Cisco AAA / Identity / Nac :: Webauth Url Redirection Fail With Firewall Between Host And Switch

Web auth redirect URL gets dropped if stateful firewall is between webauth host and switch management interface.  Aaron at Cisco live london kinda hinted about maybe Cisco working on this ?  We can't disable stateful inspection. Is there any other solutions or workarounds ?
 
"Although this approach introduces additional hops in the return path from the switch to the host, it produces negligible load on the default router and intervening infrastructure since only the WebAuth traffic from the switch to the host follows this path. In campus designs that do not use SVIs on the data VLAN,6 a default route is typically already configured. In this case, no additional configuration is required to support WebAuth.

However, problems may arise in the case in which traffic to the default router is bridged through a stateful firewall. The original SYN packet in the TCP handshake is consumed by the access switch, so the first packet that the firewall sees is the SYN-ACK packet from the access switch. Stateful firewalls typically drop SYN-ACK packets if they have not seen the original SYN packet.In this case, you will need to turn off stateful inspection for ports 80 and 443 on the firewall."