Is there a Captive Portal type solution for non http/https services?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Is there a Captive Portal type solution for non http/https services?

L0 Member

I am looking for a method to force identify users coming in over the internet trying to connect to an internal resource using MS-RDP.


I originally thought I could use Captive Portal for this but CP documentation indicates its only works with HTTP & HTTPS....obviously this makes sense because without an http interpreter, how else could an app that is not designed to talk to http recognize the HTTP/HTTPS Captive Port web-form or redirect.


Is it possible to force a type of user authentication for users coming from Untrust Internet (any IP) to Trust internal (specific IP).  Or what other method could I use or investigate?




L3 Networker

Use of User-ID based rules from Untrust (Internet) to Trust (internal) is discouraged. 


As User-ID creates a mapping of the IP address to a single user, the multiple NAT scenarios that can come into play here can give you unintended results. 


If we both happened to be at the same coffee shop and NAT'd to the same IP address, if you were the first to access the corporate resource and challenged by captive portal, I and all of the others in the coffee shop would inherit your access rights. 


You might consider deploying a GlobalProtect gateway, and then using your App-ID/User-ID based rules to permit access for the appropriate users to the systems via RDP.



Cyber Elite
Cyber Elite

as @asilliker already mentions, I'd deploy GlobalProtect from a best practices perspective

it will allow you to identify your users more easily and apply security policy based on their identity,  plus will add a layer of security (ipsec/ssl) to prevent snooping or MitM attacks when your users are making rdp connections from any random uncontrolled location to your infrastructure

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!