How to Deploy Cloudi-Fi Captive Portal into an Existing Zscaler Tenant - Option Location Only

This documentation provides step-by-step instructions for setting up the Cloudi-Fi Captive portal with an existing Zscaler tenant using the Location Only integration.

Overview

The Cloudi-Fi Captive portal is configured into an existing Zscaler tenant, using existing GRE/IPsec tunnels. The guest network(s) should be routed into these tunnels.

With the Location Only option, the Zscaler configuration is partially synchronized with Cloudi-Fi instead of a Full setup. However, the Zscaler configuration can be completed in just a few steps outlined below.

Key Information to Share with Cloudi-Fi Support Team : 

Prerequisites

Authentication check

Before proceeding, verify the following settings to avoid conflicts with Cloudi-Fi integration, especially related to Multiple Authentication Domains:

• Go to Zscaler Experience Center > Administration > Internet & SaaS Authentication > Internet Authentication Settings > Default Settings
  • User Repository Type: Must be set to Hosted DB
  • User Authentication Type: Must be set to SAML

Go to Zscaler Experience Center > Administration > Internet & SaaS Authentication > Internet Authentication Settings > Identify Providers

• The login attribute returned by your existing Identity Provider (IdP) must be unique and in the form of an email address (e.g., user@my-company.com)
• If the login attribute only returns a username without a domain, Zscaler cannot perform authentications on multiple domains. For example, the ADFS Attribute sAMAccountName only returns a username without a domain

Add a Cloudi-Fi Guest domain to Zscaler account

To add a Cloudi-Fi Guest domain to your Zscaler account, you are required to submit a ticket and furnish the following details:

• The domain name provided by the Cloudi-Fi team (e.g., your-company.cloudi-fi.net)
• Make sure to include the following information in the ticket:
  • Your Zscaler Company ID
  • The authentication domain to be added
  • Your company name

To submit a ticket, connect to the Zscaler Experience Center. In the top-right corner of the window, click the question mark icon. Go to Tools & Resources > Support Portal

Type “Add domain to my tenant” - You will then be prompted to create a case after submitting the sentence.

Check subscriptions

Provide your Zscaler account information

From Administration > Organization, copy your Company ID, Name and Domains, and send them to the Cloudi-Fi team.

1. Zscaler configuration

1.1. Create Cloudi-Fi Identity Provider

Access the Zscaler Experience Center: Go to Administration > Internet & SaaS Authentication > Internet Authentication Settings > Identity Providers.

Add IdP.

Select Add another SAML IdP for a subset of users or locations

General info

• Set name : Cloudi-Fi
• Status : Enabled 
• Saml portal URL : https://login.cloudi-fi.net/start/ch/<PASTE Cloudi-Fi public key>/sp/sp<ZSCALER_CLOUD_NAME>.net where ZSCALER_CLOUD_NAME is in zscloud, zscaler, zscalertwo, zscalerthree etc 
  • For instance

https://login.cloudi-fi.net/start/ch/123456***354667/sp/spzscaler.net

• Login Name Attribute : token
• Entity ID : ZSCALER_CLOUD_NAME (e.g zscaler.net)
• Org-Specific Entity ID : Disabled
• IdP SAML Certificate : Upload the Cloudi-Fi certificate(Available here)
• Vendor : Others

Criteria

• Location: Set it to "None"
• Authentication domains: select your-company.cloudi-fi.net

Provisioning Options

• Enable SAML Auto-Provisioning
• User Display Name Attribute : token
• Group Name Attribute : profile
• Department Name Attribute : profile 

Share the IdP ID with the Cloudi-Fi team.

1.2. Creating Cloudi-Fi Custom URL Categories

To create custom URL categories in Cloudi-Fi, follow these steps :

Go to your Zscaler Experience Center and navigate to Internet Access > Resources > URL Categories > Add URL Category.

Create the following three custom categories:

Category 1 : Cloudi-Fi Portal URL

This category contains all URLs to be whitelisted to display our captive portal correctly :

.cloudi-fi.net
.cloudi-fi.com
guest-api-v1.cloudi-fi.net
login.cloudi-fi.net
login-cn.cloudi-fi.net
www.cloudi-fi.com

Category 2 : Cloudi-Fi Connectivity Check URL

This category contains all the URLs used by guests' devices to detect the presence of a captive portal.

Add the following custom URLs and custom keywords :

Custom URLs :

captive.apple.com
clients3.google.com/generate_204
connectivity-check.ubuntu.com
connectivitycheck.gstatic.com/generate_204
detectportal.firefox.com
network-test.debian.org
www.apple.com/library/test/success.html
www.google.com/blank.html
www.msftconnecttest.com
www.msftncsi.com

Custom Keywords :

/generate_204
/gen_204

Category 3 : Cloudi-fi Apple Check URL

This category contains all the URLs used by guests’ devices to detect the presence of a captive portal (only for Apple devices).
Below are the Custom URL and Custom Key Words to be added :

Custom URLs :

captive.apple.com
www.apple.com/library/test/success.html

1.3. Create an Authentication Bypass

To avoid visitors being redirected to your Authentication IdP, set up a bypass for the previously created URL Categories (Cloudi-Fi Connectivity Check URL, Cloudi-fi Portal).

