topic Re: Captive portal URL not working when accessed from inside zone in General Topics

Captive portal URL not working when accessed from inside zone

Sly_Cooper — Mon, 23 Aug 2021 18:04:22 GMT

I have configured Captive Portal with MFA and it works fine when the user traffic is originated from Untrust side of the firewall. When the URL "https://<firewall name>:6082/php/uid.php?vsys=1&rule=0" access from one of the internal zones (e.g.) Trust, it does not work. I have user-identification enabled on all zones.

User from outside of firewall -> captive portal URL on untrust interface -> [Works fine]

User from inside of firewall -> trust -> captive portal URL on untrust interface [Does not work]. Ping works fine.

I tried packet capture and could only see SYN packets. Ping works fine. The firewall is also configured to allow non-syn tcp. There is no return traffic or 0 bytes for the traffic received. Intra-zone and security policies are configured to allow as well. Packet capture shows drop file created with SYN packets only.

No NAT involved. All internal configuration.

Any suggestion?

Re: Captive portal URL not working when accessed from inside zone

LAYER_8 — Mon, 23 Aug 2021 20:48:54 GMT

Is there a chance the browser is using DNS over HTTPS? DoT we can see into if decrypted, but many browsers default to DoH nowadays and I've fixed a few website resolution issues from internal zones this way.

Re: Captive portal URL not working when accessed from inside zone

CBittig — Tue, 24 Aug 2021 08:11:41 GMT

I have the same problem as you and have opened a ticket (Case 01900506).
A solution to the problem is still pending.

Re: Captive portal URL not working when accessed from inside zone

Sly_Cooper — Tue, 07 Sep 2021 18:17:42 GMT

I managed to resolve the issue. The untrust interface had "Response Pages" option enabled for the interface mgmt. profile. The option is required for the Captive Portal redirection to work. It worked fine for all external users. Since in this case, the traffic was originated from inside of the firewall zone, the inside zone was hit first. I had to update the interface mgmt profile applied to the inside interface and enable "Response Pages" enabled. This helped systems from inside zone to hit the captive portal page.

Re: Captive portal URL not working when accessed from inside zone

Sly_Cooper — Tue, 07 Sep 2021 18:18:15 GMT

@LAYER_8 Please check the accepted solution I posted.