Cloudi-Fi has developed a feature called "transient mode" that acts as an intermediate state for iOS devices. This mode is available only in Zscaler integration deployments and is specifically designed for iOS device users, enabling more robust session management and authentication flow.
This article explores transient mode, the necessity of using Safari for cookie persistence, and how these combined features create a more consistent, reliable connectivity experience for Zscaler iOS users.
Introduction
When you connect to a Wi-Fi network with a captive portal, iOS detects if internet access is restricted.
When an iOS device joins a Wi-Fi network with a captive portal, it detects that Internet access is restricted and automatically opens the portal in the Captive Network Assistant (CNA), a simplified browser window. The CNA does not keep cookies: everything written during the session is deleted when the CNA closes.
In Zscaler ZIA, cookie authentication is used to streamline user access and improve security by storing an authentication token (cookie) on a user’s device after they successfully authenticate.
To resolve persistence of Cookies with iOS, Cloudi-Fi introduced an intermediate authentication state called "Transient".
What Is Transient Mode?
Transient mode is an intermediate status introduced by Cloudi-Fi for Zscaler, which exists between pre-authentication and post-authentication states. This unique state is only available on iOS devices within Zscaler’s deployment framework.
In transient mode, devices are not fully authenticated but retain an "in-between" connectivity status. This allows the device to operate as if it has network access while essential pre-auth steps are processed in the background.
In transient mode, Zscaler essentially allows the device to operate as though it has connectivity even though it has not completed the full authentication process.
The login attribute returned by Cloudi-Fi Identity Provider (IdP) for a Transient user must be in the following form
transient**@yourcompany.cloudi-fi.netThe login attribute returned by Cloudi-Fi Identity Provider (IdP) for a fully authenticated user must be in the following form
user**@yourcompany.cloudi-fi.net
Authentication workflow
With "Transient" feature enabled
Step 1: Connection to the Wi-Fi Network (Guest SSID):
The user opens the Wi-Fi settings on their iOS device and selects the guest Wi-Fi network, "Guest SSID." Once connected to the guest SSID, the iOS device is assigned an IP address by the DHCP server in the network.
Step 2: Captive Portal Detection by iOS Device
iOS devices have a built-in mechanism to detect captive portals by attempting to access a known Apple URL, such as http://captive.apple.com/generate_204. If this request is redirected (instead of getting a "No Content" HTTP 204 response), iOS detects that it is behind a captive portal and displays a captive portal login screen.
user in Zscaler = noauth-protocol$@zscaler_ID.zscaler_cloud.netStep 3: Redirection to the Transient Page in Apple mini-browser
The iOS device automatically opens a mini-browser (a simplified Safari view) that redirects to the transient page URL provided by the network.
This page might have a URL structure such as
- ************ : your Cloudi-fi public key visible in your Cloudi-fi Admin interface under Settings > Company Account.
- "zscaler.net": your Zscaler Entity ID (zscaler.net or zscloud.net or zscalerthree.net, etc).
https://login.cloudi-fi.net/start/ch/************/sp/spzscaler.net?source=transientuser in Zscaler = transient***@yourcompany.cloudi-fi.net
Step 4: Redirection to the Captive Portal Page in Safari
After clicking the "Continue" button, the user is redirected to the captive portal assigned to your location (see Admin UI > Locations > Portals column)
For instance
user in Zscaler = transient***@yourcompany.cloudi-fi.netThen the user complete his authentication and can browse the internet.
Without "Transient" feature enabled
Step 1: Connection to the Wi-Fi Network (Guest SSID):
The user opens the Wi-Fi settings on their iOS device and selects the guest Wi-Fi network, "Guest SSID." Once connected to the guest SSID, the iOS device is assigned an IP address by the DHCP server on the network.
