Stackvora.tech

Captive Portal With FortiAuthenticator

Implementing secure and controlled guest Wi-Fi access often requires a captive portal solution. For Fortinet environments, integrating FortiAP wireless…

Implementing secure and controlled guest Wi-Fi access often requires a captive portal solution. For Fortinet environments, integrating FortiAP wireless infrastructure with a FortiGate and a FortiAuthenticator provides a robust and scalable method for managing guest authentication, whether through self-registration, sponsor approval, or external identity providers. This article details the configuration steps to deploy a captive portal using a FortiAuthenticator, covering SSID setup, FortiGate integration, and FortiAuthenticator portal configuration.

The core concept involves the FortiAP broadcasting an SSID, clients connecting to it, and their initial traffic being redirected by the FortiGate to the FortiAuthenticator. FortiAuthenticator then handles the user interaction, authenticates the user, and signals the FortiGate to apply the appropriate access policy. This approach centralizes user management and allows for advanced features like SMS-based authentication, social logins, or integration with external directories.

FortiGate Configuration for Captive Portal Enforcement

The FortiGate acts as the policy enforcement point and the RADIUS client to the FortiAuthenticator. It needs to be configured with the wireless SSID, a dedicated VLAN for guest traffic, and the appropriate security policy to redirect unauthenticated users.

1. Create Guest VLAN Interface

Isolate guest traffic into its own VLAN to prevent unauthorized access to internal network resources. Assign a dedicated IP range for DHCP services.

config system interface
    edit "guest_vlan"
        set vdom "root"
        set ip 10.10.20.1 255.255.255.0
        set allowaccess ping https http fgfm capwap
        set type vlan
        set vlanid 20
        set interface "internal"  # Or your internal interface connecting to APs
    next
end

config system dhcp server
    edit 1
        set dns-service default
        set default-gateway 10.10.20.1
        set netmask 255.255.255.0
        set interface "guest_vlan"
        set start-ip 10.10.20.100
        set end-ip 10.10.20.200
    next
end

2. Configure RADIUS Server (FortiAuthenticator)

Define the FortiAuthenticator as a RADIUS server for authentication and accounting. The shared secret must match the one configured on the FortiAuthenticator.

config user radius
    edit "FAC_RADIUS"
        set server "192.168.1.10"  # FortiAuthenticator IP address
        set secret "YourSharedSecret"
        set auth-type chap
        set nas-ip 10.10.20.1  # FortiGate's guest VLAN interface IP
        set radius-port 1812
        set acct-port 1813
        set timeout 5
    next
end

3. Create User Group for Captive Portal

This group is used in the firewall policy to identify users who need captive portal authentication.

config user group
    edit "guest_users"
        set member "FAC_RADIUS"
    next
end

4. Configure Wireless SSID (FortiAP Profile)

Create an SSID that uses "Captive Portal" security mode and points to the FortiGate's guest interface. Ensure client isolation is enabled.

config wireless-controller vap
    edit "guest_ssid_vap"
        set ssid "Guest_WiFi"
        set security captive-portal
        set captive-portal-interface "guest_vlan"
        set captive-portal-authentication auth
        set intra-bss-bridge disable  # Client isolation
        set broadcast-ssid enable
        set schedule "always"
    next
end

config wireless-controller ssid
    edit "Guest_WiFi_SSID"
        set vap "guest_ssid_vap"
        set password "StrongPasswordForManagement" # If using WPA2-Enterprise with fallback
    next
end

# Assuming you have an AP profile configured, assign the VAP to it.
config wireless-controller wtp-profile
    edit "default" # Or your custom AP profile
        config vap
            edit "guest_ssid_vap"
                set ssid "Guest_WiFi_SSID"
            next
        end
    next
end

Note: The set security captive-portal configures the FortiAP to signal the FortiGate to handle captive portal redirection. The captive-portal-interface is crucial as it tells the FortiGate which interface's IP address it should use for redirecting clients to the FortiAuthenticator's portal. It should be the same as the guest VLAN interface.

5. Firewall Policies for Guest Access

Two main policies are required:

  • Pre-authentication policy: Allows unauthenticated users to reach the FortiAuthenticator for portal display.
  • Post-authentication policy: Allows authenticated users access to the internet.
# Policy 1: Allow unauthenticated users to reach FortiAuthenticator (pre-auth)
config firewall policy
    edit 0
        set name "Guest_PreAuth_to_FAC"
        set srcintf "guest_vlan"
        set dstintf "internal" # Or the interface where FAC resides
        set srcaddr "all"
        set dstaddr "FAC_IP_Address" # Create an address object for FortiAuthenticator
        set service "HTTPS" "HTTP" "DNS" # Allow DNS for name resolution too
        set action accept
        set schedule "always"
        set logtraffic all
        set nat enable
    next
    edit 0
        set name "Guest_PreAuth_DNS_to_Internet"
        set srcintf "guest_vlan"
        set dstintf "wan1" # Your internet facing interface
        set srcaddr "all"
        set dstaddr "all"
        set service "DNS" # Only allow DNS to resolve portal FQDN
        set action accept
        set schedule "always"
        set logtraffic all
        set nat enable
    next
    # Policy 2: Allow authenticated guests internet access (post-auth)
    edit 0
        set name "Guest_PostAuth_to_Internet"
        set srcintf "guest_vlan"
        set dstintf "wan1" # Your internet facing interface
        set srcaddr "all"
        set dstaddr "all"
        set groups "guest_users" # This is the key for authentication enforcement
        set service "ALL"
        set action accept
        set schedule "always"
        set logtraffic all
        set nat enable
    next
end

Important: Ensure the FortiAuthenticator's IP address is added as a firewall address object (e.g., config firewall address edit "FAC_IP_Address" set subnet 192.168.1.10 255.255.255.255 next end).

