CP Policy

[loosj]

I'm trying to setup a captive portal and authenticate users via a user certificate, but I cannot get it to work in 5.0.1.

I already have a client certificate profile created but which setting do I need in the CP policy (action):

web-form => does not work since the user needs to specify username/password

no-captive-portal => does not prompt the user for a cert

browser-challenge => used for NTLM

As in 4.x there is a setting captive-portal which is not available in version 5.

Any suggestions ?

Johan

[mikand]

Verify that you in the settings for the interface facing the clients have enabled "userid".

[scantwell]

Hello, there is a document on how to configure Captive Portal that you are can search for (it references the 4.0, with screen capture, etc), but essentially it is the same for 5.0, just renamed the options in the CP policy.

This is a snippet from that document:

Go to the Policies tab -> Captive Portal rulebase. Configure a rule that requires the users to authenticate.

Note that possible actions/methods for these policies are:

· captive-portal – this option presents a web form to the user (scenarios 1 & 2), or doesn’t require any user prompting if using client certificates (scenario 3)

· ntlm-auth – this option attempts to use NTLM to authenticate the user behind the

scenes (scenario 4)

In 5.0, you have browser-based  (NTLM version) or Web-based (which is the web page OR can be the same method when using the client-certificates)

Thanks....

[JohanL]

When I select browser-based in my Captive Portal policy, the system needs an UID agent installed. Thats something I want to avoid since I want my users to authenticate via a certificate.

So, no other options left than ?

[scantwell]

CP for browser based requires a UserId agent to be installed.  The FW  fwds userid  requests to agent, which can communicate to AD or WMI active queries.

[mikand]

Couldnt the CP policy use a radius or such or for that matter the internal userdb (for really small installations)?

[scantwell]

Of course it can.  That is where Web-Form CP comes in.  In that method it can go to many different types, Radius, Kerberos, or even local.  When I first set up CP (just to understand how it worked), I used Local as my authentication type.