topic Captive Portal Session Timeout in General Topics

Captive Portal Session Timeout

u2343 — Thu, 29 Oct 2009 14:22:42 GMT

You can set the Timeout value of captive portal. Default is 60 min. In my case it is 240 min.

But this is the max TTL. There is a default TTL of 900 sec(15min)

So when a logged on user does not create any traffic for 15 min then the user must logon again.

IP                   dent. By      User                                                 TTL (s)      Max. TTL (s)
---------------      ---------           --------------------------------                       -------         ------------
145.8.245.40    CP             ce.altis.corusgroup.com\A193813       830           14327

Can the default ttl be changed?

Realy i don't know why there are 2 setting for the timeout value!!

Osman Bor

Network Engineer.

Corus group

Re: Captive Portal Session Timeout

migration — Thu, 29 Oct 2009 21:17:04 GMT

Hi,

The TTL is an idle timer. It is, as you correctly stated, set at 15 minutes (900 seconds). This timer

is reset when the system sees new sessions from the user. When this timer expires, e.g. when

there is no new sessions from the user for 15 minuets, then the user is aged out and will need to

re-authenticate with captive portal. This timer is not configurable.

The other timer you see labled "Max. TTL" is the timer which keeps track of how long the user

has been active. When this timer expires, the user is kicked off no matter how active he is. He will

need to re-authenticate using Captive Portal. This timer is user configurable from the UI.

Hope this clarifies the confusion.

Re: Captive Portal Session Timeout

u2343 — Fri, 30 Oct 2009 11:05:14 GMT

Thanks for your reply.

It's only too bad that this can't be changed for the Captive Portal. I think it's have to do with security but maybe it's better to let it decide by the organization if it's acceptable security.

Currently we are planning to move from a Cisco FW to the PaloAlto. And we are used to validate every 4 hours and it's very hard and impossible to sell this solution, that users need to logon every 15 min. with the PaloAlto.

At this moment the project stopped because this is not accepted by the users group.

So the Captive Portal is not a solution for us and we must try to find a way to use NTLM or AD with SSO. This way the users will not be prompt to logon. But this is very difficult to implement when you have mixed users in AD and not in AD. Captive portal was our fallback method.

Regards,

Osman Bor

Re: Captive Portal Session Timeout

migration — Fri, 30 Oct 2009 17:07:37 GMT

There is an existing feature request for "Captive Portal Rule-Based Timeout" already which may address your

needs. Or, you could contact your PaloAlto Networks SE to open a feature request specifically for your

requirements.

But just to be clear, the 15 minute timeout is an *idle* timeout. So as long as the user is doing something

on the system that generates new sessions across the PA firewall, he will not have to re-login every 15

minutes.

Cheers

Re: Captive Portal Session Timeout

mderksen — Fri, 30 Oct 2009 18:30:18 GMT

Both the TTL timeout and the Captive Portal Authorization fail back have been created as a request for Change.

Re: Captive Portal Session Timeout

nrice — Tue, 14 Jun 2011 23:28:21 GMT

Captive portal TTL can be changed with the CLI command:

admin@PA-2020-1(active)# set captive-portal idle-timer
<value> <1-1440> idle timer (minutes)

Re: Captive Portal Session Timeout

netslh — Thu, 15 Nov 2012 14:31:08 GMT

So for TTL if 15 minutes idle. What if the user has a tool bar like a weather toolbar talking to a server outbound making queries. Wouldn't that show as not idle? I work for a hospital and users on mobile machines are bringing up the fact that they are not being timed out or do not have the option to log theirselves out of the Captive portal system. Any suggestions?