Captive Portal Configuration

[kuntzelectroplating]

I have read over the document on how to configure the captive portal. Maybe I am missing it, or having a senior moment, but I am little puzzled.

What I want to do is make sure when we have guests, vendors, salespeople etc, connect their device to our network that they have to authenticate before they can use the Internet. Where I am puzzled in the document is, it refers to a "guest network" for the NAT policy. That I do not have. The non-employees connecting to our network will be on the same subnet as everyone else. Can I still use captive portal using something simple like a "trust to untrust" policy, but not affect the employees?

Thanks

[ssharma · Accepted solution]

Yes, you can still use "trust to untrust" policy. Whenever firewall sees an IP address that does not have mapping (user to ip mapping), that IP address's browser will be presented with Captive Portal page for authentication. Once user authenticates, they will use same NAT policy as other known user. Thanks

[kuntzelectroplating]

OK, thank you. The way I read the documentation, I thought it meant you had to create a separate subnet just for captive portal purposes.

I will give it a try.

Thanks again