topic Re: Captive Portal not presented for wireless users in General Topics

Captive Portal is not presented for wireless users

TranceforLife — Wed, 10 May 2017 09:32:35 GMT

Hello All,

PA3020

PAN-OS 7.1.4-h2

Having a strange issue with Captive Portal on PA3020 where the captive portal just suddenly has stopped working. Did a management server restart, tested with the PC directly connected into the Guest-VLAN over the wire received a CP page and was able to surf the internet. Same VLAN on the other location (different building but same subnet), same VLAN but this time mobile phone wirelessly no joy. CP URL can be resolved to the correct PA IP address but the page just not appearing (not presented by PA) so l cannot type username /password hence the user is unknown and no network/internet access. Where do l look for the logs in the tech support file?

Can see some of the issues have been resolved in the next release but not sure if l am hitting one of the below bugs:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-5-addressed-issues

Thx,

Myky

Re: Captive Portal not presented for wireless users

Raido_Rattameister — Thu, 27 Apr 2017 18:45:29 GMT

Hey can you take laptop that works in first building to other one and see the result.

Some apps can interrupt captive portal. For example Skype and Dropbox.

If Skype is installed into device it sends constantly HTTP GET requests out.

Captive portal replies with 302 redirect every now and then because it does not like clients who DoS it.

And if you open browser it is rare occation that HTTP GET that got sent out by browser get's 302 to captive portal site.

Other thing is that if you don't decrypt SSL and user tries to load site over https then captive portal will not trigger etc.

So take laptop to other building and run Wireshark and compare output with packet capture taken on firewall.

Re: Captive Portal not presented for wireless users

Raido_Rattameister — Thu, 27 Apr 2017 18:47:37 GMT

You can exclude those prolematic apps from Captive Portal.

Create custom URL category and exclude this category from Captive portal.

I think that in case of skype address was conn.ckype.com

Re: Captive Portal not presented for wireless users

TranceforLife — Thu, 27 Apr 2017 18:58:17 GMT

@Raido_Rattameister thanks for the response

I was thinking about the PCAP, at least from the firewall side (in case l am trying with a mobile phone). I am just thinking if the CP presented by PA will l be able to see some traffic triggered from the phone (should do actually)...

Again all was working fine just suddenly stopped working 😄 (l don't like such situations). l also checked config audit on PA no changes were observed during the last month.

What do you think about the bugs mentioned above?

Re: Captive Portal not presented for wireless users

Raido_Rattameister — Thu, 27 Apr 2017 19:16:11 GMT

Yeah might be some bug if just stopped working. Last 2 for example in your list.

If it is not 24/7 environment then maybe can reboot box during offhours to save troubleshooting time.

If not then jump into logs.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-Captive-Portal/ta-p/52931

If you decide to reboot firewall then always generate tech support file BEFORE reboot to save pre-reboot firewall state for TAC.

Re: Captive Portal not presented for wireless users

TranceforLife — Thu, 27 Apr 2017 22:35:22 GMT

@Raido_Rattameister l will check the logs. Have generated 2 tech support files before and after mgmt server restart so have some material to check for tomorrow morning. Thanks for article

Re: Captive Portal not presented for wireless users

TranceforLife — Fri, 28 Apr 2017 21:18:13 GMT

@Raido_Rattameister l cannot even locate the file:

> less mp-log appweb3-l3svc.log

Strange issue. Today did another test. l was connected to the wifi with the same test PC, it is open SSID network without the authentication. So once l connected l can access resources locally and even withing the different zone where no auth required. Trying access the internet, the policy has a user-id enable with CP. Opening google.com, dns works fine, traffic logs shows that the client is sending some bytes/packets to the Palo interface (Palo interface configured a CP portal as well as the default gateway for the clients). 0 packets sent back to the client, and PCAP shows all traffic is dropped.

Then another test manually typing a CP URL into the Chrome as below:

http://guestportal.xxx
https://guestportal.xxx
http://10.128.32.1
https://10.128.32.1

none of the above work

But l was suddenly redirected when l typed random URL but this time l used 6082 port number:

https://guestportal.xxxx:6082/php/uid.php?vsys=1&url=http://www.bing.com%2fsearch%3fq%3dwireshark%26src%3dIE-TopResult%26FORM%3dIE11TR%26conversationid%3d

So Captive Portal has appeared and l was able to input my username/password and successfully was able to browse the internet. For some reasons, http and https requests are not getting redirected to the Captive Portal:

Any thoughts guys?

Thx,

Myky

Re: Captive Portal not presented for wireless users

Raido_Rattameister — Mon, 01 May 2017 13:31:53 GMT

Just a wild guess - security policy drops traffic.

First policy shows client sending SYN out but nothing coming back.

For captive portal to work 3way handshake SYN, SYN ACK, ACK must complete to get to HTTP GET step.

Compare what traffic policy mathes when traffic is dropped and what policy it matches when you go to this random url that kicks in CP action.

Re: Captive Portal is not presented for wireless users

TranceforLife — Wed, 10 May 2017 09:42:42 GMT

@Raido_Rattameister thanks for the suggestions. Currently logged with TAC. Will post update later

Re: Captive Portal is not presented for wireless users

TranceforLife — Mon, 22 May 2017 19:51:04 GMT

FYI @Raido_Rattameister

Was interesting one 🙂 But the issue was quite obvious. Palo is configured as syslog listener. It receives a syslog messages from the Kiwi syslog server (fed by Aerohive APs, 120 in total I think). With TAC from the PCAP we could see that the unknown user is coming from the Kiwi as "username= no" syslog string but the Palo syslog parser was mapping that user to "n". So in the end all users were mapped as "domain\n" username hence no CP was presented (as all users have ip addresses). Initially, we have configured ignore user with "domain\n", that didn't work (unknown users mapping time out still was refreshing by syslogs). Took off the domain and left an "n" only and that worked:

Thanks all for the help

EDIT: Upgrade device to the 7.1.9 didn't help

Re: Captive Portal is not presented for wireless users

Raido_Rattameister — Mon, 22 May 2017 19:02:06 GMT

Thanks for update.

I would guess Monitor > Traffic marked "domain\n" correctly as Source user in logs during this issue?

Re: Captive Portal is not presented for wireless users

TranceforLife — Tue, 23 May 2017 07:47:38 GMT

Yes, it was mapped "correctly" for the different IPs with the same username "domain\n".

Re: Captive Portal is not presented for wireless users

DaveT — Thu, 26 Apr 2018 15:32:51 GMT

Can you shoot me a how-to to get Kiwi working with the script Aerohive says works with Palo's API? I've been beating my head against the wall for some time now and cannot get kiwi to send the log to the Palo.