¿Cómo funciona un Captive Portal? Análisis Técnico Detallado

Un análisis técnico detallado y exhaustivo sobre la arquitectura de los captive portals, explicando la intercepción de DNS, la redirección HTTP, los jardines vallados (walled gardens) y la autenticación RADIUS para profesionales de TI.

📖 7 min de lectura📝 1,564 palabras🔧 2 ejemplos❓ 3 preguntas📚 8 términos clave

🎧 Escucha esta guía

Ver transcripción

How Does a Captive Portal Work? A Technical Deep Dive
A Purple WiFi Intelligence Briefing

[INTRODUCTION — approximately 1 minute]

Welcome to the Purple Technical Briefing series. I'm your host, and today we're going deep on captive portals — specifically, how they actually work under the hood. Not the marketing version. The real version: DNS interception, HTTP redirects, walled garden configuration, RADIUS authentication, and session lifecycle management.

If you're an IT manager, network architect, or CTO responsible for guest WiFi at a hotel, retail estate, stadium, or public-sector venue, this is the briefing you need before you sign off on your next deployment. We'll cover the full technical stack, the common failure modes, and where platforms like Purple fit into the picture.

Let's get into it.

[TECHNICAL DEEP-DIVE — approximately 5 minutes]

So, how does a captive portal work? At its most fundamental level, a captive portal is a network access control mechanism that intercepts a guest device's internet traffic and redirects it to an authentication or registration page before granting full network access. Simple concept. Complex implementation.

Let's walk through the full sequence, step by step.

Step one: Association and DHCP. When a guest device connects to your SSID — your guest WiFi network — the access point assigns it an IP address via DHCP, just as you'd expect. At this point, the device has a valid IP address and a default gateway, but it cannot reach the internet. The network is in a pre-authenticated state. The device is associated, but not yet authorised.

Step two: DNS interception. Here's where it gets interesting. When the guest device tries to resolve any domain name — let's say it's trying to reach google.com — the DNS query is intercepted by the captive portal system. The DNS server in the walled garden responds with the IP address of the captive portal server, not the actual IP of google.com. This is sometimes called DNS spoofing, though in this context it's entirely intentional and controlled. Every DNS query, for any domain, returns the same answer: the portal's IP address.

Step three: HTTP redirect. The guest device's browser then attempts to connect to what it thinks is google.com, but it's actually connecting to the captive portal server. The portal server issues an HTTP 302 redirect — a standard redirect response — pointing the browser to the portal's login or registration page. Modern operating systems, including iOS, Android, Windows, and macOS, have built-in captive portal detection mechanisms. They periodically probe known URLs — Apple uses captive.apple.com, Microsoft uses msftconnecttest.com — and when they detect a redirect rather than the expected response, they automatically launch the captive portal browser window. This is the little pop-up you see on your phone when you connect to airport WiFi.

Step four: The walled garden. While the guest is in this pre-authenticated state, the network enforces what's called a walled garden — a set of IP addresses and domains that are accessible without authentication. This typically includes the captive portal server itself, any CDN resources the portal page needs to load, and potentially partner domains. For example, a hotel might whitelist their loyalty programme's domain so returning members can authenticate via their existing account. The walled garden is configured at the access controller or firewall level, using ACLs — access control lists — that permit traffic to whitelisted destinations while blocking everything else.

Step five: Authentication and RADIUS. When the guest submits their credentials — whether that's a social login, an email address, a voucher code, or a terms-of-service acceptance — the captive portal server processes that submission and communicates with a RADIUS server. RADIUS stands for Remote Authentication Dial-In User Service, and it's the industry-standard AAA protocol — Authentication, Authorisation, and Accounting. The portal server sends a RADIUS Access-Request packet containing the user's credentials. The RADIUS server validates those credentials against its user database or an external identity provider, and responds with either an Access-Accept or an Access-Reject. If accepted, the RADIUS server can also return authorisation attributes — things like session timeout, bandwidth limits, and VLAN assignment — as RADIUS attributes in the Access-Accept packet.