Step 2: Captive Portal Detection by iOS Device
iOS devices have a built-in mechanism to detect captive portals by attempting to access a known Apple URL, such as http://captive.apple.com/generate_204. If this request is redirected (instead of getting a "No Content" HTTP 204 response), iOS detects that it is behind a captive portal and displays a captive portal login screen.
user in Zscaler = noauth-protocol$@zscaler_ID.zscaler_cloud.netStep 3: Redirection to the Captive Portal Page in Apple mini-browser
After clicking the "Continue" button, the user is redirected to the captive portal assigned to your location (see Admin UI > Locations > Portals column)
For instance
user in Zscaler = noauth-protocol$@zscaler_ID.zscaler_cloud.netThen the user completes his authentication and can browse the internet.
How to enable "Transient" feature
Here are the steps to follow to enable the transient feature
Step 1: Enable "Transient" page in your captive portal
Open a ticket to Cloudi-Fi Support (see How to contact your Cloudi-Fi support ?) to enable the "Transient" Page in your captive portal
Step 2: Create a Zscaler URL policy for Transient page redirection (if it was not created yet)
See How to Deploy Cloudi-Fi Captive Portal into an Existing Zscaler Tenant - Option Location Only
Go to your Zscaler Experience Center and navigate to Internet Access > Policy > URL Filtering. Then create the following rules: Rule 1: Apple Captive Portal URL
URL Filtering Rule
- Rule Name: for instance Apple Captive Portal
- Rule status: enabled
Criteria
- URL categories: Cloudi-fi Apple Check URL
- Department: Unauthenticated Transactions
- Request Methods: CONNECT, DELETE, GET, HEAD, OPTIONS, OTHER, POST, PUT, TRACE
- Time: Always
- Location Group: CLOUDIFI
- Web Traffic: Block
- Allow override: OFF
- Redirect URL :
https://login.cloudi-fi.net/start/ch/************/sp/spzscaler.net?source=transient- ************ : your Cloudi-fi public key visible in your Cloudi-fi Admin interface under Settings > Company Account.
- "zscaler.net" : your Zscaler Entity ID (zscaler.net or zscloud.net or zscalerthree.net, etc).
Step 3: Update the Zscaler URL policy
See How to Deploy Cloudi-Fi Captive Portal into an Existing Zscaler Tenant - Option Location Only
Go to your Zscaler Experience Center and navigate to Internet Access > Policy > URL Filtering.
Wallguard is the department Cloudi-Fi assigns to iOS guests in the transient state.
Update Rule_3 (Rule 3: Cloudi-Fi redirection) to add the Wallguard Department. The Wallguard Department will be available after your first test of authentication. It cannot be created manually, so you will have to update this rule after your first tests.
Additional options for improved security and user experience
Some additional option(s) can be enabled (on the back-end side), such as automatic deletion of Transient users in Zscaler.
If the guest user closes the iOS CNS(without clicking the "Continue" button), they will remain stuck in a transient state (transient**@yourcompany.cloudi-fi.net) and will be unable to authenticate. To resolve this issue, the guest user has two options:
- Option 1: Open Safari, go to http://ip.zscaler.com/, and log out. The guest user can then restart the full connection process (see the "Transient" feature documentation for details).
- Option 2: Open Safari and navigate to an HTTP page (for example, http://3wi.fi/). This will trigger the captive portal to display in Safari, allowing the user to authenticate.
To prevent this issue from occurring, you can request that Cloudi-Fi Support (see How to contact your Cloudi-Fi support ?) activate automatic deletion of transient users in Zscaler.
Conclusion
Without the Transient feature, the Zscaler authentication cookie is written in the iOS CNA and lost when the CNA closes. With Transient enabled, the CNA only shows an intermediate page, and authentication happens in Safari (or any other browser), where the cookie persists. iOS guests stay recognised by Zscaler for the whole session. Zscaler ensures that iPhone users experience a smooth and secure authentication process.
For organizations relying on Zscaler’s cloud security solutions, transient mode is a valuable feature that supports a secure, consistent, and user-friendly environment, reflecting Zscaler’s commitment to balancing security and user experience in the modern digital landscape.