Many users receiving Captive Portal

[FabioGarcia]

Dears,

We have been facing a lot of users identified by Captive Portal and not via UIA.

Does anyone could suggest any troubleshooting/best practices to avoid this kind of behavior ?

Thanks in advance!!

[mivaldi]

Your UIA mappings are most likely timing out at the default of 45 minutes, and you're most likely relying on WMI Probes, which are failing, because your hosts are not correctly configured to respond to the WMI Probes.

Once the Probes fail, the user-ip mappings are deleted.

Once they are deleted, Captive Portal will trigger.

If the Captive Portal is set to its default Expiration of 60 minutes, then users will have to validate to CP every hour.

By default, User-ID Cache timeout is set to 45 minutes.

If users would be on site for a maximum of 12 hours, you can set the timeout to 720 minutes, and disable Probing.

Note I'm making a lot of assumptions based on similar cases I've worked. Your settings may differ, in that case, I recommend you open a Support ticket and we can take a closer look.

I also recommend checking out these documents:

Best Practices for Securing User-ID Deployments

User-ID Best Practices - PAN-OS 5.0, 6.0

[cpainchaud]

Hi essilorbr,

I also suggest that you look at GlobalProtect to transparently identify your users, please remember this is not only a VPN client but also an Authentication client when used in Internal mode.

Your colleagues from Essilor EMEA may help you setting up this configuration.

[FabioGarcia]

Hello, thx for you help... you meant change this parameter below at Agent ?

- disable WMI

- change user identification timeout from 30 to 720 ?

[mivaldi]

Yes, that is correct.

Enable WMI Probing: No

User Identification Timeout (min.): 720

[FabioGarcia]

Very nice!!

will try these options...