Step six: MAC authorisation and session activation. Once the RADIUS server returns an Access-Accept, the captive portal system instructs the access controller to authorise the guest device's MAC address. From this point, the device's traffic is no longer intercepted. The walled garden is lifted for that specific MAC address, and the device has full internet access — subject to any bandwidth or time limits specified in the RADIUS attributes. The RADIUS server also starts an Accounting session, recording the session start time, the device's MAC address, and the assigned IP. This accounting data is critical for compliance, particularly under GDPR and the EU's data retention requirements for public WiFi operators.

Step seven: Session lifecycle and expiry. Sessions don't last forever. The RADIUS Access-Accept typically includes a Session-Timeout attribute, which defines the maximum session duration. When that timer expires, the access controller sends a RADIUS Disconnect-Request, the MAC address is de-authorised, and the device is returned to the pre-authenticated state. The guest will need to re-authenticate. Some deployments use MAC address caching to remember returning devices, allowing them to bypass the portal for a configurable period — typically 24 hours or 30 days — which significantly improves the returning guest experience.

Now, a word on HTTPS and the modern challenge. As HTTPS adoption has become near-universal, the traditional HTTP interception model has become more complex. Browsers now enforce HSTS — HTTP Strict Transport Security — which means they refuse to connect to HTTPS sites over plain HTTP. This is why captive portal detection relies on specific HTTP probe URLs rather than intercepting arbitrary HTTPS traffic. If your portal is intercepting HTTPS traffic and presenting a self-signed certificate, you will generate browser security warnings — which is a terrible user experience and a potential compliance issue. The correct approach is to ensure your portal operates on a properly signed domain with a valid TLS certificate, and that your captive portal detection relies on the OS-native probe mechanism rather than HTTPS interception.

[IMPLEMENTATION RECOMMENDATIONS AND PITFALLS — approximately 2 minutes]

Right, let's talk about what actually goes wrong in production deployments, and how to avoid it.

The most common failure mode is walled garden misconfiguration. If your portal page loads external resources — JavaScript libraries, fonts, images from a CDN — and those CDN domains aren't in your walled garden, the portal page will fail to render correctly for unauthenticated users. Always audit every external resource your portal page loads and ensure those domains are whitelisted. This is particularly important if you're using a third-party portal platform like Purple, where the portal page may be served from a cloud CDN.

The second common issue is iOS Captive Network Assistant conflicts. Apple's CNA — the pop-up browser that iOS uses for captive portal authentication — has significant limitations. It doesn't support all JavaScript features, it doesn't persist cookies in the same way as Safari, and it has strict timeout behaviour. If your portal relies on complex JavaScript flows or OAuth redirects, you may find that iOS users have a degraded experience. The solution is to design your portal with CNA limitations in mind, or to implement a redirect to the device's native browser after the initial detection.

Third: RADIUS timeout and failover. In high-density environments — a stadium with 50,000 concurrent sessions, for example — your RADIUS infrastructure needs to be sized accordingly. A RADIUS server that's overwhelmed will cause authentication timeouts, which manifest to the end user as a portal that appears to hang. Implement RADIUS redundancy with primary and secondary servers, and configure appropriate retry and timeout values on your access controllers.

Fourth: GDPR and data retention compliance. Under GDPR, if you're collecting personal data at the portal — email addresses, social login data — you need a lawful basis, a privacy notice, and a data retention policy. The ICO in the UK and equivalent authorities across the EU take WiFi data collection seriously. Platforms like Purple handle this at the platform level, providing built-in consent management, data subject access request tooling, and configurable retention policies. But you need to ensure your portal configuration actually enforces those policies — don't assume it's handled automatically without verifying.

[RAPID-FIRE Q&A — approximately 1 minute]

Let me run through some questions I get asked regularly.

"Can a captive portal work with WPA3?" Yes. WPA3 handles the wireless encryption layer independently of the captive portal authentication layer. You can run a captive portal on a WPA3-protected SSID. The portal handles network access control; WPA3 handles over-the-air encryption.

