Captive Portal Example: Create a Decryption Policy with an Outbound Rule
This part of the procedure discusses how to create adecryption policy to decrypt and resign traffic before the traffic reaches the captive portal. The captive portal can authenticate traffic only after it has been decrypted.
Before you begin
You must have an internal certificate authority (CA) for your outbound server; in other words, the managed device that decrypts the traffic for captive portal users to authenticate. This certificate must be different from the internal certificate you use to authenticate the captive portal with the managed device.
Procedure
| 1 |
Click . |
| 2 |
Click New Policy. |
| 3 |
Give the policy a unique Name and, optionally, a Description. |
| 4 |
Click the Outbound Connections tab.
|
| 5 |
Upload or choose certificates for the rules. The system creates one rule per combination of CA and networks/ports. |
| 6 |
(Optional.) Choose networks and ports. For more information: |
| 7 |
Click Save. |
| 8 |
Click Edit ( |
| 9 |
Click Edit ( |
| 10 |
Click Users. |
| 11 |
Above the Available Realms list, click Refresh ( |
| 12 |
In the Available Realms list, click Special Identities. |
| 13 |
In the Available Users list, click Unknown. |
| 14 |
Click Add to Rule. The following figure shows an example.
|
| 15 |
(Optional.) Set other options as discussed in Decryption Rule Conditions. |
| 16 |
Click Add. |
) next to the decryption policy you just created.
).