ZCC disconnects when recognizing a **remote** captive portal

My client uses VPN clients to connect securely to clients networks. They have different clients with different VPN concentrators, and thus different VPN clients.

In most cases, the VPN client connection works fine with the Tunnel 2.0 ZIA setup we are testing.

In one case, a client of theirs uses Checkpoint VPN, and while the VPN tunnel comes up nicely, the quirk is that behind the Checkpoint VPN concentrator there is a captive portal for further authentication of the user before allowing access.

The issue is, ZCC sees the remote captive portal and treats it like a standard local captive portal allowing access to the internet, and thus stops ZCC and disconnects Tunnel 2.0, which makes the VPN tunnel drop. Not exactly conducive to anything good…

This is with Windows 10 running ZCC 3.4.0.101.

Would anyone here have any suggestion on what could be done on ZIA or the ZCC configuration to avoid this issue?

Would avoiding using Tunnel 2.0 for ZIA change altogether be the best practice, by configuring ALL the remote VPN concentrators from being routed to ZIA and rather be split locally before the VPN traffic hits the packet filter driver?

Many thanks for any suggestion you might have!

Bye, Luca

The customer has been affected by this issue, until they tried to set up a machine as testbed for capturing logs in order to open a case with ZTAC.

Then something weird happened. On the machine which was to be used to capture data, where ZCC was already installed and working fine, after installing the VPN client, the captive portal issue DID NOT show up!

This puzzled my customer, who went back to the machine where the issue was first encountered, and where it was still present. He deinstalled the Checkpoint VPN client, reinstalled it, and voilĂ , the issue has been solved!

Looks like the order in which one installs ZCC and the Checkpoint VPN client has some importance, and installing the VPN client again, after ZCC had been already installed, did the trick.

I will not be opening up a case with ZTAC at this time, yet wanted to leave some trace that the order in which software tools which install network device drivers like ZCC does might benefit from being reinstalled after installing ZCC.

Hope this helps.

Bye, Luca

1 Like

thanks for sharing the solution!

1 Like