"Do captive portals work on 5G devices?" Yes, with caveats. Devices that support 5G Passpoint or OpenRoaming may bypass the captive portal entirely if they have a valid Passpoint credential. This is by design — Passpoint is intended to provide seamless authentication. If you want to enforce portal authentication for all devices, ensure your SSID is not advertising Passpoint support unless you intend it.

"What's the difference between a captive portal and 802.1X?" 802.1X is a port-based network access control standard that authenticates devices before they're granted any network access at the Layer 2 level. Captive portals operate at Layer 3 and above — the device gets an IP address first, then is redirected. 802.1X is typically used for corporate networks with managed devices; captive portals are used for guest networks with unmanaged devices.

[SUMMARY AND NEXT STEPS — approximately 1 minute]

To summarise: a captive portal works through a coordinated sequence of DNS interception, HTTP redirection, walled garden enforcement, RADIUS authentication, and MAC-based session management. Each component needs to be correctly configured for the system to work reliably at scale.

For IT teams evaluating or deploying guest WiFi, the key decisions are: cloud-hosted versus on-premises portal infrastructure, RADIUS architecture and redundancy, walled garden configuration management, and compliance tooling for GDPR and data retention.

Purple's guest WiFi platform handles all of these layers — from the captive portal server and RADIUS integration through to analytics, marketing automation, and compliance management — across more than 80,000 venues globally. If you're planning a deployment or evaluating your current setup, the Purple team can provide a technical architecture review.

Links to the full written guide, architecture diagrams, and implementation checklists are in the show notes. Thanks for listening.

Conclusiones clave

✓Captive portals operate at Layer 3, intercepting DNS and HTTP traffic to redirect unauthenticated users to a login page.
✓The 'Walled Garden' is a critical pre-authentication whitelist; misconfiguring it breaks portal rendering and third-party logins.
✓Never attempt to intercept HTTPS traffic; rely on OS-native Captive Network Assistant (CNA) probes.
✓RADIUS provides the backbone for Authentication, Authorisation (bandwidth limits, session timeouts), and Accounting (compliance logs).
✓Cloud-hosted portal and RADIUS infrastructure provides superior scalability and centralised management compared to on-premises servers.
✓MAC address caching enables seamless roaming for returning guests by bypassing the portal via MAB (MAC Authentication Bypass).
✓Modern platforms like Purple integrate captive portal functionality with OpenRoaming/Passpoint for secure, cellular-like connectivity.

Resumen Ejecutivo

Para gerentes de TI y arquitectos de red que implementan WiFi para Invitados público o empresarial, el captive portal es la frontera crítica entre un dispositivo no autenticado y su infraestructura de red. Esta guía ofrece un análisis técnico detallado sobre cómo funciona un captive portal —eliminando la capa de marketing para examinar los mecanismos subyacentes de intercepción de DNS, redirección HTTP, configuración de jardines vallados (walled garden) y autenticación RADIUS.

Ya sea que esté diseñando una implementación de alta densidad para un estadio, una red distribuida para Comercio Minorista , o una solución conforme para Atención Médica , comprender el ciclo de vida de la sesión y las dependencias arquitectónicas es esencial. Un portal mal configurado conduce a experiencias de usuario degradadas, advertencias de seguridad del navegador y posibles fallas de cumplimiento. Esta guía de referencia describe la arquitectura técnica, las mejores prácticas de implementación y los modos de falla comunes para garantizar que su implementación sea segura, escalable y cumpla con los estándares modernos como WPA3 y Passpoint.

Análisis Técnico Detallado

En esencia, un captive portal es un mecanismo de control de acceso a la red de Capa 3. Intercepta el tráfico de un dispositivo asociado pero no autenticado, redirigiendo al usuario a una interfaz de autenticación antes de concederle acceso completo a la red.

