In captive portal, not asking for authentication for https traffic.

[Gururaj]

Hi All,

Captive portal is working fine for http traffic( asking for authentication ), But for https traffic it is not asking for the authentication. For example if user types facebook.com, asking authentication if types https://facebook.com then it is allowing without asking for authentication. I have added both http and https services in captive portal policy.

Installed PAN OS version is 4.1.7 (As per release notes it should support captive portal for https traffic too)

Please help me to fix this issue.

Regards

Guru.

[arkadios · Accepted solution]

Maybe you need to activate a SSL decryption in the firewall.

Regards

Marco Herrera.

[Gururaj]

Hi Marco,

Thank You,..That worked, Please I need Some more help,

1. If i enable decryption for all traffic ( Any URL Category ) that will slow down's the box performance. Is there any other way to minimize this ?
2. And also it gives two certificates, one for decrypt policy and another for captive portal which will irritate the users.

Regards

Guru

[arkadios]

Just decrypt a Social pages or pages you need to "block" over SSL... to not slow down a box performance... (is just an idea), you can do this with 2 policies in Policies -> decryption: Options Tab -> No Decrypt / Decrypt

And i don't know about point 2 sorry...

Regards

Marco.

[essnet]

Decryption is done by dedicated CPUs , you shouldn't expect slowdowns (we don't over here)

If you do the job correctly, decryption shoudldn't create SSL certificate warning ( Root CA must be trusted on your company computers). there are many guides about that on this portal.

[mikand]

The limit is rather how many concurrent ssl terminations the box you have can do. If you have plenty of SSL traffic to decrypt you might need to step up one or two models (in terms of number of concurrent ssl sessions).

[Gururaj]

Thank you All,

Regards

Guru.