topic Re: Monitor hits against captive portal? in General Topics

Monitor hits against captive portal?

btrotter — Mon, 04 Apr 2016 15:57:26 GMT

When using user ID and captive portal, when an Auth attempt fails because of the captive portal, how can you get notified? We have spent hours troubleshooting broken apps because the captive portal was preventing access but we have no indication of the reason.

Re: Monitor hits against captive portal?

Brandon_Wertz — Wed, 06 Apr 2016 03:29:52 GMT

@btrotter it's a PITA

Re: Monitor hits against captive portal?

Brandon_Wertz — Wed, 06 Apr 2016 03:45:15 GMT

From CLI you can execute this command:

show user ip-user-mapping all type CP

and see all successful CP users.

From the GUI in the system logs you can use the follwing syntax:

( description contains 'Captive Portal authentication succeeded' )

( description contains 'Captive Portal authentication failed' )

You can use these to help diagnose why some are working and some aren't.

Re: Monitor hits against captive portal?

Brandon_Wertz — Wed, 06 Apr 2016 03:51:49 GMT

@btrotter Also this may or may not be related to your issue.

Specifically my last post:

https://live.paloaltonetworks.com/t5/General-Topics/Dual-NIC-IP-Mapping-Issue/td-p/5936/page/2

regarding the whole Intranet settings and regristry settings that might need to be changed.

Re: Monitor hits against captive portal?

bmorris1 — Wed, 06 Apr 2016 09:03:18 GMT

Hi btrotter,

If you're troubleshooting a communication issue and you're not sure if the traffic is hitting a captive portal policy or not, you can quickly check with a couple of ways.

The best way would be to use the test command:

> test cp-policy-match (criteria)

This will display an output of whether your traffic is going to match a configured policy.

If you are logging your traffic, you can click the spyglass on the left hand side of the log and check the flags section of the detailed log view, if the box is filled in and green then the traffic is hitting the portal. You can also add 'captive portal' to the list of columns viewable in the logs, just click the top of the empty column:

Another method would be to check the live session information, you can do this in the session browser on the GUI or on the CLI you'll see the captive portal flag set to true or false.

I think it would be a nice idea to see captive portal hits or traffic matching a captive portal rule in the ACC, if you want any new features implemented then you will have to contact your PAN SE.

I hope this helps. Thanks,

Ben

Re: Monitor hits against captive portal?

btrotter — Fri, 15 Apr 2016 19:55:48 GMT

Sorry for the late reply.
I am unsure if my question is answered as I do not have an active issue to test it against.

I should have given a better example of the problem we are having.

For an example, one of our server admins came to us a few months back and said his backup server stopped receiving updates. We spent a long time troubleshooting it when our network engineer decided to try to add the site the server was trying to access to the no-captive-portal list. Once he did this the server guy confirmed his backups were now able to download its updates from the internet. We were unable to see anything in the traffic logs for this server attempting to access the internet and did not have any indication that it was the captive portal that was blocking it. There did not seem to be somewhere that would create an alert or log when something was hitting the captive portal.