Using an explicit L3 interface for captive portal web form in PAN-OS 3.1.2

[asia]

Hello,

I noticed this in the PAN-OS 3.1.2 release notes :

Captive Portal Session Enhancements – The captive portal web forms method of authenticating
and identifying a user’s IP address has been modified to include a session cookie. This session
cookie is used to maintain the user to IP mapping as long as the users’ browser remains
running. In addition, an option to use an explicit L3 interface for the captive portal web form
can now be used to avoid certificate mismatch issues when presenting the form via SSL.

Does this mean that we can directly connect to captive portal web form without having the need to be redirected? If yes, i have installed the 3.1.2 version of PAN-OS, but i don't find any option to slect this kind of function. Any idea?

Regrd's.

[swhyte]

Hello Asia,

we still need to have sessions redirected to the Paloalto device to inject the captive portal form.

thanks,

Stephen

[asia]

Thanks stephen,

In this case, can you telle me the meaning of this point in the release notes.

Regards

[abarnett]

Hi Stephen,

Can we make this a feature request?  The ability to have non AD users go to a webforms page and authenticate without needing the be redirected first would be awesome.

thanks,

Andrew

[mjacobsen]

One way to get this behavior would be to setup a hostname in DNS that resolves to any IP address that would be routed through the firewall and would hit a captive portal rule. For example, if you added a DNS entry for login.mycompany.com that resolved to 1.1.1.1 and 1.1.1.1 was routed through an interface on the firewall with a CP rule for 1.1.1.1, they would get the login page. The DNS part isn't actually required for this. You could simply tell people to go to 1.1.1.1 if you wanted. 1.1.1.1 just needs to be some IP address that will get routed through the firewall. Could be a public IP or a private IP.

Mike