CP Policy

Showing results for 
Search instead for 
Did you mean: 

CP Policy

Not applicable

I'm trying to setup a captive portal and authenticate users via a user certificate, but I cannot get it to work in 5.0.1.

I already have a client certificate profile created but which setting do I need in the CP policy (action):

web-form => does not work since the user needs to specify username/password

no-captive-portal => does not prompt the user for a cert

browser-challenge => used for NTLM

As in 4.x there is a setting captive-portal which is not available in version 5.

Any suggestions ?



L6 Presenter

Verify that you in the settings for the interface facing the clients have enabled "userid".

L4 Transporter

Hello, there is a document on how to configure Captive Portal that you are can search for (it references the 4.0, with screen capture, etc), but essentially it is the same for 5.0, just renamed the options in the CP policy.

This is a snippet from that document:

Go to the Policies tab -> Captive Portal rulebase. Configure a rule that requires the users to authenticate.

Note that possible actions/methods for these policies are:

· captive-portal – this option presents a web form to the user (scenarios 1 & 2), or doesn’t require any user prompting if using client certificates (scenario 3)

· ntlm-auth – this option attempts to use NTLM to authenticate the user behind the

scenes (scenario 4)

In 5.0, you have browser-based  (NTLM version) or Web-based (which is the web page OR can be the same method when using the client-certificates)


When I select browser-based in my Captive Portal policy, the system needs an UID agent installed. Thats something I want to avoid since I want my users to authenticate via a certificate.

So, no other options left than ?

CP for browser based requires a UserId agent to be installed.  The FW  fwds userid  requests to agent, which can communicate to AD or WMI active queries.

Couldnt the CP policy use a radius or such or for that matter the internal userdb (for really small installations)?

Of course it can.  That is where Web-Form CP comes in.  In that method it can go to many different types, Radius, Kerberos, or even local.  When I first set up CP (just to understand how it worked), I used Local as my authentication type.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!