Captive portal not getting login prompt with IE11.

[inderjit21]

PANOS- 7.0.6 . I am not getting prompted for captive portal login sometimes with ie11. works with firefox.

[rmonvon]

Hi...I would recommend checking the SSL cert that is use by Captive Portal and making sure it is accepted by IE11.  However, if it is working intermittently with IE11, I would suggest that you contact Support to have it looked at.

Thanks,

[mr.linus]

Hey,

I had the exact same issue and was able to indentfy the root cause:
IE11 with: "Bing" Add-on enabled + search in the address bar enabled

If you check with a http watch you can see what is going wrong:

• When you use IE with the bing add-on and you start to type the url, in the background for each letter you type a new get requests to api.bing.com/xxx is sent out
• If you type really slowly you can see the captive portal replying with a redirect for each get request
• If you type quikcly however, it seems like the captive portal has some kind of rate limitting and is not replying to each request
• This behaviour means that if you type in the full url and press enter immediatly, you can see in the http-watch:
  1) a number of api.bing.com get requests while typing the url
  2) redirect replies from the captive portal for these get requests
  3) the actual get request for the full url
  4) NO redirect reply
  => A blanc page gets displayed
• If hoewever, you type in the full url and WAIT 1 second before you press enter, you can see in the http-watch:
  1) a number of api.bing.com get requests while typing the url
  2) redirect replies from the captive portal for these get requests
  WAIT 1 second when you have completed the url and then press enter
  3) the actual get request for the full url
  4) a redirect reply from the captive portal
  => Now the captive portal page is shown
• If you dissable the Bing search add-on, the issue dissapears
  1) No api.bing.com get requests are sent out by the browser as you type in the url
  2) When you press enter after filling in the full url (even without waiting)
  => The captive portal page is displayed immediatly since this is the first redirect that needs to be sent to the client

Root Cause:

It seems like the captive portal is rate limmited and is not answering to all requests

Solution:

I have a support case open for this, will answer if they have found a solution

[mr.linus]

I got an answer from TAC to confirm the PA is indeed rate limitting these requests

If the client sends a lot of HTTP requests to the firewall, the firewall may drop the connection because this went beyond the captive portal limit. By default, the firewall captive portal has a maximum limit of 1 request every 2 seconds from any client. 

Default settings is PAN firewall to only redirect 1 GET request per 2 seconds per src IP (other connections get TCP RST). 

In order to change this behavior we imposed the following commands : 
>configure 
#set deviceconfig setting ctd cap-portal-ask-requests 2 
#set deviceconfig setting ctd cap-portal-ask-timeout 1 
#commit 

For the setting above, it will mean increasing the number of request per second (timeout) per IP address to 2, just enough to accommodate our needs and not to create a condition where MP can be overwhelmed with HTTP redirects

To see the dropped requests you can configure a filter to match client's requests and then list the delta for global counters and search for counter named ctd_cp_drop. In my example 25 requests were dropped
admin@PA-3020> show counter global filter packet-filter yes delta yes | match ctd_cp_drop
ctd_cp_drop 25 0 info ctd pktproc The number of sessions dropped because of captive portal page
admin@PA-3020>

When bing extension is used, it would generate 1 HTTP GET request for one character. Thus, after typing a long URL the limit of 1 GET request per 2 seconds can be easily reached.