Captive Portal and Enforce GlobalProtect for Network Access
In most instances, mobile users connect to Wi-Fi networks on which a captive portal has been enabled, such as those used in coffee shops, airports, and hotels. Internet access becomes available only after users log in to the captive portal. Users can log in through a browser-based captive portal login page or OS-based captive portal assistant using identifiers such as a name and email address. With this configuration, you can limit the amount of time for which users can log in to the captive portal. If a user logs in successfully and the internet becomes reachable, the GlobalProtect app automatically establishes a connection. If a user fails to log in within the specified time period, all traffic will be blocked.
To further reduce the risk of exposing your network to security threats, you can also enforce GlobalProtect for network access. When you enable this option, GlobalProtect blocks all network traffic until the app connects to a GlobalProtect gateway. All traffic is required to go through the VPN tunnel for inspection and policy enforcement, thereby enabling you to maintain full visibility and control over your users’ traffic.
Based on the presence of a captive portal and whether the GlobalProtect connection is required for network access, users must follow a specific workflow to access the network:
Enforce GlobalProtectfor Network Access
If the GlobalProtect connection is required for network access, and your end users must also log in to a captive portal to access the internet, they must use the following steps to access the network:
If your end users must log in to a captive portal to access the internet, but the GlobalProtect connection is not required for network access, they must use the following steps to access the network:
If the GlobalProtect connection is required for network access, but your end users do not have to log in to a captive portal to access the internet, they must connect to the Wi-Fi network. As soon as the Wi-Fi is connected and internet is reachable, the GlobalProtect app connects automatically.
If the app does not connect immediately, and your administrator configures a traffic blocking notification message to indicate that you must connect to GlobalProtect for network access, it displays this message until the connection is established. If GlobalProtect is unable to establish a connection, you will be locked out of the network. You must re-initiate network discovery by disconnecting and then reconnecting to the Wi-Fi network, rebooting your endpoint, or refreshing the GlobalProtect connection.
Use the following steps to the customize captive portal settings and indicate whether the GlobalProtect connection is required for network access:
Configure the Enforce GlobalProtect for Network Access option only if you configure GlobalProtect with the Always On connect method.
- Set Up Access to the GlobalProtect Portal.
- Define the GlobalProtect Agent Configurations.
- Customize the GlobalProtect App.
- To ensure that the GlobalProtect connection is always on, set the Connect Method to User-logon (Always On).
- If your users must log in to a captive portal to access the internet, you can customize the captive portal settings by configuring the following options:
- In the Captive Portal Exception Timeout (sec) field, enter the amount of time (in seconds) within which users can log in to the captive portal (range is 0 to 3600 seconds; default is 0 seconds). If users do not log in within this time period, the captive portal login page times out and users will be blocked from using the network.
- To enable the GlobalProtect app to notify users when it detects a captive portal, set the Display Captive Portal Detection Message to Yes.
- In the Captive Portal Notification Delay (sec) field, enter the amount of time (in seconds) after which the GlobalProtect app displays the captive portal detection message (range is 1 to 120 seconds; default is 5 seconds). GlobalProtect initiates this timer after the captive portal has been detected but before the internet becomes reachable.
- Customize the Captive Portal Detection Message that displays when GlobalProtect detects a captive portal.
- To force all network traffic to traverse the GlobalProtect VPN tunnel, configure the following options:
- Set the Enforce GlobalProtect for Network Access option to Yes.
- To enable the GlobalProtect app to notify users that the GlobalProtect connection is required for network access, set the Display Traffic Blocking Notification Message to Yes. The GlobalProtect app displays this message when the internet becomes reachable but before the GlobalProtect connection is established.
- In the Traffic Blocking Notification Delay (sec) field, enter the amount of time (in seconds) after which the GlobalProtect app displays the traffic blocking notification message (range is 5 to 120 seconds; default is 15 seconds). GlobalProtect initiates this timer after the internet becomes reachable.
- Customize the Traffic Blocking Notification Message that displays when the GlobalProtect connection is required for network access. This message must be 512 characters or less.
- Commit the changes.
GlobalProtect Portals Agent App Tab
GlobalProtect Portals Agent App Tab Network GlobalProtect Portals Agent App Select the App tab to specify how end users interact with the GlobalProtect apps installed ...
Customize the GlobalProtect App
Customize the GlobalProtect App The portal agent configuration allows you to customize how your end users interact with the GlobalProtect apps installed on their endpoints. ...
Device > User Identification > Captive Portal Settings
Device > User Identification > Captive Portal Settings Edit ( ) the Captive Portal Settings to configure the firewall to authenticate users whose traffic matches ...
Device > Response Pages
Device > Response Pages Custom response pages are the web pages that display when a user tries to access a URL. You can provide a ...
Configure GlobalProtect to Facilitate Multi-Factor Authenti...
Configure GlobalProtect to Facilitate Multi-Factor Authentication Notifications To protect critical applications and stop attackers from using stolen credentials to conduct lateral movement throughout your network, ...
Export SAML Meta data from an Authentication Profile
SAML Metadata Export from an Authentication Profile Device > Authentication Profile The firewall and Panorama can use a SAML identity provider (IdP) to authenticate users ...
Objects > Authentication
Objects > Authentication An authentication enforcement object specifies the method and service to use for authenticating end users who access your network resources. You assign ...
Configure Authentication Policy
Configure Authentication Policy Perform the following steps to configure Authentication policy for end users who access services through Captive Portal. Before starting, ensure that your ...
Map IP Addresses to Usernames Using Captive Portal
Map IP Addresses to Usernames Using Captive Portal When a user initiates web traffic (HTTP or HTTPS) that matches an Authentication Policy rule, the firewall ...