Configuring External Captive Portal

The External Captive Portal feature redirects unauthenticated users to a custom, externally hosted login page instead of the built-in SonicOS web login page. This enables organizations such as service providers, hospitality networks, and managed service deployments to deliver a fully branded authentication experience.

When an unauthenticated user attempts to browse the web, the firewall intercepts the request and redirects the browser to your configured external captive portal URL. The portal page collects the user's credentials and submits them to the SonicOS API for authentication. Upon successful login, the user is forwarded to their originally requested destination or a configured landing page.

This feature is supported in SonicOS 8.2.2 and higher versions.

To configure External Captive Portal

1. Enable HTTP Basic Access authentication:

   1. Navigate to Device | Settings > Administration > SonicOS API.
   2. Turn on the RFC-2617 HTTP Basic Access authentication toggle. This toggle enables basic username-password authentication using the HTTP standard method.
   3. Click Accept.

2. Configure Access Rules:

   1. Navigate to Policy | Rules and Policies > Access Rules.

   2. Add the following rules:

      Rule	From → To	Service	Destination Address	Users
      Allow DNS	LAN → WAN	DNS	Any	All
      Allow Captive Portal	LAN → WAN	HTTPS	Captive portal address with the zone set to WAN.	All

   DNS and captive portal rules with users set to "All" are required to allow unauthenticated users to access the DNS server and the login page.

   3. Set the default LAN to WAN rule to allow your desired user group, such as Everyone or Trusted Users. For more information about adding rules, refer to SonicOS 8 Rules and Policies for Classic Mode.

3. Configure User Web Login Settings:

   1. Navigate to Device | Users > Settings > Web Login.

   2. Under the User Web Login Settings section, turn on the On redirecting unauthenticated users, redirect to an external login page toggle. This settings enables HTTP and HTTPS traffic from unauthenticated users to be redirected to a specified URL instead of the SonicWall login page, allowing users to authenticate through an external authentication system.

      

   3. In the URL field, enter the full URL of your externally hosted captive portal page (for example: https://portal.example.com/login).

   4. Turn on the Append Query Parameters to External Redirect URL toggle. When enabled, this setting instructs the firewall to automatically append identifying information as query parameters to the external login page URL when redirecting unauthenticated users. This allows the external captive portal to determine which firewall to authenticate against and where to redirect the user after successful login.

      The following parameters are appended to the redirect URL:

      Parameter	Purpose
      mgmtUrl	The firewall's management URL (IP or domain name) — portal page uses this to send the login request back to the correct firewall. This can be either an IP address or a fully qualified domain name (FQDN), based on the existing configuration.
      cid	Connection Identifier — identifies the user's original web request so the firewall can redirect them to their intended destination after login.
      userIP	The user's IP address (informational, for logging).
      UFI	Unique Firewall Identifier (informational).

   5. In the Post authentication user redirect URL field, enter the destination URL to which all users are redirected after successful login through the external captive portal. This URL serves as the post-authentication landing page.

      • Set this value when you want all users to land on a specific page after login, such as a terms of service page, a welcome portal, or a company homepage.
      • Leave this field blank to provide a seamless experience in which users are redirected to the website they originally attempted to access.

   6. Click Accept.