El proceso se basa en una secuencia coordinada de servicios de red:

1. Asociación y Asignación de IP Cuando un dispositivo invitado se conecta al SSID, el punto de acceso inalámbrico o el controlador puentea la conexión a una VLAN específica. El servidor DHCP local asigna una dirección IP, máscara de subred y puerta de enlace predeterminada. En esta etapa, el dispositivo está conectado en la Capa 2 pero se encuentra en un estado de "pre-autenticación" en la Capa 3. Todo el tráfico saliente está sujeto a estrictas listas de control de acceso (ACL) aplicadas por el servidor de acceso a la red (NAS), típicamente el controlador de LAN inalámbrica (WLC) o el firewall perimetral.

2. Intercepción de DNS (DNS Spoofing) Para activar el captive portal, la red debe interceptar las solicitudes web iniciales del usuario. Cuando el dispositivo intenta resolver un nombre de dominio (por ejemplo, www.example.com), la consulta DNS es interceptada por el NAS o un servidor DNS dedicado dentro del jardín vallado (walled garden). En lugar de devolver la dirección IP pública real para el dominio solicitado, el servidor DNS devuelve la dirección IP del servidor del captive portal.

3. Redirección HTTP Cuando el navegador del cliente intenta una conexión HTTP a la dirección IP falsificada, el servidor del captive portal responde con una redirección HTTP 302 (Found) o HTTP 303 (See Other). Esto instruye al navegador a navegar a la URL real de la página de inicio de sesión del captive portal.

Los sistemas operativos modernos emplean mecanismos de Asistente de Red Cautiva (CNA) para detectar esto automáticamente. Al conectarse a una red, el sistema operativo envía una solicitud HTTP GET a una URL de sondeo conocida (por ejemplo, captive.apple.com para iOS/macOS, msftconnecttest.com para Windows). Si el sistema operativo recibe una redirección HTTP en lugar del 200 OK esperado o una carga útil HTML específica, asume que hay un captive portal presente y lanza automáticamente un pseudo-navegador para mostrar la página del portal.

4. El Jardín Vallado (Walled Garden) Durante el estado de pre-autenticación, el usuario debe poder cargar la página del portal y sus activos asociados. El "jardín vallado" (walled garden) es una lista blanca de direcciones IP, subredes y dominios configurados en el NAS. El tráfico destinado a estas ubicaciones en la lista blanca está permitido, mientras que todo el demás tráfico se descarta. Un jardín vallado (walled garden) correctamente configurado debe incluir:

La dirección IP del servidor del captive portal.
Redes de Entrega de Contenido (CDN) que alojan activos CSS, JavaScript e imágenes para la página del portal.
Proveedores de identidad (por ejemplo, Facebook, Google) si el inicio de sesión social está habilitado.
Pasarelas de pago si el portal requiere acceso de pago.

5. Autenticación y RADIUS Una vez que el usuario envía sus credenciales o acepta los términos de servicio, el servidor del captive portal actúa como cliente RADIUS. Construye un paquete RADIUS Access-Request que contiene los detalles del usuario y lo envía al servidor RADIUS (Remote Authentication Dial-In User Service).

El servidor RADIUS valida la solicitud contra su base de datos. Si tiene éxito, devuelve un paquete Access-Accept. Fundamentalmente, este paquete puede incluir Atributos Específicos del Proveedor (VSA) que definen los parámetros de la sesión, como Session-Timeout (duración máxima de la conexión), Idle-Timeout y límites de velocidad de ancho de banda.

6. Activación y Contabilidad de Sesiones Al recibir el Access-Accept, el servidor del captive portal instruye al NAS para que autorice la dirección MAC del cliente. Las restricciones del jardín vallado (walled garden) se levantan y al dispositivo se le concede acceso completo a internet. Simultáneamente, el NAS envía un paquete RADIUS Accounting-Request (Start) al servidor RADIUS para comenzar a rastrear la sesión con fines de análisis y cumplimiento.

