topic Re: Delay with User-ID and Captive Portal in General Topics

Delay with User-ID and Captive Portal

djr — Thu, 14 May 2015 14:36:49 GMT

HI,

This is only theoretical for me as I don't use captive portal (yet) but I noticed a problem. I am successfully authenticating pretty much all my users, but quite often I see a few flows at the start of a user session which doesn't have a user-id. A few milliseconds later the user-id is populated, so I guess this is just down to a slight delay between the first packets hitting the firewall and the user-id coming up with an answer.

This is no big deal but it made me think if I did have a captive portal to identify all unknown users, a domain-authenticated user would still find themselves presented with a captive portal login page if they fire off an HTTP request very early on in their session.

Is this a known behaviour? It seems like a bit of an issue to me. I know my users would moan about it.

Cheers

David

Re: Delay with User-ID and Captive Portal

aabdelhali — Fri, 15 May 2015 14:55:58 GMT

Hello David

Please check this Packet Flow in PAN-OS

a captive portal rule lookup is checked to see if the packet is subject to captive portal authentication. If captive portal is applicable, the packet is redirected to the captive portal daemon

This is done prior to security policy lookup. Hope this answered your question.

Amjad

Re: Delay with User-ID and Captive Portal

djr — Fri, 15 May 2015 15:49:45 GMT

Hi Amjad,

OK as I said I haven't used the captive portal yet, but the point still remains, in fact that document you linked to shows the problem.

I can see that logs have been written before the user is resolved, so that's after the security policy has been processed. As the captive portal rules are run earlier than that, it is even more likely that the user won't have propagated to the database, so authenticated users will get prompted with the captive portal.

Re: Delay with User-ID and Captive Portal

aabdelhali — Fri, 15 May 2015 16:01:44 GMT

David

This will depends on how your firewall learns the IP-User mapping, for example if you use UIA, I don't expect this will happen because the agent is fast enough to learn the information from AD, and also the Windows OS takes some time to load all services and startup programs when the user log in (I guess at least 10 seconds) before the user is able to open an internet browser. But if you use other methods for example GP client, I guess yea because GP will take some time to connect and firewall to learn the mapping

Amjad