Go to Zscaler Experience Center > Internet Access > Setting > Advanced Settings > Policy for Unauthenticated Traffic

In the Authentication Exemptions section, add the three custom categories previously created.

Note: If this option was originally disabled in your account, you will need to enable it and add an additional URL policy rule when creating Cloudi-Fi policy rules in the next section (see Rule 7 (optional) - Allow Unauthenticated Traffic).

1.4. Dynamic group for Cloudi-Fi location(s)

1.5. URL filtering policies for guests

The following URL Filtering policies must be configured in your Zscaler tenant to ensure proper integration with the Cloudi-Fi Captive Portal. These rules manage guest redirection to the captive portal, allow Internet access after successful authentication, and enforce browsing restrictions based on the defined security policies.

Important: The order of these rules is critical to ensure the expected behavior. They must be configured in the exact sequence described below and placed above your existing corporate URL Filtering policies to prevent conflicts and ensure proper guest authentication and Internet access.

Configure the following set of rules to achieve the following objectives :

• Redirect guests to the captive portal
• Allow authenticated users to browse the Internet
• Prevent access to forbidden categories

To set up the Cloudi-Fi Captive portal with an existing Zscaler tenant using the Location Only integration :

Go to your Zscaler Admin interface

Navigate to Policy > Access Control > URL and Cloud App Control

Create the following rules :

Rule 1 : apple captive portal URL

URL Filtering Rule

• Rule Name : for instance Apple Captive Portal 
• Rule status : enabled

Criteria

• URL categories : Cloudi-fi Apple Check URL
• Department : Unauthenticated Transactions
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always
• Location Group : CLOUDIFI
• Web Traffic : Block
• Allow override : OFF
• Redirect URL :

https://login.cloudi-fi.net/start/ch/************/sp/spzscaler.net?source=transient

Change "************" to match your Cloudi-fi public key visible in your Cloudi-fi Admin interface under "Settings > Company Account".

Change "zscaler.net" to match your Zscaler Entity ID (zscaler.net or zscloud.net or zscalerthree.net, etc).

⚠️ "?source=transient" is needed for iPhone and iPad to switch from the Captive Network Assistant (CNA) to Safari

And Save

Rule 2 : Walled Garden

URL Filtering Rule

• Rule Name : for instance, Walled Garden
• Rule status : enabled

Criteria

• URL categories : Cloudi-fi Apple Check URL, Cloudi-fi Portal
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE 
• Time : Always
• Location Group : CLOUDIFI

Action

• Web Traffic : Allow

And Save

Rule 3 : Cloudi-fi redirection

URL Filtering Rule

• Rule Name : for instance, Cloudi-fi Redirection
• Rule status : enabled

Criteria

• Department : Unauthenticated Transactions, Wallguard(*)
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always
• Location Group : CLOUDIFI

Action

• Web Traffic : Block
• Allow override : OFF
• Redirect URL :

https://login.cloudi-fi.net/start/ch/************/sp/spzscaler.net

Change "************" to match your Cloudi-fi public key visible in your Cloudi-fi Admin interface under "Settings > Company Account".

Change "zscaler.net" to match your Zscaler Entity ID (zscaler.net or zscloud.net or zscalerthree.net, etc).

And Save

(*) the Wallguard Department will be available after your first test of authentications. It cannot be created manually, so you will have to update this rule after your first tests.

Rule 4 : Denied Categories

URL Filtering Rule

• Rule Name : for instance, Denied Categories
• Rule status : enabled

Criteria

• URL Categories : add the categories you want to block for your Guests. For instance: Adult Sex Education, Adult Theme, Nudity, etc.
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always
• Location Group : CLOUDIFI

Action

• Web Traffic : Block
• Allow override : OFF
• Redirect URL : 

https://login.cloudi-fi.net/eun.php

And Save

Rule 5 : Department Allow

URL Filtering Rule

• Rule Name : for instance, Department Allow
• Rule status : enabled

Criteria

• Department : Guest, etc. (*)
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always
• Location Group : CLOUDIFI

Action

• Web Traffic : Allow
• Allow override : OFF

(*) The department here will be the Guest profiles you will create in Cloudi-fi > Users > Profiles. These Departments will be available after your first test of authentications. It cannot be created manually, so you will have to update this rule after your first tests.