Guía de Implementación

La implementación de un captive portal robusto requiere una coordinación cuidadosa entre la infraestructura inalámbrica y la plataforma del portal. Para los gerentes de TI que evalúan Proveedores de WiFi para Invitados: Qué buscar al elegir una Plataforma WiFi , consideren los siguientes enfoques arquitectónicos:

Alojado en la Nube vs. Local (On-Premises) Las implementaciones empresariales modernas hefavorecen en gran medida los portales alojados en la nube y la infraestructura RADIUS. Plataformas como Purple ofrecen una arquitectura RADIUS distribuida globalmente, eliminando la necesidad de servidores AAA locales. El WLC local simplemente dirige sus solicitudes de autenticación y contabilidad RADIUS a los puntos finales del proveedor de la nube. Este enfoque se escala sin problemas y centraliza la gestión en múltiples sitios, lo cual es particularmente beneficioso para entornos distribuidos de Hospitalidad y comercio minorista.

Configuración de Walled Garden La causa más frecuente de problemas de renderizado del portal es un walled garden incompleto. Las páginas web modernas dependen en gran medida de recursos externos. Si una fuente o una biblioteca JavaScript alojada en una CDN de terceros está bloqueada, el portal puede quedarse colgado o renderizarse incorrectamente dentro del navegador CNA del sistema operativo.

Recomendación: Utilice entradas de walled garden basadas en dominio donde su WLC lo admita (por ejemplo, *.purple.ai). Si su hardware solo admite walled gardens basados en IP, debe mantener una lista actualizada de las subredes IP del proveedor del portal.

Manejo de la Interceptación HTTPS Históricamente, los Captive Portals interceptaban todo el tráfico del puerto 80 (HTTP) y del puerto 443 (HTTPS). Sin embargo, con la adopción generalizada de HTTP Strict Transport Security (HSTS), la interceptación del tráfico HTTPS hace que los navegadores muestren advertencias de seguridad graves, ya que el certificado SSL del portal no coincidirá con el dominio solicitado.

Recomendación: Nunca intercepte el tráfico HTTPS. Confíe completamente en los mecanismos CNA nativos del sistema operativo (que sondean a través de HTTP) o instruya explícitamente a los usuarios a navegar a una URL HTTP conocida (por ejemplo, http://neverssl.com) para activar la redirección.

Mejores Prácticas

1. Almacenamiento en Caché de Direcciones MAC para Roaming sin Interrupciones Para mejorar la experiencia del usuario, implemente el almacenamiento en caché de direcciones MAC. Cuando un usuario se autentica con éxito, el servidor RADIUS registra su dirección MAC. Si el usuario se desconecta y regresa dentro de un período especificado (por ejemplo, 30 días), el WLC envía una solicitud de omisión de autenticación MAC (MAB) al servidor RADIUS. El servidor reconoce la dirección MAC y devuelve un Access-Accept inmediatamente, otorgando acceso a la red sin requerir que el usuario interactúe con el portal nuevamente.

2. Diseño para el Captive Network Assistant (CNA) Los pseudo-navegadores lanzados por iOS y Android para mostrar Captive Portals tienen una funcionalidad limitada en comparación con los navegadores completos. A menudo no admiten ventanas emergentes, tienen estrictas restricciones de tiempo de espera y manejan las cookies de manera diferente.

Recomendación: Mantenga la interfaz de usuario del portal ligera. Evite frameworks JavaScript complejos o activos multimedia pesados que puedan causar que el CNA agote el tiempo de espera. Si requiere interacciones complejas (como descargas de aplicaciones), use el portal para autorizar el dispositivo primero y luego redirija al usuario a su navegador nativo.

3. Integración con OpenRoaming y Passpoint Si bien los Captive Portals siguen siendo esenciales para la captura de datos y la aceptación de términos, la industria avanza hacia estándares de autenticación sin interrupciones como Passpoint (Hotspot 2.0). Purple actúa como un proveedor de identidad gratuito para servicios como OpenRoaming bajo la licencia Connect. Los dispositivos configurados con un perfil OpenRoaming pueden autenticarse de forma segura en la Capa 2 (a través de 802.1X/EAP) sin interactuar con un Captive Portal, proporcionando una experiencia de roaming similar a la celular. Su infraestructura debe admitir ambos mecanismos simultáneamente.

