Do captive portal apply to all web-browsing traffic or only to rules with user-id required?

[asia]

Hello,

I noticed that captiv portal is intercepting all web-brosing traffic, including traffic matching rules with userd-id required and rules without it.

Is there any solution to make some web-brosing traffic pass witghout beeing intercepted by the captive portal.

Regards.

[nrice]

You can verify you user mapping with the command >show user ip-user-mapping.  If he mapping looks good, those users should not be intercepted with Captive Portal.   The problem may be that users are logging into their workstations locally without logging into the domain, which would prevent the PanAgent from picking up  the login event from the AD. You may want to contact your support provider to verify your logs and configuration.

[asia]

Thank you Rice,

But in my case, i was thinking that the matching of the captiv portal rule is conditioned by configuring user identification within security rules. So whene rules without user-id are matched, captive portal is not executed even if there is a captive portal rule with the same source and destination configured in the security rule. Is this true, or the captive portal is intercepting alla http traffic even if it pass throw a rule without user-id?

Regards

[nrice · Accepted solution]

The packet flow in the firewall hits Captive Portal before it hits a Security Policy. If the user-ID is unknown for a given IP address and the packet is destined for TCP/80, the PAN will perform a Captive Portal policy lookup to see if Captive Portal is applicable.  If so there will be a session redirect of the current packet to Captive Portal.  Once Captive Portal is invoked, there will be a Security Policy lookup and among the fields used will be the source user-ID  to verify if there is a security rule match.

[asia]

Ok,

So the solution to exculde some destinations from being intercepted by the captive portal, is to ad a captive portal rule in top of the captive portal rules and specify in source and destination those that i don't want to authenticate and specify "no captive portal" in the method?

Regards,

[nrice]

Right, you'll specify the users you want excluded from Captive Portal under the Captive Portal rule.