topic Re: Many users receiving Captive Portal in General Topics

Many users receiving Captive Portal

FabioGarcia — Fri, 29 May 2015 18:52:53 GMT

Dears,

We have been facing a lot of users identified by Captive Portal and not via UIA.

Does anyone could suggest any troubleshooting/best practices to avoid this kind of behavior ?

Thanks in advance!!

Re: Many users receiving Captive Portal

mivaldi — Fri, 29 May 2015 23:27:31 GMT

Your UIA mappings are most likely timing out at the default of 45 minutes, and you're most likely relying on WMI Probes, which are failing, because your hosts are not correctly configured to respond to the WMI Probes.

Once the Probes fail, the user-ip mappings are deleted.

Once they are deleted, Captive Portal will trigger.

If the Captive Portal is set to its default Expiration of 60 minutes, then users will have to validate to CP every hour.

By default, User-ID Cache timeout is set to 45 minutes.

If users would be on site for a maximum of 12 hours, you can set the timeout to 720 minutes, and disable Probing.

Note I'm making a lot of assumptions based on similar cases I've worked. Your settings may differ, in that case, I recommend you open a Support ticket and we can take a closer look.

I also recommend checking out these documents:

Best Practices for Securing User-ID Deployments

User-ID Best Practices - PAN-OS 5.0, 6.0

Re: Many users receiving Captive Portal

cpainchaud — Sat, 30 May 2015 12:29:19 GMT

Hi essilorbr,

I also suggest that you look at GlobalProtect to transparently identify your users, please remember this is not only a VPN client but also an Authentication client when used in Internal mode.

Your colleagues from Essilor EMEA may help you setting up this configuration.

Re: Many users receiving Captive Portal

FabioGarcia — Wed, 03 Jun 2015 19:10:11 GMT

Hello, thx for you help... you meant change this parameter below at Agent ?

- disable WMI

- change user identification timeout from 30 to 720 ?

Re: Many users receiving Captive Portal

mivaldi — Fri, 05 Jun 2015 18:57:11 GMT

Yes, that is correct.

Enable WMI Probing: No

User Identification Timeout (min.): 720

Re: Many users receiving Captive Portal

FabioGarcia — Tue, 09 Jun 2015 14:47:58 GMT

Very nice!!

will try these options...