Palo Alto and Captive Portal for Kerberos

[rickylv426]

HI all

We have a Palo Alto deployed in AWS and have a requirement to check for a users AD group before letting them into the network.

We cannot use User ID Agent as we are not allowed to set up connections to domain controllers as we have over 10 and the traffic load will be too much at the moment. So only option is to use kerberos to check user group.

However Palo Alto docs say Captive Portal re direct for kerberos does not support SSL Decryption.

Does this mean the Captive portal page itself cannot use inbound decryption or any URLs cannot use it if we enable CP?

I.E User on WAN browses www.application.domain.com and the Palo Alto redirects to captive portal on www.portal.domain.com and does the Auth then redirects back to original URL. So in this this can we still keep SSL decrypt on the original URL and disable it on CP URL?

What other options are there?

Thanks

[rickylv426]

Anyone??

[BalaBWV]

any solution. the samething i am trying in Azure cloud