topic Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2 in General Topics

Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Mon, 30 Aug 2021 06:42:54 GMT

Hi All,

I have an issue where captive portal isn't working in Chrome 92.0.4515-159 and Edge 92.0.902.84 after updating to PAN OS 10.1.2. Captive portal is still working in IE 11 and Firefox 91.0.2 though.

Receiving the below error in Chrome and a similar error in Edge:

Has anyone come across this issue? It seems as though it may be a bug? Any ideas?

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Mon, 30 Aug 2021 06:53:03 GMT

Further to that I have tried the below from the command from the changes to default behavior doc from PAN but seems to be to no avail.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

BPry — Tue, 31 Aug 2021 03:43:18 GMT

@Ben-Price,

That is Chrome's new Captive Portal connection screen. If you click on Connect does it actually present the Captive Portal page or not?

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Tue, 31 Aug 2021 06:09:20 GMT

@BPry It does not present the captive portal. I have a further screen shot's from the client in Edge, but the same behavior occurs in Chrome (see below).

Workflow is:

1. Browse to google in Chrome or Edge

2. Redirects to the page below (picture 1)

3. Click connect and get a new tab which is blank (picture 2)

In IE it redirects to the captive portal page.

In Firefox you get a pop up warning about a security exception once accepted it redirects you to the captive portal.

I have also restarted the l3-service and cleared browser cache, decryption profile is only applied to some of the affected users, so don't think that's an issue. Don't think its a config issue as it works in IE and Firefox.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Wed, 01 Sep 2021 23:12:13 GMT

@BPry Are you able to provide any further feedback here?

Thanks in advance.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

BPry — Thu, 02 Sep 2021 02:59:06 GMT

@Ben-Price,

I haven't had a chance to try to duplicate this on any of my 10.1.2 VMs. It could be a bug that got introduced in 10.1.2, but if it is I haven't seen any reports about it yet.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Thu, 02 Sep 2021 05:28:04 GMT

@BPry OK thanks, if you are able to test that would be much appreciated as I don't have access to a 10.1.2 VM. Is there anything else you can think of that may be causing this?

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Mon, 06 Sep 2021 01:37:57 GMT

@BPry I also asked the client to disable QUIC, but this hasn't made a difference. Client also mentioned that in Chrome and Edge the authentication form used to pop up in a window rather than the graphical PAN login page. Pop ups aren't being blocked by Chrome or Edge, but the issue remains.

Ran the below command while browsing to the captive portal from Chrome and received the below:

admin@firewall(active)> tail follow yes mp-log l3svc_ngx_error.log
2021/08/30 10:29:39 [alert] 21732#0: setrlimit(RLIMIT_NOFILE, 100000) failed (1: Operation not permitted)
2021-08-30 10:29:47.203 +1000 sysd worker[0]: ffe1980110: starting up...
2021-08-30 10:29:47.204 +1000 sysd worker[0]: ffe1980110: starting up...
2021/08/30 10:29:39 [alert] 21731#0: nginx connected to sysd! SUCCESS
2021/08/30 10:29:39 [alert] 21732#0: nginx connected to sysd! SUCCESS
2021-08-30 10:29:49.229 +1000 nginx worker process 21732, slot 1
2021-08-30 10:29:49.231 +1000 nginx worker process 21731, slot 0
2021/09/01 08:49:11 [error] 21731#0: *146400 directory index of "/var/html/" is forbidden, client: ::ffff:10.120.200.68, server: , request: "GET / HTTP/1.1", host: "captiveportal.local:6082"
2021/09/01 08:49:18 [error] 21731#0: *146400 directory index of "/var/html/" is forbidden, client: ::ffff:10.120.200.68, server: , request: "GET / HTTP/1.1", host: "captiveportal.local:6082"
2021/09/03 10:52:09 [error] 21732#0: *298567 directory index of "/var/html/" is forbidden, client: ::ffff:10.140.200.8, server: , request: "GET / HTTP/1.1", host: "captiveportal.local:6082"

I am also seeing this error in the log I got from the TSF file. Any ideas?

Error: pan_compare_hmac(panos_addons/pan_l3svc_utils.c:2068): hmac is different!2021-08-25 10:30:30.776 +1000 Error: pan_parse_bc_params(panos_addons/pan_l3svc_utils.c:2520): hmac is different return NGX ERROR!

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Nikko.Junia — Wed, 15 Sep 2021 09:09:47 GMT

I jut recently had PAN TAC check this.

Apparently you need to disable the token for captive portal via CLI.

configure

set deviceconfig setting captive-portal disable-token yes

Hope it helps

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Thu, 16 Sep 2021 02:13:53 GMT

Thanks @Nikko.Junia I had already tried that, but unfortunately to no avail. Did you have to do anything further after running that command?

@BPry I have also discovered that the client was using NTLM in PAN OS 9.1 which has been deprecated in 10.0 and above, so there NTLM config was blown away after the update, as they were not aware. They are now trying to implement Kerberos SSO. I performed a packet capture while they browsed to the captive portal and can see the below S2C flow in Wireshark, so am thinking this could be part of the issue. Is there any specific browser settings required for Kerberos SSO to work?

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Nikko.Junia — Thu, 16 Sep 2021 02:22:42 GMT

Before doing the command, PAN TAC advised that since service route was going through the management interface, they advised me to enable User-ID in the MGT interface but unfortunately, still the same issue . Then comes the command to disable the token in the Captive Portal and it worked.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Fri, 17 Sep 2021 01:18:40 GMT

Thanks @Nikko.Junia, so you can confirm that Chrome/Edge work with captive portal in PAN OS 10.1.2?

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

Ben-Price — Fri, 24 Sep 2021 05:27:16 GMT

@Nikko.Junia @BPry turns out the below command hadn't been run successfully by the client. I logged in and ran it, to triple check, and the issue is now resolved.

>configure

#set deviceconfig setting captive-portal disable-token

#commit

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

nikoolayy1 — Sun, 17 Oct 2021 10:16:45 GMT

Nice! It seems that other captive portals like Cisco Wi-Fi ones have this issue with the new edge and chrome as I was thinking it was Globalprotect VPN having issues but it is not.

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

tamilvanan — Sat, 13 Nov 2021 01:49:42 GMT

Hi Team,

After implementing the below command do we need to re-boot the firewall

>configure

#set deviceconfig setting captive-portal disable-token

#commit

I had upgraded the device recently to 10.1.0 and facing the same issue even after running the above command.

Any thoughts on this.

@Nikko.Junia @Ben-Price

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

wwww88889999 — Wed, 15 Dec 2021 21:42:58 GMT

I tried to run this command several times. I still get no results and I keep seeing the same screen on chrome

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

tamilvanan — Thu, 16 Dec 2021 04:06:01 GMT

Hi @wwww88889999 What Pan-OS version you are using

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

wwww88889999 — Thu, 16 Dec 2021 21:57:33 GMT

The firewalls were running on 10.0.8-h4, but I upgraded them to 10.1.3 to see if it could fix the issue. And so far, I keep seeing that screen on both Chrome and Edge. Now they're running on 10.1.3

Re: Captive portal not working in Chrome and Edge after updating to PAN OS 10.1.2

sgptihul — Tue, 11 Jan 2022 21:16:20 GMT

Hi guys,

In my firewall (PA-850, version 10.0.8-h4, the command looks like this: set deviceconfig setting captive-portal disable-token yes

So, does the disable-token parameter have to be no or yes for the captive portal to work in a browser like Google Chrome?

configure show