Firewall model and software version
- Output of
get system version
Frequently Asked Questions
What does the “Bağlantı kurulamadı” (connection could not be established) error on the captive portal mean?
The firewall redirected the guest to SignLogger, but SignLogger could not match the request to a defined portal. The CP- error code on the screen shows the cause; the most common ones are a portal name mismatch (CP-104), the firewall address missing from the portal's Firewall IP setting (CP-107) and the guest IP being outside the Guest Network range (CP-108).
How do I fix the CP-107 error?
Add the address of the redirecting firewall to the portal's Firewall IP setting. You can find the address in the host part of the post field in the log. In HA pairs, add the addresses of both members; if the firewall sends a domain name, check the FQDN setting.
Why is the support code different every time?
The support code is an identifier generated anew for each request and is only used to find the line belonging to that request in the log. The cause of the error is shown by the error code (CP-xxx); the same cause always produces the same error code.
The guest does not receive the SMS code and sees CP-110. What should I do?
No RADIUS group is selected on the portal. Edit the portal and select the guest group in the RADIUS Group field. Without a group, no SMS is sent to the guest, because the firewall rejects the login without an access rule bound to the group.
I see CP-101 or CP-109. Are my settings correct?
These codes do not indicate a configuration error but a temporary problem on the appliance. Restart the captive portal service with execute restart captive-portal. If they recur frequently, upgrade the appliance to the latest version, and if the problem persists, contact the support team.