topic Captive portal palo alto issued with chrome in General Topics

Captive portal palo alto issued with chrome

nfsfantasy — Thu, 28 Oct 2021 11:41:20 GMT

Hi all

I use captive portal on palo alto just zone Lan to internet and found issued about chrome

My client have window 7,8 and palo version 8.1

Test on firefox need open firefox and click to option for login to internet

But on chorme not option for click and we try to access website https but it can not redirect to webportal to login

Anyone have issued abd idea

I did install cert from palo on client trustroot cert

nfsfantasy — Thu, 28 Oct 2021 12:32:25 GMT

This chrome reirect only http like type 1.1.1.1 it can redirect to portal but we use https://facebook

It not redirect

aleksandar.astardzhiev — Thu, 28 Oct 2021 17:02:34 GMT

From what I understand your problem is redirecting HTTPS (encrypted) traffic to captive portal.

Unfortunately this is expected, if you think about how the captive portal works:

- When user tried to access some resource with HTTP, firewall will act as man-in-the-middle and intercept the request to the server

- It will forge a reply redirecting the user to the captive portal

- Once the authentication is completed, firewall will forward the request to the destination and leave the user to continue his journey

If traffic is encrypted and you don't perform SSL decryption, firewall will not be able to intercept the HTTP request and reply with redirect.

Here is a really good KB explaining how to workaround this, without enabling full SSL decryption - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClevCAC

Basically you will need to decrypt the request for any unknown users (IP that does not have ip-to-user mapping) and no-decrypt for known users.

nfsfantasy — Tue, 02 Nov 2021 05:42:16 GMT

Hi Astardzhiev

thank you for explain I will try to decrypt all the request from unknow