topic Re: Captive portal SSL decryption policy requirement in General Topics

Captive portal SSL decryption policy requirement

tirexxerit — Tue, 19 Mar 2019 16:04:53 GMT

Hi,

PAN has the following document [1] which says you need to have SSL decryption in order to redirect SSL pages to captive portal.

To me it doesn't seem to be accurate. Response page [2] workaround seems to be doing the same i.e without having an SSL decryption policy, I see that SSL pages are redirected to captive portal properly. What am I missing? I have found

several posts about this topic referring response page document too but PAN's document contradicts this.

I have created a PAN case for clarification/document update though, I would appreciate forum users' feedback.

thanks.

[1] https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH8CAK

[2] https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0

Re: Captive portal SSL decryption policy requirement

reaper — Thu, 21 Mar 2019 10:55:37 GMT

That first article is simply very old and should have been archived, I'll go ahead and do that

Thanks for reporting this!

Re: Captive portal SSL decryption policy requirement

tirexxerit — Thu, 21 Mar 2019 12:23:45 GMT

Hi,

that is fine but please publish a new article as TAC keep telling us that SSL decryption is required for captive portal

and as per experience, it is not a correct statement. New article can be helpful for TAC and users like us 🙂

thanks.

Re: Captive portal SSL decryption policy requirement

mike.pochan — Tue, 01 Nov 2022 19:23:26 GMT

What is the actual requirement? We are trying to redirect to a captive portal for an auth policy for https traffic and are being told by TAC this isn't supported unless we are decrypting all of the https traffic.

Re: Captive portal SSL decryption policy requirement

ccscott — Tue, 01 Nov 2022 19:31:16 GMT

I think TaC is wrong here. The 2nd link has always worked for me, although I will say I've found it not to work 100% of the time with https traffic. SSL decryption certain does help.

I think this is an issue with 1st level TAC not knowing something.