Can the WSS Agent recognize when there is a captive network and allow access?

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Can the WSS Agent (WSSA) recognize when there is a captive portal and allow temporary access to that portal?

How does the WSS Agent ensure that it is using best practices to determine the captive portal state?

Resolution

Captive Network Detection

A captive network portal is a web page accessed with a browser that is displayed to newly connected users to a Wi-Fi network.  

For example, a common use case is a hotel or airport Wi-Fi network (before the user is granted access to that network).

WSS Agent relies on the OS (Windows or macOS) to determine if a captive network is available.

The WSS Agent doesn't perform the captive portal check itself...the OS does.  The agent goes into a "passive" state while on a captive network (even if "Fail Closed" is configured).

WSSA receives the captive network state as part of the network connectivity from the OS.

 

Without the context that the OS provides, there is not a way to reliably determine the difference between a network being captive (when you need to allow traffic through), or a malicious actor targeting your application and service endpoints.

Leveraging the OS API's for determining network captivity ensures that the agent is following the best practices from the OS vendors.

The WSS Agent does not intercept traffic while on a captive network because it cannot establish a tunnel on a captive network.  Only when the OS tells the agent that the interface is no longer in the "captive network detected state" will the WSS Agent bring up the tunnel.