topic Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required? in General Topics

Do captive portal apply to all web-browsing traffic or only to rules with user-id required?

asia — Fri, 30 Apr 2010 15:31:59 GMT

Hello,

I noticed that captiv portal is intercepting all web-brosing traffic, including traffic matching rules with userd-id required and rules without it.

Is there any solution to make some web-brosing traffic pass witghout beeing intercepted by the captive portal.

Regards.

Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required?

nrice — Fri, 30 Apr 2010 23:47:03 GMT

You can verify you user mapping with the command >show user ip-user-mapping. If he mapping looks good, those users should not be intercepted with Captive Portal. The problem may be that users are logging into their workstations locally without logging into the domain, which would prevent the PanAgent from picking up the login event from the AD. You may want to contact your support provider to verify your logs and configuration.

Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required?

asia — Mon, 03 May 2010 12:28:01 GMT

Thank you Rice,

But in my case, i was thinking that the matching of the captiv portal rule is conditioned by configuring user identification within security rules. So whene rules without user-id are matched, captive portal is not executed even if there is a captive portal rule with the same source and destination configured in the security rule. Is this true, or the captive portal is intercepting alla http traffic even if it pass throw a rule without user-id?

Regards

Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required?

nrice — Mon, 03 May 2010 19:36:43 GMT

The packet flow in the firewall hits Captive Portal before it hits a Security Policy. If the user-ID is unknown for a given IP address and the packet is destined for TCP/80, the PAN will perform a Captive Portal policy lookup to see if Captive Portal is applicable. If so there will be a session redirect of the current packet to Captive Portal. Once Captive Portal is invoked, there will be a Security Policy lookup and among the fields used will be the source user-ID to verify if there is a security rule match.

Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required?

asia — Tue, 04 May 2010 14:15:47 GMT

Ok,

So the solution to exculde some destinations from being intercepted by the captive portal, is to ad a captive portal rule in top of the captive portal rules and specify in source and destination those that i don't want to authenticate and specify "no captive portal" in the method?

Regards,

Re: Do captive portal apply to all web-brosing traffic or aonly to reules with user-id required?

nrice — Tue, 04 May 2010 16:55:48 GMT

Right, you'll specify the users you want excluded from Captive Portal under the Captive Portal rule.