topic Is there a Captive Portal type solution for non http/https services? in General Topics

Is there a Captive Portal type solution for non http/https services?

Russell123 — Mon, 06 Feb 2017 14:55:05 GMT

I am looking for a method to force identify users coming in over the internet trying to connect to an internal resource using MS-RDP.

I originally thought I could use Captive Portal for this but CP documentation indicates its only works with HTTP & HTTPS....obviously this makes sense because without an http interpreter, how else could an app that is not designed to talk to http recognize the HTTP/HTTPS Captive Port web-form or redirect.

Is it possible to force a type of user authentication for users coming from Untrust Internet (any IP) to Trust internal (specific IP). Or what other method could I use or investigate?

Thanks.

Re: Is there a Captive Portal type solution for non http/https services?

asilliker — Fri, 10 Feb 2017 03:29:01 GMT

Use of User-ID based rules from Untrust (Internet) to Trust (internal) is discouraged.

As User-ID creates a mapping of the IP address to a single user, the multiple NAT scenarios that can come into play here can give you unintended results.

If we both happened to be at the same coffee shop and NAT'd to the same IP address, if you were the first to access the corporate resource and challenged by captive portal, I and all of the others in the coffee shop would inherit your access rights.

You might consider deploying a GlobalProtect gateway, and then using your App-ID/User-ID based rules to permit access for the appropriate users to the systems via RDP.

Re: Is there a Captive Portal type solution for non http/https services?

reaper — Fri, 10 Feb 2017 09:24:08 GMT

as @asilliker already mentions, I'd deploy GlobalProtect from a best practices perspective

it will allow you to identify your users more easily and apply security policy based on their identity, plus will add a layer of security (ipsec/ssl) to prevent snooping or MitM attacks when your users are making rdp connections from any random uncontrolled location to your infrastructure