Captive portal SSL decryption policy requirement

[tirexxerit]

Hi,

PAN has the following document [1] which says you need to have SSL decryption in order to redirect SSL pages to captive portal.

To me it doesn't seem to be accurate. Response page [2] workaround seems to be doing the same i.e without having an SSL decryption policy, I see that SSL pages are redirected to captive portal properly. What am I missing? I have found

several posts about this topic referring response page document too but PAN's document contradicts this.

I have created a PAN case for clarification/document update though, I would appreciate forum users' feedback.

thanks.

[1] https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH8CAK

[2] https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0

[reaper]

That first article is simply very old and should have been archived, I'll go ahead and do that 

Thanks for reporting this!

[tirexxerit]

Hi,

  that is fine but please publish a new article as TAC keep telling us that SSL decryption is required for captive portal

and as per experience, it is not a correct statement. New article can be helpful for TAC and users like us 🙂

thanks.

[mike.pochan]

What is the actual requirement? We are trying to redirect to a captive portal for an auth policy for https traffic and are being told by TAC this isn't supported unless we are decrypting all of the https traffic. 

[ccscott]

I think TaC is wrong here. The 2nd link has always worked for me, although I will say I've found it not to work 100% of the time with https traffic. SSL decryption certain does help.

I think this is an issue with 1st level TAC not knowing something.