topic Re: Captive Portal - Terms of Service in General Topics

Captive Portal - Terms of Service

u13001 — Mon, 21 May 2012 13:35:07 GMT

I would like to configure my PA-200 in such a way that when the user tries to browse a web site, he is presented with the captive portal. On this page I would like to display a "Terms of Service" banner telling him about acceptable use etc. I do NOT wish to authenticate individual users.

A simpe banner and an I Accept/Cancel button would suffice. Is there any way to implement this on Palo Alto?

Thanks a lot.

Re: Captive Portal - Terms of Service

kalyanram.piratla — Mon, 21 May 2012 16:39:42 GMT

Why use captive portal for this? Captive Portal is a method used for user-to-ip-mapping wherein the user would pass on the credentials for ip-mapping. Setting all your URL categories to Continue / Override should be more easy...!!!

Hope this helps..!!!

Regards,

Re: Captive Portal - Terms of Service

zarina — Mon, 21 May 2012 16:43:07 GMT

Captive portal is used for ip-user mapping and it is not possible to change the behavior to display only the terms and conditions page. You can achieve this by using URL continue page. You can define your customized URL continue page and then import it to the box.

Re: Captive Portal - Terms of Service

u13001 — Mon, 21 May 2012 20:24:36 GMT

Thanks guys. I will give this a try tomorrow.

Will it be cached so that the users isnt asked multiple times for different categories?

Also, can this govern other policies, so that the user has to accept before other firewall rules are enabled for him?

Re: Captive Portal - Terms of Service

kalyanram.piratla — Tue, 22 May 2012 08:29:29 GMT

"Also, can this govern other policies, so that the user has to accept before other firewall rules are enabled for him?", Can you please elaborate a little more on this. As per understanding, you want this Acceptance page as and when the user will open a browser for surfing the internet.

If that is the case, then you will need to attach the URL Filtering profile to all the security rules that allow internet access.

Hope this helps...!!!

Regards,

Re: Captive Portal - Terms of Service

u13001 — Wed, 23 May 2012 15:22:30 GMT

I'll try to explain.

When the user connects to the network he should have access to nothing.

When attempting to browse the internet he is presented with a Terms of Use web page where he is asked to accept the conditions.

After the user accepts other policies might be enabled for him allowing him to vpn etc.

Re: Captive Portal - Terms of Service

u13001 — Wed, 30 May 2012 10:39:41 GMT

I got the problem somewhat resolved.

The only way we could get it to behave properly was with captive portal.

Basically there is a ToS text and a phrase that says you accept these terms by logging on with guest/guest user account.

If only there was a way to revert to regular HTTP instead of using SSL on captive portal...

Re: Captive Portal - Terms of Service

znlwin — Thu, 13 Jun 2013 05:09:17 GMT

Hi Anyone,

Is there a way to revert to regular HTTP instead of using SSL on captive portal login page?

Re: Captive Portal - Terms of Service

Retired Member — Thu, 13 Jun 2013 05:46:05 GMT

I don't think it is possible.

if you choose none as server certificate the firewall will use the local default certificate to provide an SSL connection.

Re: Captive Portal - Terms of Service

Colgonics — Sat, 10 Aug 2013 17:57:13 GMT

It is complex, but it can be done.

Create local user accounts, point authentication to local. Then we you make the custom page, just hide their form and create your own with the username and password filled in. Hide their login button and replace it with your own. Then setup your onClick to click theirs. Kind of ridiculous, but it can be done.

Hopefully this makes sense. I'm not the best at explaining....

Re: Captive Portal - Terms of Service

ericgearhart — Sat, 10 Aug 2013 22:06:13 GMT

Wow what an interesting and creative hack to get a "Terms of service" portal to work with PA! I applaud your ingenuity on this one.

PA should really add this simple feature.

Re: Captive Portal - Terms of Service

JimMcGrady — Fri, 17 Mar 2017 04:28:09 GMT

3 years later, does Palo have a cleaner way of doing this very common requirement?

Re: Captive Portal - Terms of Service

_slv_ — Thu, 24 May 2018 08:23:00 GMT

As most of You (from EU) knows tommrow GDRP will apply

Has anyone solution for PANOS 8.x for CaptivePortal with button to accept the terms and authentication?

Could You ahare it?

Regards

Slawek

Re: Captive Portal - Terms of Service

_slv_ — Mon, 04 Jun 2018 11:15:26 GMT

Hello

Noone is using such feature? I'm pretty sure that You have solution 😉 - please share it..

Regards

Slawek

Re: Captive Portal - Terms of Service

Remo — Mon, 04 Jun 2018 17:09:45 GMT

Hi @_slv_

Do you want to use captive portal only to show terms of service or do you require your users to log in?

Re: Captive Portal - Terms of Service

_slv_ — Mon, 04 Jun 2018 18:38:53 GMT

Hi @Remo

I require that my users need to provide user name and passwword and I need checkbox for terms and conditions.

You need to check that checbox to be able to logon using proper credentials.

Regards

Slawek

Re: Captive Portal - Terms of Service

Remo — Mon, 04 Jun 2018 20:35:29 GMT

Hi @_slv_

Why don't you simply solve this with an additional checkbox on the caprove portal website? With a little javascript you could also make this checkbox mandatory so a login won't be possible unless the user agrees to your terms and conditions.

Because paloalto gives you the ability to customize the loginpage there are theoretocally no limits for whatever you try to do (as long it is something webbased).

Edit: it doesn't even require javascript as there is an attribute "required" for html input objects.

Re: Captive Portal - Terms of Service

_slv_ — Mon, 04 Jun 2018 20:49:53 GMT

Hi @Remo

>Why don't you simply solve this with an additional checkbox on the caprove portal website

This is what I'm looking for ... I'm not a "html" guy - so I need proper code that I will adopt for my requrements.

Regards

Slawek

Re: Captive Portal - Terms of Service

Remo — Mon, 04 Jun 2018 21:32:00 GMT

Hi @_slv_

Because of the way PaloAlto adds the actual login form into the captive portal loginwebsite, you probably need a little javascript.

This is the html code for a checkbox:

<input type="checkbox" name="terms" value="I accept Terms and conditions" required />

I know it is possible but because of the mentionned way paloalto adds the loginform I need to test this shortly in order to provide some html/javascript lines for your terms and conditions captive portal login.

Re: Captive Portal - Terms of Service

_slv_ — Tue, 19 Jun 2018 13:07:01 GMT

@Remo

I need your help I think ...

Here is my code of shared config of CP

</head>
<body onload="loadPage();">
<table id="formtable">
<tr><td>
	<div id="activearea">
		<div id="heading">User Identification Portal</div>
		<div id="desc">Some text here</div>
		<input type="checkbox" id="terms" name="terms" value="I accept Terms and conditions" required />
		<a href="https://www.contoso.com/terms.pdf">I accept Terms and conditions.</a>
		<div id="desc">The resource you are trying to access requires proper user identification prior to access. Please enter your credentials.</div>
		<div id="formdiv">
			<pan_form/>
		<div id="desc"></div>
		</div>
		<div id="desc">Some text here</div>
		
	</div>
</td></tr>

I have two issues:

- if you provide wrong username/password it doesnt tell that credenatials are incorrect

- I can logon with proper credentials but without checking checkbox

How to correct it?

Help me please

Regards

Slawek