Palo Alto Integration Guide

This guide covers the full integration between a Palo Alto firewall and Useroam Cloud: zone and interface configuration, RADIUS authentication, certificates, the Authentication Portal, DNS, log forwarding, and the firewall rules.

Before you start: you need administrator access to the Palo Alto web interface, the external interface IP address the firewall will use to talk to Useroam, and your SSL certificate together with its key file and password.

1 - Adding the firewall to the panel

Device type: select PaloAlto.
5651 Logging: tick the 5651 Logging checkbox.

Adding a Palo Alto device in the Useroam panel

2 - Zone settings

For the interface where Useroam will be enabled, create a new zone under Network > Zone and tick Enable User Identification.

3 - Interface and profile settings

On the interface where Useroam will be enabled, create a new profile from the Advanced section. While doing so, tick the Response Pages checkbox.

4 - RADIUS settings

Apply the settings below under Device > Server Profiles > RADIUS:

Authentication Protocol: PAP
RADIUS Server / FQDN: panel.useroam.com
Secret: the device password you obtained from Settings > Device Settings in panel.useroam.com

5 - Authentication Profile

Define the new profile under Device > Authentication Profile.

Type: RADIUS
Server Profile: select the RADIUS server profile you created.
Retrieve user group from RADIUS: make sure this checkbox is ticked.
Advanced: add the all object to the Allow List.

6 - Certificate configuration

Before the certificates are installed on the device, the relevant root certificates (Root CA or Intermediate) must already be added to the system. This completes the certificate trust chain and prevents SSL/TLS errors on the client devices that connect.

6A - Importing the Root CA

As the first step, import the Root CA or CA certificate.

6B - Uploading the certificate and key file

Next, upload the certificate file to the firewall together with the key file and its password.

6C - Verifying the layered certificate chain

Once the upload is complete, the view should show a layered structure — a certificate chain in which the entries are linked to one another.

7 - Authentication Portal settings

Next, open the Settings section under Device > User Identification > Authentication Portal.

Enable Authentication Portal: tick this option to activate the hotspot.
Idle Timer and Timer: enter the maximum value, 1440 minutes (24 hours), in both fields. This means a user sees the hotspot screen only once a day. We use this value because we want the hotspot screen to appear once every 24 hours; if you prefer shorter sessions, adjust it to suit your needs.
SSL/TLS Service Profile: select the SSL profile you created earlier. Note that on some Palo Alto versions, previously created profiles may not appear in this field. In that case, use the New option to create a new SSL/TLS profile from this screen. If your system does let you select one, you can use the existing profile.

Palo Alto Authentication Portal settings

If you need to create a new profile, follow these steps:

Give the profile a name and select the SSL certificate to be used.
Under Protocol Settings, choose the minimum and maximum SSL/TLS versions you want to support.
When the settings are complete, click OK to save the profile.

Authentication Profile: continue by selecting the Useroam profile you created.
Session Cookie / Timeout: enter 1440 minutes (24 hours) here as well, matching the value set above.
Redirect Host: enter the subdomain here, since the redirect is performed over the certificate.

8 - Uploading the captive portal design (Comfort Page)

In panel.useroam.com, go to Settings > Device Settings and copy the entire code block that starts with <html>. Paste it into a text editor and save it in HTML format under a name such as captive.html. Then upload that document on the firewall via Device > Response Pages > Captive Portal Comfort Page.

9 - DHCP settings

So that DNS queries from the internal network are handled without problems, the DHCP and DNS Proxy configuration must be updated if you do not have a separate DNS server. Go to Network > DHCP > Options.

Primary DNS: enter the firewall's own interface IP address.
Secondary DNS: you can define a global DNS server (for example 8.8.8.8 — Google DNS).

Note: if you already have an internal DNS server, add the record required for the domain redirect to your internal DNS as well (in the Static Entries section) and continue from step 11.

