Captive Portal Redirect Issue

[pomologist]

Hello!  Quick question:

I have captive portal set up for one zone and it works well, where my captive portal "redirect host" ip is in the same zone/subnet as my users who need to authenticate.  But I'm needing to expand this so that users from several zones/subnets can authenticate via captive portal. 

The problem I'm having is that for users in zones/subnets external to the captive portal IP,  the redirection gets stuck.  External users are redirected to the correct zone URL, but they get no response at that URL and the redirection times out. 

I have set up the correct security policy rules to allow the user zones to communicate with the redirect host IP captive portal zone.  I can ping the redirect host IP from the external zones users are trying to authenticate from.  But users in external zones never see the redirect web form. 

Does anyone have this working and can you advise what I'm overlooking?  Thanks!

[Remo]

Hi @pomologist 

Did you check the traffic log if there is still something dropped? What did you allow in the security policy rule you mentionned?

[reaper]

did you mke sure NAT is not being applied somehow, and did you set manual service ports (or 'any') in the security rule you created as CP uses port 6082 which could trip up 'application-default'

[pomologist · Accepted solution]

Well I figured out how to get it working! The problem was that every zone users are authenticating from needed a management profile with response pages turned on.

That seems counter intuitive as I was thinking only the destination zone should need that. 

But I turned on for both source and destination zone and everything immediately started working.

FYI, I’m using the latest version of pan os 10.