Rule 6 : Block (default)

URL Filtering Rule

• Rule Name : for instance, Block
• Rule status : enabled

Criteria

• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always
• Location Group : CLOUDIFI

Action

• Web Traffic : Block
• Allow override : OFF
• Redirect URL : 

https://login.cloudi-fi.net/eun.php

And Save

Rule 7 (optional) : Allow Unauthenticated Traffic

If the option Enable Policy for Unauthenticated Traffic was initially disabled in Advanced Settings (see Step 1.3: Create an Authentication Bypass ), add the following rule at the end of Cloudi-Fi rules:

URL Filtering Rule

• Rule Name : for instance, Allow Unauthenticated Traffic 
• Rule status : enabled

Criteria

• Department : Unauthenticated Transactions
• Request Methods : CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
• Time : Always

Action

Web Traffic : Allow

1.6. Create the guest firewall policy rules

It is recommended to configure these rules at the beginning of your Firewall Policy.

Go to your Zscaler Experience Center > Policy > Firewall control and and create the following rules :

Rule 1 : Allow Web Guest locations

Firewall Filtering Rule

• Rule Name : for instance, Allow Web Guest locations
• Rule status : enabled

Who, Where, When

• Criteria > Location Group : CLOUDIFI
• Action > Network traffic : Allow

Services

• Criteria > Network Services : DNS, HTTP, HTTP Proxy, HTTPS
• Action > Network traffic : Allow

And Save

Rule 2 : Deny all Guest

Firewall Filtering Rule

• Rule Name : for instance, Deny All Guests
• Rule status : enabled

Who, Where, When

• Criteria > Location Group : CLOUDIFI
• Action > Network traffic : Block

And Save

1.7. Create your guest location/sub-location

You have the flexibility to create either a location (dedicated VPN tunnel for Guest traffic) or sub-locations (reuse an existing location and define the Guest private IP range).

Go to your Zscaler Experience Center and navigate to Infrastructure > Location Management > Locations

For a new location : Create a new location

For a sub-location : Select the sub-location menu and click on “Add”

Configure the settings for your guest location :

• Name : Make sure the name matches the condition of your Cloudi-Fi dynamic group
• Enforce Authentication : ON
• Enable IP Surrogate : ON
• Enable IP Surrogate for known Browsers : ON
• Enforce Firewall Control : ON
• Idle Time to Disassociation : Set this value to match the Cloudi-Fi lifetime session. Refer to your Cloudi-Fi Admin interface under Portals > Template > Session Lifetime for the correct value
• Refresh Time for re-validation of Surrogacy : Set this value to match the Cloudi-Fi lifetime session. Refer to your Cloudi-Fi Admin interface under Portals > Template > Session Lifetime for the correct value

2. Synchronization between Cloudi-fi and Zscaler

To ensure seamless integration between your Cloudi-fi and Zscaler tenants, follow these steps.

2.1. Create the API Role

Go to Zscaler Experience Center > Administration > Role Management > Internet & SaaS 

Add API Role 

• Name : Cloudi-Fi API
• Reporting Access : Full

Policy & Components

• Security : Full
• Access Control : Full
• Data Protection : None
• Decryption : Full
• URL Categories : Full
• Shared Policy Components : Full

Cloud configuration & Integration

• Integrations : None
• Cloud Configuration : None
• Business Continuity : None

Traffic forwarding

• Traffic forwarding : Full
• Traffic forwarding Methods : Full
• Traffic forwarding Components : None

Administration controls

• Administration controls : Full
• Backup controls : None

Reporting data

• Reporting data : None

2.2. Create the API Client

Go to Zscaler Experience Center > Administration > API Configuration > OneAPI > API Clients

Add API client

Client

• Name : Cloudi-Fi Integration
• Description 
• Status : enabled 
• Access token validity : 1440 minutes
• Validation type : secret and add
  • Copy and save the secret 
• Expires on 365 days

2.3. Synchronize your Cloudi-fi tenant with your Zscaler tenant

Access your Cloudi-fi Admin interface and navigate to Settings > Integrations > Zscaler. Enable the Zscaler integration

Fill in the following details:

• Zscaler client OAuth URL: Zscaler_vanity-domain (e.g https://cloudi-fi.zslogin.net/) -- Do not forget https:// and the / at the end
• Zscaler client ID: Use the client ID from the previous step “Create the API client”
• Zscaler client secret: Use the secret you copied from the previous step “Create the API client”
• Zscaler cloud: Select the Zscaler Cloud of your environment
• Tenant type: Existing tenant
• Synchronisation Mode : Only Locations

Click on "Connect" to establish the synchronization between Cloudi-fi and Zscaler.

Troubleshooting

Once you have completed the configuration steps, you are now ready to start using the Cloudi-fi captive portal solution. If you encounter any issues or have any questions, please do not hesitate to reach out to our Support team.

Additionally, you can consult the Cloudi-Fi and Zscaler Troubleshooting guide for further assistance.

What’s Next?

For more information about our solutions integrated with Zscaler, including a how-to video and a comprehensive solution brief, please visit our partner page.