Wrong Policy match

[luca1994]

Hello team,

I have a problem with matching a policy.

The policy in question is:

the policy logs (one is an example of a correct match and the 'other of a wrong match)

I can't figure out why they don't both match the same policy.

Thanks for the support

[dbu]

HI @luca1994 , 
I see two differences on the provided logs : 

-Allowed traffic is doing SNAT

-Blocked traffic shows Denied by Thread

[luca1994]

Hi @dbu ,

yes but why in your opinion ?

I would have expected it to pass correctly and not "Denied bt Thread"

Thanks for the support

BR

[funkylicious]

Hi,

The only explanation i can see here, is that the user in question on the right side, isnt part of that group defined in the policy.

Whereas on the left side, no user was identified in the traffic so it was allowed.

[luca1994]

Hi @funkylicious , thanks for the response.

The user in question on the right side is a guest user, infact in the section "guest management" is correctly present. Then there are a one guest group configured as follows:

And this group is in the policy. Any other suggestion for me?

Thansk for the support

BR

[bpozdena_FTNT · Accepted solution]

Hi@luca1994 ,

You should exempt DNS traffic from the captive portal. Requiring authentication for DNS traffic will cause the clients to be unable to resolve domain names, which is needed in order to trigger the captive portal login page.