Solución de Problemas y Mitigación de Riesgos

Síntoma: La página del portal no aparece automáticamente en dispositivos móviles.

Causa Raíz: El walled garden está mal configurado, permitiendo que las solicitudes de sondeo CNA del sistema operativo lleguen directamente a internet. Si el sistema operativo recibe un 200 OK de captive.apple.com, asume que tiene acceso completo a internet y no lanzará el portal.
Mitigación: Asegúrese de que los dominios de sondeo CNA no estén en la lista blanca del walled garden. Deben ser interceptados y redirigidos al servidor del portal.

Síntoma: Los usuarios ven una advertencia de certificado SSL/TLS.

Causa Raíz: El WLC está intentando interceptar el tráfico HTTPS y presenta el certificado SSL del portal en lugar del certificado del dominio solicitado por el usuario.
Mitigación: Deshabilite la redirección HTTPS en el WLC.

Síntoma: El inicio de sesión social (por ejemplo, Facebook, Google) no se carga o no se autentica.

Causa Raíz: Faltan los dominios requeridos para el flujo OAuth del proveedor de identidad en el walled garden.
Mitigación: Audite la configuración del walled garden en comparación con la documentación actual del proveedor de identidad. Tenga en cuenta que estos rangos de IP y dominios cambian con frecuencia.

ROI e Impacto Empresarial

Un Captive Portal no es simplemente una necesidad técnica; es un activo estratégico. Al reemplazar las claves precompartidas (PSK) genéricas con un portal gestionado, las organizaciones logran:

Captura de Datos y Automatización de Marketing: La integración del portal con una plataforma de WiFi Analytics permite a los establecimientos recopilar datos verificados de primera mano (correos electrónicos, datos demográficos) a cambio de acceso. Estos datos alimentan los sistemas CRM y las campañas de marketing dirigidas.
Cumplimiento y Mitigación de Riesgos: Los operadores de WiFi público están sujetos a leyes de retención de datos y responsabilidad por infracción de derechos de autor. Un Captive Portal con contabilidad RADIUS proporciona un registro auditable de qué dispositivo (dirección MAC) tuvo qué dirección IP en un momento específico, protegiendo al establecimiento de responsabilidades.
Gestión de Ancho de Banda: Al aplicar atributos RADIUS como Filter-Id o WISPr-Bandwidth-Max-Down, TI puede evitar que usuarios individuales monopolicen la conexión WAN, asegurando una experiencia consistente para todos los invitados y protegiendo el tráfico crítico de back-office. Esto es particularmente relevante al evaluar Los Beneficios Clave de SD WAN para Empresas Modernas .

Términos clave y definiciones

Walled Garden

An access control list (ACL) applied to unauthenticated users, permitting traffic only to specific IP addresses or domains required to load the captive portal.

Crucial for allowing access to CDNs, payment gateways, and social login APIs before the user is fully authorised.

RADIUS (Remote Authentication Dial-In User Service)

The industry-standard networking protocol that provides centralised Authentication, Authorisation, and Accounting (AAA) management.

The captive portal server uses RADIUS to tell the wireless controller whether a user is allowed on the network and what restrictions apply.

Captive Network Assistant (CNA)

A pseudo-browser built into modern operating systems (iOS, Android, Windows) designed specifically to detect and display captive portals.

CNAs have limited functionality compared to full browsers; portals must be designed to accommodate their constraints.

MAC Authentication Bypass (MAB)

A process where the network uses a device's MAC address as its identity to authenticate against a RADIUS server without user interaction.

Used to implement 'MAC Caching', allowing returning guests to connect seamlessly without seeing the portal again.

DNS Interception / Spoofing

The process where the network intercepts a user's DNS query and returns the IP address of the captive portal server instead of the actual destination.

This is the primary mechanism used to force the user's web traffic to the portal page.

HTTP 302 Redirect

An HTTP response status code indicating that the requested resource has been temporarily moved to a different URI.

