Use Case
Some devices on a guest network (printers, displays, IoT devices) cannot use a captive portal and must access the Internet without authenticating. With the Zscaler integration, you can exempt them by placing them in a dedicated bypass sub-location.
Note: each bypassed subnet needs its own virtual location. To bypass several subnets, repeat this procedure once per subnet.
Prerequisites
- Access to Cloudi-Fi admin console
- Access to Zscaler Experience Center
- The subnet to bypass, with DHCP reservations on your local DHCP server so the devices always receive addresses in that subnet
1. Log into the Cloudi-Fi Admin Console
Log into the Cloudi-Fi admin console and navigate to the Locations section.
2. Create bypass virtual location
When we add a location for Bypass traffic, a secondary location will automatically be provisioned to allow for all other authenticated traffic.
We will be creating a virtual location with the original location set as the parent location, the subnet to the bypass, and the country.
When you are done creating the bypass virtual location you will have:
- Original Location
- Virtual Location for Bypass
- Virtual Location titled other
Synchronization between Cloudi-Fi and Zscaler can take a few minutes.
3. Open Location Management
Log into Zscaler Experience Center and navigate to Infrastructure > Location Management > Locations
4. Find Location
Search for your main location and then click on the number under the sub-location column.
5. Edit "Bypass" Sub-location
Click on the Bypass sub-location.
6. Remove Authentication Requirement
Navigate to the “Connection Options” tab and disable "Enforce Authentication".
7. Edit "Other" sub-location
Click on the "Other" sub-location.
8. Edit name of sub-location
Rename the "Other" sub-location so it starts with CLOUDIFI (for example, CLOUDIFI-<location>-other). This places it in the CLOUDIFI dynamic group, so it receives the guest portal and policy rules.
9. Create Bypass Dynamic Location Group
Click the "Location Groups" tab at the top of the location management list, then click "Add Dynamic Group"
10. Enter in Dynamic Group Information
Name this location group "Bypass" and set a condition that matches any location with BYPASS in the name.
Note: The bypass sub-location must not match the CLOUDIFI group condition (its name must not start with CLOUDIFI). Otherwise, it also receives the guest rules, including the Deny All Guests firewall rule, which blocks all its non-web traffic
11. Create URL Policy for Bypass Locations
Navigate to Internet Access > Policy > URL Filtering and click "Add Rule".
12. Configure URL Policy
Name this Rule "Bypass Captive Portal" and find the section for "Location Groups" and add the newly created "Bypass" Group. Keep in mind this rule needs to be above all other redirect rules so these IP addresses in the bypass range are not prompted by the portal.
- Rule name: Bypass Captive Portal
- Rule order: above all Cloudi-Fi rules (above Apple Captive Portal), so devices in the bypass range are never redirected to the portal
- Location Groups: Bypass
- Request methods: all
- Action - Web Traffic: Allow
Save.
13. Activate
After hitting save, click on the Activate button on the top right panel.
What’s Next?
Devices in the bypass subnet now reach the Internet without the captive portal using the Zscaler Integration. For location provisioning or synchronization issues, contact Cloudi-Fi Support.