How to authenticate users using captive portal for non-http/https traffic

1. We can use authentication policy with MFA (Multi Factor Authentication), and the MFA can be used in conjunction with GP (Global Protect). GP client would present the user with a link which would be the MFA login page.
   
   You can refer to the following links for more info on how to make necessary configuration:

           Configure GlobalProtect to Facilitate Multi-Factor Authentication Notifications

           Duo Multi-Factor Authentication (MFA)

           GlobalProtect: Authentication Policy with MFA

           Configure Multi-Factor Authentication

       2. Another option is to have the end users going manually to the captive portal page and authenticating themselves. After authentication they will be granted
       access based on their user/group name.
     
           This works as below:

• The users should access the captive portal by typing the URL https://1.1.1.1:6082/php/uid.php?vsys=1&rule=0; where:
  1.1.1.1 => IP address of the captive portal is 1.1.1.1
  vsys=1 => The id of the vsys is 1 where the authentication policy is configured
  rule=0 => The id of the rule is 0 which is the first policy (index = 1) under Policies > Authentication using to the web-form authentication method.
   
• They will then try to access necessary resource and the traffic will be allowed or denied per user/group based policies. 

          Notes: 
          - If we don’t assign an SSL/TLS Service Profile, the firewall uses port 6081 and the firewall's default certificate. The firewall uses TLS 1.2 by default. In order
          to use a different TLS version, we need to configure an SSL/TLS Service Profile and select the TLS version we want to use.
          - If we assign an SSL/TLS Service Profile, the firewall uses port 6082. That is the port captive portal uses while sending the first 302 redirect message.