About Ameya-Kawimandan

Hello Luigi , Custom reports do not provide the option to report the GP related events at the moment. Your best bet would be to filter the System logs (Monitor>System) and filter for ( subtype eq globalprotect ) . This will provide you all the GP related activity on the firewall such as : GP user name ,IP address, login and logout details etc. You may also filter this logs for the following events for more granular results : ( eventid eq globalprotectgateway-config-succ ) ( eventid eq globalprotectgateway-regist-succ ) ( eventid eq globalprotectgateway-logout-succ ) ( eventid eq globalprotectgateway-config-release ) ( eventid eq globalprotectgateway-auth-succ ) ( eventid eq globalprotectportal-auth-succ ) ( eventid eq globalprotectportal-auth-fail ) HTH, Ameya ... View more

Hello cornbelt140 , If you disable session cookies in the Captive portal (CP) config, a CP user mapping would be lost once the browser window is closed. Using is behavior to your advantage , a user using a shared Chromebook can just close the browser window to let a new user re-authenticate. The following Doc talks about Radius and User-ID integration in the environments using 802.1x devices and wireless access points and controllers. A script can be configured to run on the Syslog server that will extract the user and IP information from the message, format it correctly for the UID-API, and then send it to the API agent. Ref : UserID API integration using Syslog Also check : USER ID Issues HTH, Ameya ... View more

1>Configure a loopback interface and allow https on this interface through interface management profile. 2>Create a Destination NAT rule to translate the traffic on Public IP + Desired Port (4443) to Loopback IP : port 443. 3>Allow this traffic through security rule 4>Remove the Interface management profile off the Public interface. HTH, Ameya ... View more

Is this because the Captive Portal policy for this subnet is active (and cannot be controlled by a schedule).  Please elaborate if I misunderstood how to do this? CP page would be prompted as long as the HTTP GET request/HTTPS transaction reaches firewall's CP zone. Applying  schedules to the security rule that allows applications dns and web-browsing for unknown-users would ensure that DNS resolution and web-traffic only succeeds during the desired schedule, indirectly controlling the prompting of CP auth page. Also there is abosolutely not way to 'log off' a PanOS captive portal session?  Occasionally we make public computers available and it would be nice if the current user was able to log out before letting another user continue browsing the internet. Firewall sets a cookie so that future login requests become transparent to the user using session cookies in redirect mode, if the browser has not been closed, Try disabling this option so that a new user has to login when the current user closes the browser window. Currently there is no option to log off a CP user. HTH, Ameya ... View more