Chrome Bypassing Captive Portal for Google Services

[actibit]

Hi,

PANOS 4.1.6

Client OS: Windows 7

Client Browser: Google Chrome 21.0.1180.89

I have PAN running with CaptivePortal (Public Certificate with AD Auth profile). Everything works fine when I use Firefox, Chrome and IE (in the case of IE except for the small hitch discussed here in this forum when running on Windows7). I am prompted to Authenticate WebForm without any certificate warning etc etc. How ever when I try gmail.com in chrome (and only in chrome it happens), it simply takes me through and lets me login to gmail and do what ever I want to. Its true for certain other google Apps services ( like Chrome WebStore, Google Analytics etc) too. CaptivePortal is running on Redirect mode on the Trust Interface (l3)

Any thoughts please?

Cheers.

[essnet]

URL category won't be unknown : it reads URL hostname (not real url which is encrypted) from certificate itself that passes trough, so it will  see *.google.com.

If you are using Macs, then consider GlobalProtect Portal with agents installed on corporate computers.

[actibit]

Looking at the URL Logs, things are working the way expected. But I think, as you said, since https response cant be rewritten (unless ssl decrypt) we cant force a block page..right?

Thanks

[essnet]

Yes you got it right.

GlobalProtect Client for Internet Gateways and Portal might be the answer you are looking for.

[actibit]

I thought about GP earlier, but deploying on corporate and not deploying on consultants will make it hard to manage in over all...So I think will have to live with it for now, by announcing to login to our company http website (which then takes to CP ) who ever have internet issues , probably ...!!

Thanks mate.