Global Protect/Prisma Cloud not working for travelers

[cwcaron]

Anyone else facing issues with travelers using Global Protect (with enforcement on) who have a terrible time connecting to captive portals? 

This seems to be especially problematic at Marriott Hotels and Regus spaces.  From what I gather, if you're not connected to Global Protect you can't realize the protections of web content filtering and DLP provided by Palo Alto.  

However, for users to get past those issues with captive portals (despite Palo Alto stating that captive portals should work), they have to be able to disconnect.  The concern is that if someone is permitted to disconnect, you have to fall back to some other web content filtering/DLP solution. Anyone else struggling with this and or find a solution?  We've seen this with both 6.2.5 and 6.2.6 versions.  Please share what you've ben able to do in order to deal with these problems.  

[Vickynet]

---

@cwcaron wrote:

Anyone else facing issues with travelers using Global Protect (with enforcement on) who have a terrible time connecting to captive portals? 

This seems to be especially problematic at Marriott Hotels and Regus spaces.  From what I gather, if you're not connected to Global Protect you can't realize the protections of web content filtering and DLP provided by Palo Alto.  

However, for users to get past those issues with captive portals (despite Palo Alto stating that captive portals should work), they have to be able to disconnect.  The concern is that if someone is permitted to disconnect, you have to fall back to some other web content filtering/DLP solution. Anyone else struggling with this and or find a solution?  We've seen this with both 6.2.5 and 6.2.6 versions.  Please share what you've ben able to do in order to deal with these problems.  

---

Hello  @cwcaron , have you tried the configuration setup documented here: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-quick-configs.... Generally, from my experience with the issue, GP version 6.2.5 addresses most of the bugs related to the scenario you mentioned above. If you are sure users running 6.2.6 is still having the issue, try the settings in the attached documentation. 

[nikoolayy1]

In addition to what @Vickynet  said you can try the new Prisma Access Browser Prisma Access Browser as you can enforce DLP policies directly in it and as it is based on Chromium it should handle well captive portals as well. You can even block traffic to you internal apps if it is not coming from the browser.