Captive Portal failed when if a machine used by multiple users

tim toa,

the problem is not with MAC but how the authenticaiton works. In OSI layering, User does not exists, so Firewall and other devices build a table where an IP is associated with a User. So, once the XG knows the IP and request authentication in some way, the table is filled up using the information IP and User. What you can do is to force the user to logout using the logout button or use the inactivity timeout under Authentication > Services. Take note that XG does not allow less than 3 minutes which are too many if you consider how much time is required between logoff/login on MAC, Windows, etc...

Regards

To be honest, the solutions seems not feasible

1) use the inactivity timeout 

>>>> will never happen, because switch user only takes seconds, traffic will continue passing

2) force the user to logout

>>>> then captive portal will be meaningless because user will easily hijack other session if they know this vulnerability

I know. I cannot say the opposite. I use CAA on MAC.

I know. I cannot say the opposite. I use CAA on MAC.

I thought using CAA is the best way to address this problem but when I tried that out today it wasn't working as expected. 

The CAA just simply submit the username and password to firewall. The second person can still hijack the session without authentication. 

Does anyone know how to solve this problem.

Is there a way to have a logon script with the CAA so when the user logs in it will automaticlly update the credentials for the CAA session?