Description

This article describes the issue of the Unified Access Control (UAC) Captive Portal being unable to load the login page from the Infranet Controller (IC).

Symptoms

A customer has configured all unauthenticated traffic to be redirected to a sign-in page on a Junos Pulse Access Control Service device (IC or MAG series device) via a captive portal support. The landing page never displays.
 

  • The guest PC is in the WirelessGuest zone.
  • The IC is in the Server zone
  • The gust PC is configured to use a public DNS, such as 8.8.8.8 .

The customer would like a captive portal page to be displayed, which requires the user login, before gaining network access. This is not happening.

Solution

The SRX configuration would look like this:

from-zone WirelessGuest to-zone untrust {
     policy GuesWIFI {

         match {

source-address any;

destination-address any;
application [ junos-http junos-https ];

         }

then {

    permit {
        application-services {

            uac-policy {

                captive-portal mycp;

            }

        }

    }

}


and
show services unified-access-control

infranet-controller 42-IC {

address 10.10.1.175;
interface ge-0/0/2.0;

      password "$9$7J-VYHkPz39JGF/9AIRVwYgZU"; ## SECRET-DATA

}

timeout 600;
timeout-action open;

captive-portal mycp {
    redirect-traffic unauthenticated;

          redirect-url https://10.10.1.175;

      }


The issues with this configuration are:
 
  • The IC in this example is not accessible from the WirelessGuest zone.
  • The client PC from the WirelessGuest zone does not have any DNS access to resolve the original URL, which was provided in the user's browser session.

To resolve this, you will need to modify the SRX configuration to allow a pin-hole connection from the WirelessGuest zone to the Servers zone for IC access. Additionally, you will need to allow DNS traffic to a functional DNS server. In this case, you can allow DNS traffic out to the internet via the untrust zone. 

Refer to the following configuration:

from-zone WirelessGuest to-zone untrust {
    policy DNS-Out {
        match {
            source-address any;
            destination-address any;
            application [ junos-dns-udp junos-dns-tcp ];
        }
then {
    permit;
}
    }
policy GuesWIFI {
    match {
        source-address any;
        destination-address any;
        application [ junos-http junos-https ];
    }
then {
    permit {
        application-services {
            uac-policy {
                captive-portal mycp;
            }
        }
    }
}


As well as :
from-zone WirelessGuest to-zone Servers {
    policy ICPinhole {
        match {
        source-address any;
        destination-address [ 42-IC IC ];
        application any;
        }
then {
    permit;
}
    }
}


 
 

Modification History

2019-07-05: Content reviewed for accuracy