Problem with Captive portal :

[ikkgroup]

Dears,

I'm using PA-500 with 5.0.11 OS.

I would like to get help for the captive portal, HTTPS traffic isn't being interrupted while HTTP is working fine and redirecting traffic for authorization.

Please help me.

Regards,

Umair.

[_slv_]

Yes, this is (unfortunetelly) expected behavior of PAN.

I have the same in my CP. I know that other vendors are able to redirect https session to Captive Portal.

Regards

SLawek

[VinceM]

Hi all,

PaloALto is able to do that only if in your CP policy you have configure service-http AND service-https.

Hope help.

V.

[_slv_]

Hi Vince

My CP policy of course using service-http AND service-https.

When I try to connect to any site with https://www.mozilla.com my webbrowser (Firefox) display "Connection was reset"

Regards

Slawek

[ikkgroup]

Thanks for the responses.

I have configured both HTTP and HTTPS both in service policy.

but unfortunately not getting right result and because of that some users are able to browse via https

Regards,

Umair.

[_slv_]

In my opinion something wrong is in Your security policy configuration if users are able to browse by https.

My looks like:

Vince - why in my config users aren't redirected to CP portal?

Regards

SLawek

[hyadavalli]

Hello Everyone,

For captive portal to work with https you need to setup decryption policy.

Regards,

Hari Yadavalli

[_slv_]

Please take a look MikroTik RouterOS • View topic - Hotspots and SSL redirection to login

"There is the new HTTP status codes which include 511 "Authentication Required", and although the RFC itself mentions that currently, browsers will show a certificate error on an SSL page, I think browser vendors should be asked to not do that."

Maybe this is a way to go with CP and PAN?

Regards

Slawek

[HITSSEC]

Umair,

We have a PA-5020 running 5.1.10 and do Captive portal internally and externally. In both cases we redirect http and https.  Please check the following setting:

Please check the management profile and make sure you have selected https response pages.

The Captive portal settings should look something like this:

Phil

[_slv_]

Hi Hitsec

thats very intersting what You wrote.

Could You share with us your settings of managemanet profile?

My looks like:

and it doesn'r redirect when You try to open https://www.mozilla.com with FF browser.

Regards

Slawek

[_slv_]

Hi Phil

I forgot to ask You about decryption policy - do You use SSL decryption?

Regards

Slawek

[HITSSEC]

Slawek,

I realized that is only http traffic that I am seeing redirected to Captive portal.  Sorry for misleading you and the discussion thread.  That has prompted me to look further into it.

Phil

[panos]

Agree with hyadavalli

You have to use SSL decryption.Without that page will not be loaded.(For unknown users allow only dns.)

[Retired Member]

Just to add to discussion, CP works by sending a 302 redirect when HTTP GET is received. HTTPS encrypts the GET message. Hence no redirect is triggered. This is why you need SSL decryption if you want to CP HTTPS traffic.

-Richard