topic Re: Captive portal in Firewall and Security Management

Captive portal

Anna_Ushakova — Mon, 08 Apr 2019 09:34:13 GMT

Hi!

Users of non-domain PC started having problems with authorization on the captive portal. When you try to enter your login and password - writes that your session has expired. What could be the problem?

Thank 😃

Re: Captive portal

Nick_Doropoulos — Mon, 08 Apr 2019 09:59:00 GMT

Hi Anna,

Could you please answer the following questions so we can narrow down the potential causes:

How many users are affected?
Is this a new problem? Had the affected users experienced the same symptom before? If not, are you aware of any changes that could have occurred recently?
Is the problem intermittent or consistent?
Can you confirm that the problem occurs across all browsers?

If you could also provide us with the output of the following command it would be great:

[in clish] show version all

Finally, a screenshot of the relevant error would help tremendously as well.

Re: Captive portal

Anna_Ushakova — Mon, 08 Apr 2019 11:34:00 GMT

1)All non-domain PC users
2)New problem
3)The problem periodically arises - and not for long holds and leaves. The last 2 weeks became more frequent
4)Yes, all browsers

cp-gw> show version all
Product version Check Point Gaia R80.10
OS build 421
OS kernel version 2.6.18-92cpx86_64
OS edition 64-bit

cp-smart> show version all
Product version Check Point Gaia R80.10
OS build 421
OS kernel version 2.6.18-92cpx86_64
OS edition 64-bit

Re: Captive portal

Nick_Doropoulos — Tue, 09 Apr 2019 09:33:57 GMT

Hi Anna,

Could you provide us with the following as well please:

1) A screenshot of the error the affected users encounter.

2) A screenshot of the gateway's logs while the problem is being reproduced.

Thanks.

Re: Captive portal

Anna_Ushakova — Tue, 09 Apr 2019 09:43:17 GMT

Re: Captive portal

Nick_Doropoulos — Tue, 09 Apr 2019 10:32:08 GMT

Thanks for providing the requested info.

The next item that needs to be examined now is the way that Identity Awareness has been configured on your gateway.

More specifically:

1) What are the identity sources being used here? I am assuming that Browser-Based authentication has to be one of them given that we are trying to achieve access via the Captive Portal.

2) Are the affected users required to have the identity agent installed on their machines?

3) Provided the assumption on Step 1 is correct, navigate to the settings of the Browser-Based Authentication source

and tells us the session length for unregistered guests (since the affected users have not joined the domain and are therefore not known by the gateway).

4) What happens when a domain-registered user tries to log in to the Captive Portal from the same machine? Does the same symptom occur?

Re: Captive portal

D_W — Tue, 09 Apr 2019 11:12:44 GMT

We had this too in the past. Possibly the Multi Portal is not working correctly.
If you have a cluster try to fail over and test. Otherwise try to check the status of the Portal (mpclient status <portalname>) and or restart the Multiportal.

KR
David

Re: Captive portal

D_W — Tue, 09 Apr 2019 11:25:52 GMT