Explorer III

Solved

Wrong Policy match

5 replies
2639 views

Hello team,

I have a problem with matching a policy.

The policy in question is:

the policy logs (one is an example of a correct match and the 'other of a wrong match)

I can't figure out why they don't both match the same policy.

Thanks for the support

FortiGate

bpozdena_FTNTAnswer

Staff

Hi@luca1994 ,

You should exempt DNS traffic from the captive portal. Requiring authentication for DNS traffic will cause the clients to be unable to resolve domain names, which is needed in order to trigger the captive portal login page.

dbu

Staff

HI @luca1994 ,
I see two differences on the provided logs :

-Allowed traffic is doing SNAT

-Blocked traffic shows Denied by Thread

luca1994Author

Explorer III

Hi @dbu ,

yes but why in your opinion ?

I would have expected it to pass correctly and not "Denied bt Thread"

Thanks for the support

BR

funkylicious

SuperUser

Hi,

The only explanation i can see here, is that the user in question on the right side, isnt part of that group defined in the policy.

Whereas on the left side, no user was identified in the traffic so it was allowed.

"jack of all trades, master of none"

luca1994Author

Explorer III

Hi @funkylicious , thanks for the response.

The user in question on the right side is a guest user, infact in the section "guest management" is correctly present. Then there are a one guest group configured as follows:

guest group.png

And this group is in the policy. Any other suggestion for me?

Thansk for the support

BR

bpozdena_FTNTAnswer

Staff

Hi@luca1994 ,

You should exempt DNS traffic from the captive portal. Requiring authentication for DNS traffic will cause the clients to be unable to resolve domain names, which is needed in order to trigger the captive portal login page.

Sign up

Login with SSO

Login to the community

Login with SSO