Cato Networks Knowledge Base

Using Captive Portal Detection with Cato Clients

This article explains how to authenticate to a Captive Portal for Clients with and without Always On enabled.


Captive Portal is a name to identify a network that requires an additional log-in to connect to the Internet. For example, a guest network at a hotel, or an airport. First the user opens the browser to authenticate to the Captive Portal and connect to the Internet, and then uses the Client to connect to the Cato Cloud.

However, for Clients with Always On enabled, you need to enable a setting in the Client before you can connect to the Internet.

Using a Captive Portal with Always On

When Always On is enabled for the entire account or a specific SDP user, you can enable the Client to let the SDP user authenticate to the Captive Portal.

In the Settings menu for the Client, enable Captive Portal Detection.


This is the an overview of the process to authenticate to a Captive Portal when Always On is enabled:

  1. The user can’t connect to the Captive Portal because there’s no Internet connection for the device.

  2. The Client automatically identifies that this network uses a Captive Portal that requires authentication.

  3. Always On is temporarily disabled for the Client.

  4. From a browser, the user can now authenticate to the Captive Portal.

  5. After the Internet connection is established, the Client automatically connects to the Cato Cloud, and Always On is enabled again.

  6. The user is connected to the network for your account with Cato's encrypted tunnel.

Supported Clients for Captive Portal

The following Client OS support Captive Portal Detection:

  • Windows

    • The Captive Portal setting is disabled by default for the Windows Client

  • macOS

    • The Captive Portal setting is enabled by default for the macOS Client (possible that the macOS will enable the user to authenticate to the Captive Portal)

  • iOS

    • The Captive Portal setting is disabled by default for the iOS Client

  • Android

    • The Captive Portal setting is disabled by default for the Android Client

Was this article helpful?

0 out of 0 found this helpful



  • Comment author

    Is this article current? For version 5.5.115 on Windows we see our clients have the Captive Portal Detection enabled by default. We do not (yet) use Always On.

  • Comment author
    Yaakov Simon

    Updated article with description of authenticating with the Cato Client to a Captive Portal

  • Comment author
    French John Discaya

    Hi  Cato Team

    Need your advice on this.

    Issue: client said previously they can access to download the report inside cato portal, but now they do not. 



    Client status 

    Client request below.

    Can you have CATO provide us what access a CATO Management Application admin has to the overall site.  Too be truthfull I am not real happy with the thought I will need to submit a request everytime I want to pull data – not a very efficent use of my or ViewQwest time.



Please sign in to leave a comment.