This guide provides step-by-step instructions to set up the Cloudi-Fi Captive Portal with your existing Zscaler tenant, ensuring full synchronization.
Overview
Cloudi-Fi Captive portal is configured into your Zscaler tenant using existing GRE/IPSEC tunnels. The source guest network(s) should be routed into the tunnels.
With the Full option, the Zscaler configuration is fully synchronized with Cloudi-Fi.
Key Information to Share with Cloudi-fi Support Team
| Attribute | Value | Where? |
| Cloudi-Fi Guest domain | To share | Go to Step 2: Add a Cloudi-Fi Guest domain to Zscaler account |
Prerequisites
1. Authentication check
Before proceeding, verify the following settings to avoid conflicts with Cloudi-Fi integration, especially related to Multiple Authentication Domains:
-
Go to Zscaler Experience Center > Administration > Internet & SaaS Authentication > Internet Authentication Settings > Default Settings
- User Repository Type: Must be set to Hosted DB
- User Authentication Type: Must be set to SAML
-
Go to Zscaler Experience Center > Administration > Internet & SaaS Authentication > Internet Authentication Settings > Identify Providers
- The login attribute returned by your existing Identity Provider (IdP) must be unique and in the form of an email address (e.g., user@my-company.com).
- If the login attribute only returns a username without a domain, Zscaler cannot perform authentications on multiple domains. For example, the ADFS Attribute sAMAccountName only returns a username without a domain.
2. Add a Cloudi-Fi guest domain to Zscaler account
To add a Cloudi-Fi Guest domain to your Zscaler account, you are required to submit a ticket and furnish the following details:
- The domain name provided by the Cloudi-Fi team (e.g., your-company.cloudi-fi.net)
-
Make sure to include the following information in the ticket:
- Your Zscaler Company ID
- The authentication domain to be added
- Your company name
To submit a ticket, connect to the Zscaler Experience Center. In the top-right corner of the window, click the question mark icon. Go to Tools & Resources > Support Portal
Type “Add domain to my tenant” - You will then be prompted to create a case after submitting the sentence.
3. Check subscriptions
Ensure the following features are activated for a Full integration:
-
Z_API:
- Go to your Zscaler Experience Center > Administration > Subscription > Internet & SaaS
- Ensure that the Z_API subscription is activated. If not activated, submit a ticket to Zscaler support.
-
IP_Surrogate:
- Check if "Enable Internal IP Features" is enabled. If not, submit a ticket to Zscaler support.
- Go to Zscaler Experience Center > Infrastructure > Location Resources > Locations > Select one location > Select one of the sublocations > Connection Options > Enable IP Surrogate
-
Source IP-based Load Distribution
- Check with Zscaler Support if the Source IP-based Load Distribution option is enabled.
-
Apply location mapping to Global Auth Bypass traffic
- Check with Zscaler Support if the Apply location mapping to Global Auth Bypass traffic option is enabled.
4. Advanced settings
Enable the "Policy for unauthenticated traffic" option to trigger the captive portal for unauthenticated Guests.
Go to Zscaler Experience Center > Internet Access > Setting > Advanced Settings > Policy for Unauthenticated Traffic
Instructions
Create the API Role
Go to Zscaler Experience Center > Administration > Role Management > Internet & SaaS
Add API Role
- Name : Cloudi-Fi API
- Reporting Access : Full
Policy & Components
- Security : Full
- Access Control : Full
- Data Protection : None
- Decryption : Full
- URL Categories : Full
- Shared Policy Components : Full
Cloud configuration & Integration
- Integrations : None
- Cloud Configuration : None
- Business Continuity : None
Traffic forwarding
- Traffic forwarding : Full
- Traffic forwarding Methods : Full
- Traffic forwarding Components : None
Administration controls
- Administration controls : Full
- Backup controls : None
Reporting data
- Reporting data : None
Create the API Client
Go to Zscaler Experience Center > Administration > API Configuration > OneAPI > API Clients
Add API client
Client
- Name : Cloudi-Fi Integration
- Description
- Status : enabled
- Access token validity : 1440 minutes
-
Validation type : secret and add
- Copy and save the secret
- Expires on 365 days
Synchronize your Cloudi-fi tenant with Zscaler tenant
- Go to your Cloudi-fi Admin interface > Settings > Integrations > Zscaler.
- Enable the Zscaler integration
- Enter the following details:
- Zscaler client OAuth URL: Zscaler_vanity-domain (e.g https://cloudi-fi.zslogin.net/) -- Do not forget https:// and the / at the end
- Zscaler client ID: Use the client ID from the previous step “Create the API client”
- Zscaler client secret: Use the secret you copied from the previous step “Create the API client”
- Zscaler cloud: Select the Zscaler Cloud of your environment
- Tenant type: Existing tenant
- Synchronisation Mode: Full
- Finally, click on the "Connect" button.
For detailed information on all configurations pushed during this synchronization, please navigate to: How to deploy Cloudi-fi Captive portal into an existing Zscaler tenant - option Location Only
Troubleshooting
Once you have completed the configuration steps, you are now ready to start using the Cloudi-fi captive portal solution. If you encounter any issues or have any questions, please do not hesitate to reach out to our Support team.
Additionally, you can consult the Cloudi-Fi and Zscaler Troubleshooting guide for further assistance.
What’s next?
From now on, all of your locations with "CLOUDIFI" in their name will be automatically uploaded to the Cloudi-fi Admin interface under the Locations section.
For more information about our solutions integrated with Zscaler, including a how-to video and a comprehensive solution brief, please visit our partner page.