Captive portal authentication rules not working

Question

Previously, before I updated our firewall to SFOS 17.5.0 GA, users always had to login via the Authentication Agent or the Captive portal on the browsers before they could access internet. But of late, this is not working. I have seen this on quite a number of devices, once they join our organisation network either through WIFI or LAN, they are automatically connected to the internet without login to the firewall. 
 I would like to know what could have happened? Did the update alter my firewall rules or there could be something am not doing right. One thing for sure, i have not amended my firewall rules in the longest time and they have been working till when I update our firewall to this firmware build(SFOS 17.5.0 GA). Any assistance is highly appreciated.

Michael Dunn · Accepted Answer

Authentication is controlled by the firewall so you must be using "Test Firewall Policy". 
 It will look like

So you see the firewall rule is "aaa" and is id 5. 
 Now go to your firewall rules and look at that rule.

See in this case it is a rule applying to "Any" Service. Which means this rule is a pretty wide open rule allowing almost anything through the firewall. You can see that the green "Web" means that there is the web proxy running on it. Going into it, take a look if "Match known users" is set. 
 Usually the problem is that a rule has been created, enabled, or moved so that the rule you intend to use is not the rule that is actually being used.