Captive Portal and Enforce GlobalProtect for Network Access
In most instances, mobile users connect to Wi-Fi networks on which a captive portal has been enabled, such as those used in coffee shops, airports, and hotels. Internet access becomes available only after users log in to the captive portal. Users can log in through a browser-based captive portal login page or OS-based captive portal assistant using identifiers such as a name and email address. With this configuration, you can limit the amount of time for which users can log in to the captive portal. If a user logs in successfully and the Internet becomes reachable, the GlobalProtect app automatically establishes a connection. If a user fails to log in within the specified time period, all traffic will be blocked.
To further reduce the risk of exposing your network to security threats, you can also enforce GlobalProtect for network access. When you enable this option, GlobalProtect blocks all network traffic until the app connects to a GlobalProtect gateway. All traffic is required to go through the VPN tunnel for inspection and policy enforcement, thereby enabling you to maintain full visibility and control over your users’ traffic.
Based on the presence of a captive portal and whether the GlobalProtect connection is required for network access, users must follow a specific workflow to access the network:
Enforce GlobalProtectfor Network Access
If the GlobalProtect connection is required for network access, and your end users must also log in to a captive portal to access the Internet, they must use the following steps to access the network:
If your end users must log in to a captive portal to access the Internet, but the GlobalProtect connection is not required for network access, they must use the following steps to access the network:
If the GlobalProtect connection is required for network access, but your end users do not have to log in to a captive portal to access the Internet, they must connect to the Wi-Fi network. As soon as the Wi-Fi is connected and Internet is reachable, the GlobalProtect app connects automatically.
If the app does not connect immediately, and your administrator configures a traffic blocking notification message to indicate that you must connect to GlobalProtect for network access, it displays this message until the connection is established. If GlobalProtect is unable to establish a connection, you will be locked out of the network. You must re-initiate network discovery by disconnecting and then reconnecting to the Wi-Fi network, rebooting your endpoint, or refreshing the GlobalProtect connection.
Use the following steps to the customize captive portal settings and indicate whether the GlobalProtect connection is required for network access:
Enforce GlobalProtect for Network Accessoption only if you configure GlobalProtect with the Always On connect method.
- To ensure that the GlobalProtect connection is always on, set theConnect MethodtoUser-logon (Always On).
- If your users must log in to a captive portal to access the Internet, you can customize the captive portal settings by configuring the following options:
- In theCaptive Portal Exception Timeout (sec)field, enter the amount of time (in seconds) within which users can log in to the captive portal (range is 0 to 3600 seconds; default is 0 seconds). If users do not log in within this time period, the captive portal login page times out and users will be blocked from using the network.
- To enable the GlobalProtect app to notify users when it detects a captive portal, set theDisplay Captive Portal Detection MessagetoYes.
- In theCaptive Portal Notification Delay (sec)field, enter the amount of time (in seconds) after which the GlobalProtect app displays the captive portal detection message (range is 1 to 120 seconds; default is 5 seconds). GlobalProtect initiates this timer after the captive portal has been detected but before the Internet becomes reachable.
- Customize theCaptive Portal Detection Messagethat displays when GlobalProtect detects a captive portal.
- To force all network traffic to traverse the GlobalProtect VPN tunnel, configure the following options:
- Set theEnforce GlobalProtect for Network Accessoption toYes.
- To enable the GlobalProtect app to notify users that the GlobalProtect connection is required for network access, set theDisplay Traffic Blocking Notification MessagetoYes. The GlobalProtect app displays this message when the Internet becomes reachable but before the GlobalProtect connection is established.
- In theTraffic Blocking Notification Delay (sec)field, enter the amount of time (in seconds) after which the GlobalProtect app displays the traffic blocking notification message (range is 5 to 120 seconds; default is 15 seconds). GlobalProtect initiates this timer after the Internet becomes reachable.
- Customize theTraffic Blocking Notification Messagethat displays when the GlobalProtect connection is required for network access. This message must be 512 characters or less.
- Committhe changes.
Recommended For You
Recommended videos not found.