topic Re: Captive Portal doesn't work in FMC in Network Security

Captive Portal doesn't work in FMC

BaboMigo — Wed, 25 Sep 2024 07:24:49 GMT

Dears,

I'am using FTD 6.6.1 managed with FMC, i Configured Internal Certificats, Trusted Certificat, add DNS target with the routed interface, configured the Identity Policy, added it to the Access Policy and allowed it.

When now i go the user computer to go to internet, first i dont have the redirection, secundary, when i write the full URl : https://dj-captiveportal.rasdika.dj:885/ , I get this output : The requested URL / was not found on this server.

Re: Captive Portal doesn't work in FMC

MHM Cisco World — Wed, 25 Sep 2024 08:19:15 GMT

Can I know what you try here

Thanks

MHM

Re: Captive Portal doesn't work in FMC

Aref Alsouqi — Wed, 25 Sep 2024 09:48:45 GMT

Take a look at this video please and see if it helps:

18. Cisco FTD Identity Policy: Active Authentication (youtube.com)

Re: Captive Portal doesn't work in FMC

BaboMigo — Sun, 29 Sep 2024 13:26:41 GMT

@MHM Cisco World i am trying to make acitve authentication with FMC.

@Aref Alsouqi i did exactly what he does in video youtube, but nothing !!!!

Re: Captive Portal doesn't work in FMC

MHM Cisco World — Mon, 30 Sep 2024 08:09:23 GMT

Can you make double check steps by view this doc

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/217231-configure-fdm-active-authentication-cap.html

MHM

Re: Captive Portal doesn't work in FMC

balaji.bandi — Mon, 30 Sep 2024 08:27:47 GMT

how about only domain name with out port 885 ? what you get.

have you session analysis active user and events ?

@Aref Alsouqi suggested i have used many times and it works as expected.

check also guide from Cisco : (it has some videos )

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/create_and_manage_identity_policies.html

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/create_and_manage_realms.html

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 12:06:12 GMT

https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw/firepower-ftd-fmc-6-6x-fxos-2-8x-eol.html

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 12:21:53 GMT

Thanks @ahollifield i will upgrade the version, because it isn't working correctly

@MHM Cisco World your recent link is for FDM, i'am using FMC to manage and think it is a bit different !

The big issues is, that the portal captive work once per day, after i disconnect, i have issue to reconnect !

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 12:42:33 GMT

I would also question why captive portal on the FTD at all? Why not perform captive portal redirect on the NAD instead?

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 13:04:52 GMT

The captive portal is for Active Authentication in Identity Policy inside FMC, authenticate Users in LAN through to captiveportal before to access some ressources(like internet ...) ::::

what you mean in NAD ?

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 13:08:45 GMT

Network access device. Switch, WLC, etc. what is the NAC solution in the environment? Why not use ISE or ISE-PIC?

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 13:30:14 GMT

I have only Switchs, Small AccessPoint, and FTD managed with FMC. No ISE or ISE-PIC

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 13:38:45 GMT

So what is the identity source FTD using for auth on the captive portal? Local users? LDAP to AD? Something else?

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 13:45:31 GMT

FTD integrated with realm AD..

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 13:48:45 GMT

Got it, so again if there is AD here why use captive portal at all? Why not use ISE-PIC?

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 14:36:04 GMT

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 14:35:52 GMT

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 14:35:34 GMT

Re: Captive Portal doesn't work in FMC

BaboMigo — Mon, 30 Sep 2024 14:32:54 GMT

I didn't give much attention to ISE-PIC, I thought Cisco FTD had abandoned this technology and that active authentication is much more beneficial than passive one. I'm learning this from you. Is it a good solution that's easy to implement in an environment with 100-200 users?

Re: Captive Portal doesn't work in FMC

ahollifield — Mon, 30 Sep 2024 16:48:08 GMT

Active auth is ALWAYS better than passive auth. That being said captive portal sucks. The best solution is active authentication using 802.1X to ISE and share that context with FMC via pxGrid. If that is not available for whatever reason I would personally position ISE-PIC as a "good enough" solution before enforcing an annoying captive portal.