FortiAuthenticator Configuration for Captive Portal

FortiAuthenticator handles the user experience, authentication logic, and RADIUS communication back to the FortiGate.

1. Add FortiGate as RADIUS Client

The FortiAuthenticator needs to recognize the FortiGate as a legitimate RADIUS client. The shared secret must match.

Navigate to Authentication > RADIUS Service > RADIUS Clients. Click "Create New".

  • Client Name: FortiGate_Guest_VLAN
  • IP Address: 10.10.20.1 (FortiGate guest_vlan IP)
  • Secret: YourSharedSecret
  • Auth. Methods: PAP, CHAP, MSCHAP2 (for broader compatibility)
  • Description: FortiGate Guest Wi-Fi

2. Configure Captive Portal Policy

This policy defines how users interact with the portal and what authentication methods are available.

Navigate to Authentication > Portals > Policies. Click "Create New".

  • Name: Guest_WiFi_Portal_Policy
  • Portal Type: Self-service portal
  • Client Type: RADIUS (NAS)
  • Authentication Method: Select your desired method(s) such as Local Users, SMS, Social Login, Sponsor Approval. For basic guest access, "Local Users" might be sufficient, allowing self-registration. For SMS, ensure your SMS gateway is configured under System > Messaging > SMS.
  • Guest User Registration: Enable (if self-registration is desired)
  • Approval required: Enable (if sponsor approval is desired, configure sponsors under Authentication > Guest Users > Sponsors)
  • Terms of Service: Enable and define (optional but recommended)
  • Login Success/Failure Pages: Customize as needed.
  • Max Concurrent Logins: 1 (typical for guest users)
  • Session Timeout: e.g., 3600 seconds (1 hour) or 86400 seconds (24 hours).
  • Idle Timeout: e.g., 1800 seconds (30 minutes).

3. Create Captive Portal Design

Customize the look and feel of your portal page.

Navigate to Authentication > Portals > Portal Designs. Click "Create New" or edit the default.

  • Name: Guest_WiFi_Design
  • Content: Use the editor to add your company logo, welcome message, instructions, and terms of service.
  • Layout: Adjust elements like background color, font, etc.

4. Link Portal Policy to Interface/VLAN

This tells FortiAuthenticator which portal policy to apply for traffic coming from the FortiGate's guest VLAN.

Navigate to Authentication > Portals > Portal Services. Click "Create New".

  • Name: Guest_WiFi_Service
  • Interface: Select the FortiAuthenticator interface connected to the FortiGate (e.g., port1).
  • IP Address/Netmask: Enter the FortiGate's guest VLAN IP (10.10.20.1) with a /32 netmask (255.255.255.255).
  • Realm: Default.
  • Portal Policy: Guest_WiFi_Portal_Policy (the one created in step 2).
  • Portal Design: Guest_WiFi_Design (the one created in step 3).

This configuration ensures that when the FortiGate redirects traffic from 10.10.20.1 to the FortiAuthenticator, it uses the specified portal policy and design.

Verification and Testing

  1. Connect a client device to the "Guest_WiFi" SSID.
  2. The client should receive a DHCP address from the FortiGate's guest_vlan (e.g., 10.10.20.x).
  3. Attempt to browse to any HTTP or HTTPS website. The browser should be redirected to the FortiAuthenticator captive portal page.
  4. Complete the authentication process (e.g., self-registration, SMS code, sponsor approval).
  5. Upon successful authentication, the FortiAuthenticator sends an Access-Accept message to the FortiGate, which then moves the client into the authenticated user group ("guest_users") and applies the post-authentication firewall policy, allowing internet access.
  6. Verify internet access and observe logs on both FortiGate (Log & Report > Forward Traffic) and FortiAuthenticator (Monitoring > Authentication Logs).

Common Pitfalls

  • Incorrect Shared Secret: A mismatch between the FortiGate and FortiAuthenticator RADIUS shared secret is a common cause for authentication failures. Double-check this setting.
  • Firewall Policy Order: Ensure the pre-authentication policy (allowing access to FortiAuthenticator) is above the post-authentication policy (allowing general internet access). If the order is wrong, users might get blocked from reaching the portal.
  • DNS Resolution Issues: If clients cannot resolve the FortiAuthenticator's hostname (if used) or general internet domains, the captive portal might not load correctly. Ensure the pre-authentication policy allows DNS traffic and DHCP hands out valid DNS servers.
  • FortiAuthenticator Interface IP: The "IP Address/Netmask" configured in the FortiAuthenticator Portal Service (step 4 above) must match the FortiGate's guest VLAN IP (nas-ip in RADIUS client config and captive-portal-interface in VAP config).
  • Client Isolation: Always enable client isolation (intra-bss-bridge disable) on guest SSIDs to prevent clients from communicating directly with each other, enhancing security.
  • HTTPS Certificate Warnings: If the FortiAuthenticator uses a self-signed certificate for its portal, users will encounter browser warnings. Consider installing a trusted SSL certificate on the FortiAuthenticator for a smoother user experience.
  • RADIUS Protocol Mismatch: Ensure the RADIUS authentication types (e.g., PAP, CHAP, MSCHAP2) configured on the FortiGate RADIUS client match those enabled on the FortiAuthenticator RADIUS client.

Back to the knowledge base · Ask the AI assistant