Device > User Identification > Captive Portal Settings
Edit ( ) the Captive Portal Settings to configure the firewall to authenticate users whose traffic matches an Authentication policy rule.
If Captive Portal uses an SSL/TLS Service profile (Device > Certificate Management > SSL/TLS Service Profile), authentication profile (Device > Authentication Profile), or Certificate Profile (Device > Certificate Management > Certificate Profile), then configure the profile before you begin. The complete procedure to configure Captive Portal requires additional tasks in addition to configuring these profiles.
You must Enable Captive Portal to enforce Authentication policy (see Policies > Authentication).
Enable Captive Portal
Select this option to enable Captive Portal.
Idle Timer (min)
Enter the user time-to-live (TTL) value in minutes for a Captive Portal session (range is 1 to 1,440; default is 15). This timer resets every time there is activity from a Captive Portal user. If idle time for a user exceeds the Idle Timer value, PAN-OS removes the Captive Portal user mapping and the user must log in again.
This is the maximum TTL in minutes, which is the maximum time that any Captive Portal session can remain mapped (range is 1 to 1,440; default is 60). After this duration elapses, PAN-OS removes the mapping and users must re-authenticate even if the session is active. This timer prevents stale mappings and overrides the Idle Timer value.
You should always set the expiration Timer higher than the Idle Timer.
SSL/TLS Service Profile
To specify a firewall server certificate and the allowed protocols for securing redirect requests, select an SSL/TLS service profile (Device > Certificate Management > SSL/TLS Service Profile). If you select None, the firewall uses its local default certificate for SSL/TLS connections.
In the SSL/TLS Service Profile, set the Min Version to TLSv1.2 and set the Max Version to Max to provide the strongest security against SSL/TLS protocol vulnerabilities. Setting the Max Version to Max ensures that as stronger protocols become available, the firewall always uses the latest version.
To transparently redirect users without displaying certificate errors, assign a profile associated with a certificate that matches the IP address of the interface to which you are redirecting web requests.
You can select an authentication profile (Device > Authentication Profile) to authenticate users when their traffic matches an Authentication policy rule (Policies > Authentication). However, the authentication profile you select in the Captive Portal Settings applies only to rules that reference one of the default authentication enforcement objects (Objects > Authentication). This is typically the case right after an upgrade to PAN-OS 8.0 because all Authentication rules initially reference the default objects. For rules that reference custom authentication enforcement objects, select the authentication profile when you create the object.
GlobalProtect Network Port for Inbound Authentication Prompts (UDP)
Specify the port that GlobalProtect™ uses to receive inbound authentication prompts from multi-factor (MFA) gateways. (range is 1 to 65,536; default is 4,501). To support multi-factor authentication, a GlobalProtect endpoint must receive and acknowledge UDP prompts that are inbound from the MFA gateway. When a GlobalProtect endpoint receives a UDP message on the specified network port and the UDP message comes from a trusted firewall or gateway, GlobalProtect displays the authentication message (seeCustomize the GlobalProtect App ).
Select how the firewall captures web requests for authentication:
Redirect mode is required if Captive Portal uses Kerberos SSO or NTLM authentication because the browser provides credentials only to trusted sites. Redirect mode is also required if Captive Portal uses multi-factor authentication (MFA).
(Redirect mode only)
(Redirect mode only)
Specify the intranet hostname that resolves to the IP address of the Layer 3 interface to which the firewall redirects web requests.
You can select a Certificate Profile (Device > Certificate Management > Certificate Profile) to authenticate users when their traffic matches any Authentication policy rule (Policies > Authentication).
For this authentication type, Captive Portal prompts the endpoint browser of the user to present a client certificate. Therefore, you must deploy client certificates to each user system. Furthermore, on the firewall, you must install the certificate authority (CA) certificate that issued the client certificates and assign the CA certificate to the Certificate Profile. This is the only authentication method that enables Transparent authentication for macOS and Linux endpoints.
When you configure Captive Portal for NT LAN Manager (NTLM) authentication , the firewall uses an encrypted challenge-response mechanism to transparently obtain user credentials from the browser without prompting the user.
To invoke NTLM authentication, Authentication policy rules must specify an Authentication Enforcement object with the Authentication Method set to browser-challenge or default-browser-challenge (Objects > Authentication). If the object specifies an Authentication Profile with Kerberos single sign-on (SSO) enabled, the firewall first attempts Kerberos authentication before falling back to NTLM. If the browser cannot perform NTLM or if NTLM authentication fails, the firewall falls back to web-form or default-web-form as the Authentication Method.
By default, Internet Explorer supports NTLM. You can configure Firefox and Chrome to use it, as well, but you cannot use NTLM to authenticate non-Windows endpoints.
Choose Kerberos SSO transparent authentication over NTLM authentication when configuring Captive Portal. Kerberos is a stronger, more robust authentication method than NTLM and it does not require the firewall to have an administrative account to join the domain.
These options apply only to the Windows-based User-ID agents. When using the PAN-OS integrated User-ID agent, the firewall must be able to successfully resolve the DNS name of your domain controller to join the domain. You can then enable NTLM Authentication in the PAN-OS integrated User-ID agent setup and provide the credentials for the firewall to join the domain. NTLM is available only for Windows Server version 2003 and earlier versions.
To configure NTLM for use with Windows-based User-ID agents, define the following:
Configure Captive Portal
Configure Captive Portal The following procedure shows how to set up Captive Portal authentication by configuring the PAN-OS integrated User-ID agent to redirect web requests ...
Objects > Authentication
Objects > Authentication An authentication enforcement object specifies the method and service to use for authenticating end users who access your network resources. You assign ...
Captive Portal Authentication Methods
Captive Portal Authentication Methods Captive Portal uses the following methods to authenticate users whose web requests match Authentication Policy rules: Authentication Method Description Kerberos SSO ...
Guidelines for Setting Authentication Server Timeouts
Guidelines for Setting Authentication Server Timeouts The following are some guidelines for setting the timeouts for firewall attempts to connect with External Authentication Services . ...
Authentication Authentication is a method for protecting services and applications by verifying the identities of users so that only legitimate users have access. Several firewall ...
Configure Authentication Policy
Configure Authentication Policy Perform the following steps to configure Authentication policy for end users who access services through Captive Portal. Before starting, ensure that your ...
Captive Portal Modes
Captive Portal Modes The Captive Portal mode defines how the firewall captures web requests for authentication: Mode Description Transparent The firewall intercepts the browser traffic ...
Configure Multi-Factor Authentication
Configure Multi-Factor Authentication To use Multi-Factor Authentication (MFA) for protecting sensitive services and applications, you must configure Captive Portal to display a web form for ...
NTLM Authentication Device User Identification User Mapping Palo Alto Networks User-ID Agent Setup NTLM You can use NT LAN Manager (NTLM) to authenticate only Windows ...