Paloalto firewall captive portal

Home > Enterprise security devices or applications > Paloalto firewall > Captive Portal

Configure a captive portal with AD authentication

For captive portal via AD we need to add a LDAP server, create group mapping, create authentication profile and optionally create authentication sequence as explained at Paloalto firewall AD integration. Here for captive portal select appropriate AD Group eg "Captive Portal Users" instead of VPN related group as explained in linked article.

Assuming following is done using above reference:

• Configure LDAP server profile
• Configure Group mapping for the LDAP server
• Create Authentication Profile based on LDAP server and Group mapping
• (Optional) Create required local users and groups
• (Optionally) Create authentication sequence where first local authentication is tried before trying AD authentication

followed by testing as per "Test AD integration with Admin roles"

After above specifically for captive portal use:

1. Login into palo-alto firewall
2. Go to "Device" -> "User Identification" -> "Authentication Portal Settings"
   1. Click on Gearbox icon to open settings dialog
   2. Ensure "Enable authentication portal" is selected
   3. Under "Authentication Profile" choose LDAP based profile or Authentication sequence which will allow both local and AD based logins

      It is important to have AD for captive portal as there is no easy way to allow local firewall users to change their passwords

   4. Enable mode as "Redirect"
   5. Enable session cookie with 1440 timeout with roaming enabled
   6. In redirect host give firewall LAN management IP address. This is the IP where we open firewall for management and not gateway IP used by devices to route traffic to firewall.
   7. Click ok
3. Go to "Network" -> "Network Profiles" -> "Interface Mgmt"
   1. Edit the management profile used for LAN interface
   2. Ensure "Response pages" and "User-ID" are selected. Click ok
4. Go to "Network" -> "Zones". Select the zone for "LAN" typically named 'LAN'
   1. Enable "Enable User Authentication" and click ok
5. Go to "Objects" -> "Authentication" and click "Add"
   1. Add authentication object with desired name
   2. Set authentication method as "Web form"
   3. Select appropriate authentication profile (Or preferably authentication sequence)
   4. Click ok to add authentication object
6. Go to "Polices" -> Authentication and add a authentication profile with desired name
   1. In the policy choose Source Zone as LAN
   2. If policy should be applied only to a few selected addresses (Good for testing before implenting the same org-wide), then specify the IP address (/32).
   3. In Destination choose "WAN" zone
   4. In service/URL category ensure that only service-http and service-https are selected.
   5. Under Actions choose the Authentication enforcement object created in previous steps
   6. Click ok to add authentication policy
7. Test the captive portal from specified source addresses in the authentication policy. If it is working as per expectation, optionally enable it for the organization.
8. You can negate the policy for a few IPS eg servers / devices which may need Internet but may not have option to go through captive portal (Eg command line based servers without any GUI for captive portal authentication). Same can be required for appliances such as VMWare vCenter, etc.

Create exception for captive portal

Add a rule in captive portal above default rule under "Polices" -> Authentication" of all users with captive portal as none.

Home > Enterprise security devices or applications > Paloalto firewall > Captive Portal