topic Re: Problem with Captive portal : in General Topics

Problem with Captive portal :

ikkgroup — Tue, 04 Mar 2014 08:12:26 GMT

Dears,

I'm using PA-500 with 5.0.11 OS.

I would like to get help for the captive portal, HTTPS traffic isn't being interrupted while HTTP is working fine and redirecting traffic for authorization.

Please help me.

Regards,

Umair.

Re: Problem with Captive portal :

_slv_ — Tue, 04 Mar 2014 10:21:15 GMT

Yes, this is (unfortunetelly) expected behavior of PAN.

I have the same in my CP. I know that other vendors are able to redirect https session to Captive Portal.

Regards

SLawek

Re: Problem with Captive portal :

VinceM — Tue, 04 Mar 2014 10:43:50 GMT

Hi all,

PaloALto is able to do that only if in your CP policy you have configure service-http AND service-https.

Hope help.

Re: Problem with Captive portal :

_slv_ — Tue, 04 Mar 2014 11:18:12 GMT

Hi Vince

My CP policy of course using service-http AND service-https.

When I try to connect to any site with https://www.mozilla.com my webbrowser (Firefox) display "Connection was reset"

Regards

Slawek

Re: Problem with Captive portal :

ikkgroup — Tue, 04 Mar 2014 12:38:04 GMT

Thanks for the responses.

I have configured both HTTP and HTTPS both in service policy.

but unfortunately not getting right result and because of that some users are able to browse via https

Regards,

Umair.

Re: Problem with Captive portal :

_slv_ — Tue, 04 Mar 2014 12:45:13 GMT

In my opinion something wrong is in Your security policy configuration if users are able to browse by https.

My looks like:

Vince - why in my config users aren't redirected to CP portal?

Regards

SLawek

Re: Problem with Captive portal :

hyadavalli — Tue, 04 Mar 2014 18:33:02 GMT

Hello Everyone,

For captive portal to work with https you need to setup decryption policy.

Regards,

Hari Yadavalli

Re: Problem with Captive portal :

_slv_ — Wed, 05 Mar 2014 09:00:14 GMT

Please take a look MikroTik RouterOS • View topic - Hotspots and SSL redirection to login

"There is the new HTTP status codes which include 511 "Authentication Required", and although the RFC itself mentions that currently, browsers will show a certificate error on an SSL page, I think browser vendors should be asked to not do that."

Maybe this is a way to go with CP and PAN?

Regards

Slawek

Re: Problem with Captive portal :

HITSSEC — Thu, 06 Mar 2014 00:58:40 GMT

Umair,

We have a PA-5020 running 5.1.10 and do Captive portal internally and externally. In both cases we redirect http and https. Please check the following setting:

Please check the management profile and make sure you have selected https response pages.

The Captive portal settings should look something like this:

Phil

Re: Problem with Captive portal :

_slv_ — Thu, 06 Mar 2014 07:53:30 GMT

Hi Hitsec

thats very intersting what You wrote.

Could You share with us your settings of managemanet profile?

My looks like:

and it doesn'r redirect when You try to open https://www.mozilla.com with FF browser.

Regards

Slawek

Re: Problem with Captive portal :

_slv_ — Thu, 06 Mar 2014 09:21:11 GMT

Hi Phil

I forgot to ask You about decryption policy - do You use SSL decryption?

Regards

Slawek

Re: Problem with Captive portal :

HITSSEC — Fri, 07 Mar 2014 01:39:14 GMT

Slawek,

I realized that is only http traffic that I am seeing redirected to Captive portal. Sorry for misleading you and the discussion thread. That has prompted me to look further into it.

Phil

Re: Problem with Captive portal :

Retired Member — Sat, 08 Mar 2014 22:50:07 GMT

Agree with hyadavalli

You have to use SSL decryption.Without that page will not be loaded.(For unknown users allow only dns.)

Re: Problem with Captive portal :

Retired Member — Mon, 10 Mar 2014 01:27:00 GMT

Just to add to discussion, CP works by sending a 302 redirect when HTTP GET is received. HTTPS encrypts the GET message. Hence no redirect is triggered. This is why you need SSL decryption if you want to CP HTTPS traffic.

-Richard