10 - DNS Proxy settings

Next, define a new proxy under Network > DNS Proxy so DNS queries resolve correctly.

Interface: select the interface(s) where Useroam will be active.
Primary / Secondary DNS: enter the global DNS servers.
Static Entries: click Add to create a new record. At this stage it is important that the IP used for the redirect is the gateway IP address of the firewall's Management Interface.

11 - Forwarding logs to Useroam (Log Forwarding)

Go to Objects > Log Forwarding and add a new profile with Add. A separate profile must be created for each of the five log types (auth, data, decryption, traffic, url). For every entry, remember to select the Useroam profile in the Syslog section.

$Palo Alto log forwarding syslog selection$

Creating the firewall rules

Two sets of rules are needed for the Palo Alto integration. When you first create the rules, Palo Alto needs to learn the traffic — so set Service to Any at first and change it to application-default afterwards.

12A - RULE SET 1: Authentication rules

Go to Policies > Authentication and define the three rules below. Useroam must be selected in the Log Forwarding field on every rule.

RULE 1 (Allow DNS): created so DNS queries pass through the authentication stage without problems. All DNS queries towards the WAN are allowed by selecting default-no-captive-portal under Authentication Enforcement.
RULE 2 (Allow Useroam Cloud): this rule provides trouble-free access to Useroam Cloud. In the Destination Address field, select the UseroamCloud (panel.useroam.com) FQDN address object you created.
RULE 3 (Captive redirect): the main rule that redirects HTTP and HTTPS traffic of users who have not yet signed in — or who are joining the network for the first time — to default-web-form, i.e. the captive portal screen.

12B - RULE SET 2: Security rules

Go to Policies > Security. On every rule, Log at Session End must be selected under Log Settings and Useroam must be assigned in Log Forwarding.

RULE 1 (Allow WAN DNS): lets every device run DNS queries over the WAN without being caught by the captive portal. It is required so the device can reach its own global captive-detection domain (for example captive.apple.com), conclude that internet access exists, and then trigger the hotspot screen.
RULE 2 (Allow Useroam access): defined so devices in the captive portal zone can reach panel.useroam.com through the firewall without problems.
RULE 3 (Allow internet access): the final rule that gives your guest network internet access. On this rule, the Source User value in the Source section must be set to known-user.

Additional technical note (disconnecting a signed-in user): to end an active guest session or clear its cache, sign in to the Palo Alto CLI and run the following commands in order.

To list all signed-in active users and their IP addresses:
show user ip-user-mapping all

To drop the relevant IP address from the network, run:
clear user-cache ip <ip-address>
debug user-id reset captive-portal ip-address <ip-address>

Important — integration complete

That's it — your Palo Alto integration and server change are complete. If you run into any technical problems during the process, contact our support team at destek@useroamteknoloji.com.

For the Login with WhatsApp flow to work while the guest is still behind the captive portal (before internet access is granted), the following addresses must be allowed in your firewall or walled-garden configuration. Without these rules the WhatsApp login screen will not open and the automatic login based on delivery confirmation will not work.

Domains to allow (FQDN)

*.wa.me
*.whatsapp.com
*.whatsapp.net
g.whatsapp.net
mmg.whatsapp.net
fbsbx.com
*.useroam.com

IP addresses to allow

157.240.0.0 — Meta / Facebook network block
31.13.0.0 — Meta / Facebook network block
104.247.174.120 — Useroam panel

Note: 157.240.0.0 and 31.13.0.0 are typically /16 network blocks (Meta infrastructure); we recommend defining them as blocks in the firewall (157.240.0.0/16, 31.13.0.0/16). 104.247.174.120 is the Useroam panel IP (/32). Use the domain list if your firewall supports FQDN-based filtering; otherwise use the IP blocks.

Revizyon #1
tugay tarafından 10 Ağustos 2026 22:59:09 oluşturuldu
tugay tarafından 10 Ağustos 2026 22:59:09 güncellendi