topic CP Policy in General Topics

CP Policy

loosj — Fri, 08 Feb 2013 10:32:06 GMT

I'm trying to setup a captive portal and authenticate users via a user certificate, but I cannot get it to work in 5.0.1.

I already have a client certificate profile created but which setting do I need in the CP policy (action):

web-form => does not work since the user needs to specify username/password

no-captive-portal => does not prompt the user for a cert

browser-challenge => used for NTLM

As in 4.x there is a setting captive-portal which is not available in version 5.

Any suggestions ?

Johan

Re: CP Policy

mikand — Fri, 08 Feb 2013 17:04:16 GMT

Verify that you in the settings for the interface facing the clients have enabled "userid".

Re: CP Policy

scantwell — Fri, 08 Feb 2013 17:32:04 GMT

Hello, there is a document on how to configure Captive Portal that you are can search for (it references the 4.0, with screen capture, etc), but essentially it is the same for 5.0, just renamed the options in the CP policy.

This is a snippet from that document:

Go to the Policies tab -> Captive Portal rulebase. Configure a rule that requires the users to authenticate.

Note that possible actions/methods for these policies are:

· captive-portal – this option presents a web form to the user (scenarios 1 & 2), or doesn’t require any user prompting if using client certificates (scenario 3)

· ntlm-auth – this option attempts to use NTLM to authenticate the user behind the

scenes (scenario 4)

In 5.0, you have browser-based (NTLM version) or Web-based (which is the web page OR can be the same method when using the client-certificates)

Thanks....

Re: CP Policy

JohanL — Fri, 15 Feb 2013 13:13:39 GMT

When I select browser-based in my Captive Portal policy, the system needs an UID agent installed. Thats something I want to avoid since I want my users to authenticate via a certificate.

So, no other options left than ?

Re: CP Policy

scantwell — Thu, 28 Feb 2013 06:06:22 GMT

CP for browser based requires a UserId agent to be installed. The FW fwds userid requests to agent, which can communicate to AD or WMI active queries.

Re: CP Policy

mikand — Thu, 28 Feb 2013 07:40:09 GMT

Couldnt the CP policy use a radius or such or for that matter the internal userdb (for really small installations)?

Re: CP Policy

scantwell — Thu, 28 Feb 2013 12:36:41 GMT

Of course it can. That is where Web-Form CP comes in. In that method it can go to many different types, Radius, Kerberos, or even local. When I first set up CP (just to understand how it worked), I used Local as my authentication type.