topic Re: Authentication of Users through Captive portal query in General Topics

Authentication of Users through Captive portal query

tamilvanan — Fri, 22 Oct 2021 12:32:47 GMT

Hi Team,

We had configured captive portal on the firewall recently.

In Authentication policy we had selected source users as any and we are using Active Directory for Authentication.

Also we had configured agentless user-id mapping on the firewall and server monitoring to fetch details from AD server for User-IP mapping to feed onto the firewall.

When an unknown user tries to access internet we are getting captive portal re-direction but for devices which have user-ip mapping fetched from AD server Captive portal redirection is not happening.

Is this an expected behaviour for users who are already got user-IP mapped through AD source to not get Captive portal redirection.

I had seen previously it works for Global Protect users but not sure about AD users.

Done troubleshooting as per below doc also:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZiCAK#:~:text=Verify%20Captive%20Portal%20is%20enabled,for%20the%20traffic%20in%20question.

Also SSL forward proxy decryption is configured on the firewall.

Thanks in advance

Re: Authentication of Users through Captive portal query

PavelK — Fri, 22 Oct 2021 13:53:55 GMT

Thank you for the post @tamilvanan

I am running similar setup in multiple Firewalls. I just tried to reproduce the scenario you mentioned and I got the same result. For the session that has already user-ip mapping from user-id agent, I was not getting redirection to captive portal despite fact that I configured in authentication policy source as "any" and Authentication Enforcement: default-web-form. Based on my test I would say what you are experiencing is expected, however I could not find any reference in documentation to back this up.

Kind Regards

Pavel

Re: Authentication of Users through Captive portal query

BPry — Fri, 22 Oct 2021 14:12:54 GMT

@tamilvanan,

This is expected behavior. Captive Portal only triggers on unknown users and doesn't trigger for IPs that already have a user-id mapping.