Skip to main content
luca1994
luca1994
Explorer III
October 12, 2023
Solved

Wrong Policy match

  • October 12, 2023
  • 5 replies
  • 2631 views

Hello team,

 

I have a problem with matching a policy.

The policy in question is:

policy.png

the policy logs (one is an example of a correct match and the 'other of a wrong match)

log.png

I can't figure out why they don't both match the same policy.

Thanks for the support

Best answer by bpozdena_FTNT

Hi@luca1994 ,

You should exempt DNS traffic from the captive portal. Requiring authentication for DNS traffic will cause the clients to be unable to resolve domain names, which is needed in order to trigger the captive portal login page.  

5 replies

dbu
Staff
dbu
Staff
October 12, 2023

HI @luca1994 , 
I see two differences on the provided logs : 

-Allowed traffic is doing SNAT

-Blocked traffic shows Denied by Thread

    luca1994
    luca1994Author
    Explorer III
    October 12, 2023

    Hi @dbu ,

     

    yes but why in your opinion ?

    I would have expected it to pass correctly and not "Denied bt Thread"

     

    Thanks for the support

    BR

    funkylicious
    SuperUser
    funkylicious
    SuperUser
    October 12, 2023

    Hi,

    The only explanation i can see here, is that the user in question on the right side, isnt part of that group defined in the policy.

    Whereas on the left side, no user was identified in the traffic so it was allowed.

    "jack of all trades, master of none"
    luca1994
    luca1994Author
    Explorer III
    October 13, 2023

    Hi @funkylicious , thanks for the response.

    The user in question on the right side is a guest user, infact in the section "guest management" is correctly present. Then there are a one guest group configured as follows:

     

    guest group.png

     

    And this group is in the policy. Any other suggestion for me?

     

    Thansk for the support

    BR

    bpozdena_FTNT
    Staff
    bpozdena_FTNTAnswer
    Staff
    October 13, 2023

    Hi@luca1994 ,

    You should exempt DNS traffic from the captive portal. Requiring authentication for DNS traffic will cause the clients to be unable to resolve domain names, which is needed in order to trigger the captive portal login page.  

    Terms & ConditionsAccessibility statement