DHCP Option 114

Modern captive-portal discovery via DHCP Option 114 (RFC 8910). Lets guest devices detect and open the Captive Portal automatically, without probe hacks.

DHCP Option 114 (defined by RFC 8910) is the standards-based way for a network to advertise its captive-portal URL on the DHCP lease. Modern operating systems — recent iOS, iPadOS, Android, and macOS — read the option and take the guest straight to the portal, with a clear “Sign in to network” prompt instead of the classic connectivity-probe redirect dance. Support varies by platform: Windows continues to rely mainly on its own connectivity tests and still reaches the portal through classic detection in practice.

Why bother with Option 114

Fewer guest surprises. The native OS captive-portal UI is faster and clearer than the browser-based probe redirect.
Better with modern privacy features. Operating systems are moving away from the heuristic “try to reach captive.apple.com” model; Option 114 is the forward-looking replacement.
Consistent experience across iOS, iPadOS, Android, and macOS versions that support the option.

Clients that don’t support Option 114 fall back to the probe-redirect model, so enabling the option is additive — nothing breaks.

How the platform advertises Option 114

When DHCP is served from your Sign-In Context’s Cisco Service Gateway, each DHCP scope can include Option 114 in its offers. The URL carried by the option is the Context’s own Captive Portal URL — the same URL shown on the Captive Portal link at the top of the Context admin. You don’t enter it separately; it follows the Context, so every scope that advertises Option 114 points at the right portal automatically.

Whether a given scope actually sends Option 114 is the product of two settings:

A Context-wide default in DHCP Common Settings.
A per-scope policy that either follows the default or overrides it.

Enabling it on Service Gateway scopes

Open Service Integration → Service Gateway → DHCP in the Context admin.

1. Set the Context-wide default

In the DHCP Configuration card, the Enable Option 114 checkbox controls whether scopes that haven’t been overridden include Option 114 in their leases. New Contexts have this enabled by default; leaving it on is the recommended baseline.

Save with Update Configuration. You’ll see a reminder that the DHCP service needs to be restarted for the new configuration to take effect.

2. Override per scope if needed

Each DHCP scope has an Option 114 Policy dropdown with three values:

Default (as configured in Dhcp - Common Settings) — the scope follows the Context-wide toggle.
Override - Always On — the scope always advertises Option 114, regardless of the Context-wide toggle.
Override - Always Off — the scope never advertises Option 114.

The DHCP scopes list has a matching Option 114 column showing Default, Always On, or Always Off for each scope at a glance.

Use the overrides when a specific scope — say, a staff network sharing the same gateway as a guest network — shouldn’t advertise the captive portal even though the Context default does.

When DHCP is served elsewhere

If guest leases come from somewhere other than the Service Gateway — for example, DHCP handled by a Meraki switch or AP, a firewall appliance, or a standalone DHCP server — the platform has no way to push Option 114 into that system. Configure Option 114 on the upstream DHCP and advertise the Sign-In Context’s Captive Portal URL, which you can copy from the Captive Portal link at the top of the Context admin.

Coexisting with probe redirects

Option 114 doesn’t replace the redirect-based captive-portal machinery; it augments it. Keep your existing walled-garden entries and redirect rules in place. Clients that support Option 114 take the cleaner path; others continue to work the way they did before.

Compatibility quirks

See Captive-portal detection for OS-specific quirks around iOS Private Wi-Fi Address, 802.11r fast transitions, and MAC randomization. These interact with Option 114 in various subtle ways.