Used by the portal server to redirect the intercepted HTTP request to the actual login page URL.

Vendor-Specific Attributes (VSAs)

Custom parameters included in a RADIUS message that allow vendors to support features not defined in the base RADIUS standard.

Used to pass specific policies, like bandwidth limits or VLAN assignments, from the portal platform to the specific brand of wireless controller.

Passpoint (Hotspot 2.0)

A standard that enables mobile devices to automatically discover and authenticate to Wi-Fi networks securely without user interaction.

The modern alternative to captive portals for seamless roaming; platforms like Purple act as identity providers for Passpoint networks.

Casos de éxito

A 500-room hotel is upgrading its guest WiFi. They want returning guests to connect seamlessly without seeing the portal again for 30 days, but they require a daily bandwidth limit of 10Mbps per device.

Configure the WLC to use external RADIUS authentication pointing to the cloud provider. 2. Enable MAC Address Caching on the RADIUS server with a 30-day retention policy. 3. Configure the portal profile to assign a RADIUS Vendor-Specific Attribute (VSA) for bandwidth limiting (e.g., WISPr-Bandwidth-Max-Down = 10000000) in the Access-Accept packet.

Notas de implementación: This approach balances user experience with network protection. By using MAC caching, the initial captive portal interaction is preserved for terms acceptance, while subsequent connections rely on seamless MAB (MAC Authentication Bypass) at Layer 2. The bandwidth VSA ensures the WLC enforces the limit dynamically.

A retail chain deploys a new captive portal featuring a Facebook login option. Users report that when they click the Facebook button, the page hangs indefinitely inside the captive portal pop-up.

The WLC's walled garden configuration is incomplete. The network administrator must add Facebook's required OAuth domains (e.g., graph.facebook.com, connect.facebook.net) and IP subnets to the pre-authentication ACL.

Notas de implementación: This is the most common failure mode in modern portal deployments. Because the device is in a pre-authenticated state, any traffic to domains not explicitly whitelisted in the walled garden is dropped. The CNA browser simply times out waiting for the Facebook API response.

Análisis de escenarios

Q1. You are deploying a captive portal at a stadium. The portal requires users to watch a 15-second video hosted on YouTube before gaining access. Users are reporting that the portal loads, but the video frame is blank. What is the most likely architectural cause?

💡 Sugerencia:Consider the state of the device before it is fully authenticated and what resources it needs to access.

Mostrar enfoque recomendado

The walled garden configuration is incomplete. The network administrator must add YouTube's video delivery domains and CDNs to the walled garden ACL. Without this, the unauthenticated device cannot reach the YouTube servers to stream the video content, even though the main portal page (hosted elsewhere) loads successfully.

Q2. A client insists on intercepting all HTTPS traffic to force users to the captive portal, arguing that users rarely type 'http://' anymore. Why is this a bad idea, and what is the standard alternative?

💡 Sugerencia:Think about how modern browsers handle SSL/TLS certificates and HSTS.

Mostrar enfoque recomendado

Intercepting HTTPS traffic requires the wireless controller to present a certificate for the requested domain (e.g., google.com). Since the controller does not possess Google's private key, the browser will flag the connection as insecure and display a severe certificate warning, breaking the user experience. The standard alternative is to rely on the Operating System's built-in Captive Network Assistant (CNA), which automatically probes known HTTP URLs in the background specifically to trigger the redirect gracefully.

Q3. A venue wants to limit guest WiFi sessions to 2 hours. How is this enforced technically within the captive portal architecture?

💡 Sugerencia:Which component is responsible for Authorisation and passing policy parameters to the network hardware?

Mostrar enfoque recomendado

This is enforced via RADIUS. When the captive portal server successfully authenticates the user, it receives an Access-Accept packet from the RADIUS server. This packet includes a 'Session-Timeout' attribute set to 7200 seconds (2 hours). The wireless controller reads this attribute, applies the timer to the user's session, and automatically disconnects the device when the timer expires.