Webauth url redirection fail with firewall between host and switch

Question

Hi All,
I noticed some old posts (2012) on this specific issue (thanks Tarik) - this is exactly our problem.  Web auth redirect URL gets dropped if stateful firewall is between webauth host and switch management interface.  Aaron at Cisco live london kinda hinted about maybe Cisco working on this ?  We can't disable stateful inspection
Is there any other solutions or workarounds ?
"Although this approach introduces additional hops in the return path from the switch to the host, it produces negligible load on the default router and intervening infrastructure since only the WebAuth traffic from the switch to the host follows this path. In campus designs that do not use SVIs on the data VLAN,6 a default route is typically already configured. In this case, no additional configuration is required to support WebAuth. However, problems may arise in the case in which traffic to the default router is bridged through a stateful firewall. The original SYN packet in the TCP handshake is consumed by the access switch, so the first packet that the firewall sees is the SYN-ACK packet from the access switch. Stateful firewalls typically drop SYN-ACK packets if they have not seen the original SYN packet.
In this case, you will need to turn off stateful inspection for ports 80 and 443 on the firewall."
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/app_note_c27-577494.html
Cheers
Peter.                

Answer 1

There is  workaround i haven't tested which is available from 15.0 i think, which is the option to create svi's on your access layer switches for the guest/user vlans, without actually enabling routing between them, it sounds weird, but i have been told that this combined is a possible woraround, that will cause the switch to use the svi interfaces when responding with the SYN-ACK, thus not being sent to its ip default-gateway.