Having to register visitors' MAC is unfeasible, you must think about some way to difference between unauthenticated and authenticated.
Could be whatever you like/can: By MAC, by IP, by subnets, by CIDR, etc etc.
The whole idea that you must achieve on your rules is:
1-Create an unauthenticated rule that catch all visitors BUT doesn't affect to your authenticated users.
2-Catch anything, and request authentication.
This way you trap all visitor requests with the first rule, and they don't get any auth request because the rule don't ask for.
With the second rule you catch the rest of the traffic (that is, your authenticated users).
So the thing is that AUTH rule only fires with AUTH users, and UNAUTH rule only fires with UNAUTH.
You do need a second interface for blue. It can be a physical NIC or a VLAN. Endian accepts VLAN's, but you need a managed switch with VLAN support, and it's more complex.
I can recommend some options:
Option 1:Catch MAC address from auth users first.
Rule 1: Catch all AUTH users. Create an AUTH rule with the MAC of your authenticated users
Rule 2: Catch anything. It's an UNAUTH rule for everything else.
Pros: This option is good if you authenticated users are few, and don't change a lot. Not to hard to setup. Doesn't require new hardware
Cons: With a lot of users it becomes hard to manage, and it's hard to link users with MAC Address.
Option 2:Separate users by IP ranges:
If you use DHCP, create fixed DHCP leases for your known users, and move it outside your DHCP range.
Set your DHCP range to a simple CIDR range. Use a CIDR calculator (like
http://www.subnet-calculator.com/cidr.php ) to group users.
For example set your DHCP range from 192.168.0.128 to 192.168.0.254 (change 192.168.0 for your real subnet), that range correspond to the 192.168.0.128/25 CIDR.
Range 192.168.0.1 to 192.168.0.127 translates to 192.168.0.0/25, and it's for AUTH users.
I.e: You have 30 users, and you want to auth them. Create a fixed DHCP lease for each of them, all of them with IP's below 192.168.0.128.
Rule 1: Source IP: 192.168.0.128/25, UNAUTH.
Rule 2: Source IP: 192.168.0.0/25, AUTH
Pros: Don't require new hardware. DHCP fixed leases allow to identify what MAC belongs to what computer/user.
Cons: Hard to manage. Hard to setup. Clients with admin privileges can change their IP and exit for the other rule.
Option 3: (recommended, but you need new hardware)Add a BLUE zone for visitors, you need a new NIC and some changes on your network. The easiest setup is to add a NIC for BLUE, and connect only an Access Point to that NIC. All users connecting to that WiFi will be on BLUE zone.
Configure HTTP Proxy: BLUE zone as transparent, GREEN as non transparent.
Rule 1: Zone BLUE, UNAUTH rule
Rule 2: Zone GREEN, AUTH rule.
Pros: Cleaner and easier to manage. Set up and forget.
Cons: Adds some complexity with NIC's and Access Points.
Author