topic Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2 in General Topics

Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

asia — Mon, 07 Jun 2010 12:45:25 GMT

Hello,

I noticed this in the PAN-OS 3.1.2 release notes :

Captive Portal Session Enhancements – The captive portal web forms method of authenticating
and identifying a user’s IP address has been modified to include a session cookie. This session
cookie is used to maintain the user to IP mapping as long as the users’ browser remains
running. In addition, an option to use an explicit L3 interface for the captive portal web form
can now be used to avoid certificate mismatch issues when presenting the form via SSL.

Does this mean that we can directly connect to captive portal web form without having the need to be redirected? If yes, i have installed the 3.1.2 version of PAN-OS, but i don't find any option to slect this kind of function. Any idea?

Regrd's.

Re: Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

swhyte — Mon, 07 Jun 2010 22:16:12 GMT

Hello Asia,

we still need to have sessions redirected to the Paloalto device to inject the captive portal form.

thanks,

Stephen

Re: Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

asia — Tue, 08 Jun 2010 07:09:41 GMT

Thanks stephen,

In this case, can you telle me the meaning of this point in the release notes.

Regards

Re: Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

abarnett — Thu, 22 Jul 2010 04:47:42 GMT

Hi Stephen,

Can we make this a feature request? The ability to have non AD users go to a webforms page and authenticate without needing the be redirected first would be awesome.

thanks,

Andrew

Re: Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

mjacobsen — Fri, 23 Jul 2010 00:05:16 GMT

One way to get this behavior would be to setup a hostname in DNS that resolves to any IP address that would be routed through the firewall and would hit a captive portal rule. For example, if you added a DNS entry for login.mycompany.com that resolved to 1.1.1.1 and 1.1.1.1 was routed through an interface on the firewall with a CP rule for 1.1.1.1, they would get the login page. The DNS part isn't actually required for this. You could simply tell people to go to 1.1.1.1 if you wanted. 1.1.1.1 just needs to be some IP address that will get routed through the firewall. Could be a public IP or a private IP.

Mike