2.3 Given a scenario, select and configure wireless devices and technologies

Guest Networks

📘CompTIA Network+ (N10-009)

What Is a Captive Portal?

A captive portal is a web page that automatically appears when someone connects to a guest Wi-Fi network, but before they are allowed full internet access.
It acts as a controlled access gateway that forces users to complete some form of verification or acknowledgement.

A captive portal is mainly used on:

Guest wireless networks
Public Wi-Fi environments
Enterprise environments where temporary access is provided

CompTIA wants you to understand how captive portals work, why they are used, what security controls they provide, and how they fit into guest network configuration.

Why Captive Portals Are Used

Captive portals are used to control how guest users enter a network without giving them access to the internal company environment.

Key purposes:

1. Authentication

You can require users to log in using:

A username and password
Social login (optional)
A one-time passcode
An access voucher or token

2. Acceptable Use Policy (AUP) Enforcement

Organizations use captive portals to force users to read and agree to:

Terms of use
Security and privacy policies
Restrictions on network behavior

3. Tracking and Logging

Administrators can track:

Who connected
When they connected
Bandwidth usage
Session duration

This is important for compliance and troubleshooting.

4. Bandwidth Control

Captive portals can apply restrictions such as:

Rate limiting
Time-based access control
Data caps

5. Network Isolation

Captive portals are typically placed on guest VLANs, ensuring guests cannot access internal devices or resources.

How Captive Portals Work (Step-by-Step)

A client joins the guest Wi-Fi SSID.
The DHCP server assigns an IP address, gateway, and DNS information.
The client tries to open any webpage.
The router, firewall, or wireless controller intercepts the request.
The captive portal page loads instead of the intended web page.
The user must authenticate, accept terms, or register.
Upon completion, the system adds the user’s IP/MAC to an allowed list.
The user is granted internet access.

Where Captive Portals Are Implemented

Captive portals are usually configured on:

Wireless LAN controllers (WLCs)
Firewalls
Unified Threat Management (UTM) appliances
Cloud-based Wi-Fi management platforms
Routers with guest network features

The captive portal is part of the network access control process.

Key Features of Captive Portals

For the Network+ exam, remember the following features:

✔ Redirection

Users are redirected to a login/verification page automatically.

✔ Authentication Options

Includes local authentication or integration with external services such as:

RADIUS
LDAP
Cloud authentication systems

✔ Session Control

Administrators can define how long a guest stays connected.

✔ Guest Account Creation

Temporary accounts/vouchers can be generated for short-term use.

✔ Splash Page Customization

Organizations can customize:

Branding
Instructions
Legal messages

✔ Network Segmentation

Captive portals operate on isolated guest networks or VLANs.

Security Functions of Captive Portals

Captive portals are not used for deep security like WPA3, but they help maintain controlled guest access.

1. Limits access to internal networks

Users connecting through a captive portal cannot interact with:

Internal servers
Internal subnets
Internal devices

2. Prevents anonymous usage (optional)

By asking for login information or identification.

3. Helps with logging and accountability

Administrators can review usage logs for security or compliance.

4. Minimizes misuse

Policies can block harmful behavior, large downloads, or unwanted traffic.

Technologies Commonly Used with Captive Portals

VLANs

Guest users are placed on a separate VLAN for isolation.

DNS redirection

Requests are intercepted and redirected to the portal page.

Firewall rules

Traffic is blocked until authentication is completed.

RADIUS (optional)

For enterprise authentication or accounting.

SSL certificates

Used so the login page loads securely over HTTPS.

Limitations of Captive Portals (Exam Points)

Captive portals are helpful but not perfect. CompTIA may test their weaknesses:

1. Not a strong security method

They cannot replace encryption such as WPA2 or WPA3.

2. Some devices cannot display the portal

Examples include IoT devices, printers, and some smart equipment.

3. Users may bypass them with VPNs (if not blocked)

Unless the network prevents VPN tunneling.

4. Requires active device interaction

If a device cannot open a web browser, it cannot authenticate.

5. Susceptible to MAC spoofing

If the portal allows access by MAC address, attackers could imitate an approved MAC.

Configuration Considerations for the Exam

When configuring captive portals, remember:

✔ Configure a separate guest SSID

Do NOT use the same SSID as your internal WLAN.

✔ Place guests in a dedicated VLAN

This ensures isolation.

✔ Set up firewall rules

Block all traffic except to the captive portal URL until authentication is completed.

✔ Enable DHCP for guest clients

Captive portals require proper IP settings to function.

✔ Customize the splash page

Include:

Terms of service
Acceptable use policy
Authentication method

✔ Configure session limits

For example:

Time of day restrictions
Idle timeout
Max concurrent sessions

✔ Enable HTTPS for the portal

Protects login credentials during transmission.

Common Captive Portal Deployment Models

1. Local Captive Portal

Runs directly on the wireless router/controller.

2. Cloud-based Captive Portal

Portal is hosted on a vendor’s cloud platform.

3. External Authentication Portal

Requests are forwarded to an external system (RADIUS/LDAP).

Each model still performs the same function: gatekeeping guest Wi-Fi access.

Captive Portal Behavior on Devices

CompTIA may test how clients interact with captive portals:

✔ Captive network detection

Most modern devices detect captive portals automatically by attempting to access a known test URL.

✔ HTTPS redirection issue

Browsers may warn users if an HTTPS site is blocked and redirected, so portals often redirect HTTP first.

✔ MAC-based tracking

Devices may be recognized by MAC address to avoid re-authentication.

What You Must Remember for the Exam

A captive portal is a webpage used to control access to a guest Wi-Fi network.
It provides authentication, terms acceptance, usage tracking, and network isolation.
It usually works through DNS redirection, firewall rules, and VLAN separation.
It does not replace encryption, and it is not a strong security method.
It is used mainly for guest networks, public Wi-Fi access, and temporary access control.
Some devices cannot display captive portals, which is a common limitation.