topic Captive Portal & Identifying Guests? in General Topics

Captive Portal & Identifying Guests?

SethArnoff — Wed, 29 Mar 2017 15:19:23 GMT

Hello,

We have a guest network with a constant rotation of mobile phone users. Is there a way to collect some information about who these devices belong to, such as forcing the user to enter their e-mail or company name? Perhaps using the Captive portal? We need some way of identifying unauthenticated users.

Re: Captive Portal & Identifying Guests?

bradk14 — Wed, 29 Mar 2017 15:52:51 GMT

Captive portal would require successful authentication which means accounts have to exist somewhere. I don't know of any off the shelf solutions that you can plug in (there may very well be one), but you could probably fairly 'easily' create some sort of homebrew solution such as a registration service (that you could link to from the captive portal page) that could accept the mobile number as an input (and whatever else) and possibly even tie integration into an SMS service such as nexmo so the user would receive a one time code to validate the number, then create a temporary account in a database and use that to authenticate against Palo Alto via LDAP or whatever.

that's what immediately comes to mind, though what usually comes to my mind immediately is often overlooking an even more simple approach.

ETA: If you went with the SMS approach, you could probably even have the backend script automatically update PA's UserID via the XML API directly, then redirect back to the internet where hopefully PA has the user already identified.

If the user has javascript enabled, you could probably avoid the captive portal page altogether by simply setting the window location url directly and redirect to the custom script without user intervention.

Re: Captive Portal & Identifying Guests?

BenjAudy.MTL — Wed, 29 Mar 2017 17:55:09 GMT

Hi,

Do you have an enterprise wifi? At my work, we started feeding ip address/username associations from Clearpass (Aruba Networks wifi) to our firewalls and it is so much better than having to dig through authentication logs to find out who did what.

Benjamin