Is Captive Portal triggered when using "any" as user in security policy?

[GLastra]

I read a lot of captive portal set up. In almost every documents says that the user "unknown" doesn't trigger the captive portal. I think that the "any" user also included the "unknown" user, I'm not quite sure if those rules are gonna trigger the captive portal policy [And I don't want to]

[dreputi]

Yes, I have tested this in the lab and it does trigger Captive Portal when using "any" as user in security policy.

If you have security rule with user as "Unknown" it will work fine, and triggers captive portal login page..

If you have security rule with user as "any" it will work fine. and triggers captive portal login page

If you have security rule with user as "Known-user" it will not work because captive portal is only for unknown users.

To learn more about captive portal here is a link:

How to Configure Captive Portal

Let me know if you have any questions.'

Regards,

Dileep

[sjamaluddin]

When you have no IP to user mapping for a particular IP address, for traffic that comes in on a zone that has User Identification enabled, AND a CP policy is enabled, then the CP page should be triggered.

When looking at the Security policy, you are trying to restrict traffic for only "Known" users - whether they known via the User ID agent, or CP, or GP, the security policy will control what traffic is allowed for what users.

If you choose to put "unknown" or "any" - that would imply that you do not really care about "known" users.

The security policy is more for controlling who gets what access.

To trigger the CP policy, you ought to look at the CP policy and the zones and addresses for which you'd like the CP policy triggered.