FortiGate External Captive WiFi Portal Setup Guide

Complete Configuration Guide for IT Engineers

1. Overview

This guide provides step-by-step instructions for configuring a FortiGate firewall to work with an external captive portal for guest WiFi authentication. The configuration creates a secure, isolated guest network that routes users through a cloud-based captive portal for authentication before granting internet access.

What This Guide Covers

• Creating a dedicated Guest VLAN with appropriate addressing

• Configuring RADIUS authentication for the captive portal

• Setting up the external captive portal redirect

• Creating exempt destinations for portal functionality

• Configuring the wireless SSID

• Setting up firewall policies for guest traffic

2. Prerequisites

Before You Begin

1. Administrative access to the FortiGate firewall

2. FortiGate with integrated wireless controller or managed FortiAPs

3. Your Site ID from the Captive WiFi portal (found in WiFi Hardware section)

4. RADIUS shared secret (contact support via live chat or support@captivewifi.io)

5. Planned IP addressing scheme for the guest network

Required Server Addresses

You will need the following addresses during configuration:

3. Enable Wireless Open Security

Before configuring the SSID, you must enable the Wireless Open Security feature in FortiOS.

1. Navigate to System > Feature Visibility

2. Scroll down to find Wireless Open Security

3. Toggle the switch to Enabled

4. Click Apply

Note: This feature must be enabled to allow Open security mode on wireless SSIDs, which is required for captive portal authentication.

4. Create the Guest VLAN Interface

The Guest VLAN provides network isolation for guest users and enables the captive portal functionality.

4.1 Create the VLAN Interface

1. Navigate to Network > Interfaces

2. Click Create New > Interface

3. Configure the following settings:

4.2 Configure Administrative Access

Under Administrative Access, enable the following:

• ☑ RADIUS Accounting (Required for captive portal session management)

• ☑ PING (Recommended for troubleshooting)

• ☑ Security Fabric Connection (If using Security Fabric)

Important: RADIUS Accounting must be enabled on the VLAN interface for the captive portal to track user sessions properly.

4.3 Configure DHCP Server

1. Enable DHCP Server

2. Configure the following:

4.4 Configure DNS (Optional)

For content-filtered guest access using Cloudflare Family DNS:

Note: Cloudflare's 1.1.1.3 and 1.0.0.3 provide family-friendly DNS filtering, blocking malware and adult content. This is optional but recommended for guest networks.

4.5 Configure Captive Portal Settings

Under the Network section of the interface:

Important: Replace <YOUR_SITE_ID> with your actual Site ID from the Captive WiFi portal's WiFi Hardware section.

Replace your Redirect URL with the Connected Page link, that can be found on the Splash Design in the Captive WiFi Dashboard

Click OK to save the interface.

5. Configure RADIUS Servers

RADIUS servers handle the authentication between the FortiGate and the captive portal backend.

5.1 Create Primary RADIUS Server

1. Navigate to User & Authentication > RADIUS Servers

2. Click Create New

3. Configure the following:

4. Click Test Connectivity to verify the connection

5. Click OK to save

Note: Contact support via live chat or support@captivewifi.io to obtain your RADIUS shared secret.

6. Create User Group

The user group links authenticated captive portal users to firewall policies.

6.1 Create the Captive WiFi User Group

1. Navigate to User & Authentication > User Groups

2. Click Create New

3. Configure the following:

4. Under Remote Groups, click Add

5. Select your RADIUS server (CaptiveWifi-Primary)

6. Set Groups to Any

7. Click OK to save

7. Create Address Objects

Address objects define the exempt destinations that must be accessible before authentication (for the captive portal to function).

7.1 Create Required Address Objects

Navigate to Policy & Objects > Addresses and create the following:

Portal Server IP

Images Server IP

Digital Ocean Storage

Portal Domain

DNS (for pre-auth resolution)

Note: Alternatively, create specific address objects for your DNS servers (e.g., 1.1.1.3/32 and 1.0.0.3/32) for tighter security.

7.2 Add Exempt Destinations to VLAN Interface

1. Return to Network > Interfaces

2. Edit the Guest_Wifi interface

3. Under Exempt Destinations/Services, add:

   • Captive_Portal_Server

   • Captive_Portal_Domain

   • Captive_Wifi_Digital_Oceans

   • Captive_Wifi_Images

   • DNS_Servers (or your specific DNS address objects)

4. Click OK to save

8. Configure the Wireless SSID

Create the guest WiFi SSID that will be broadcast to users.

8.1 Create the SSID

1. Navigate to WiFi & Switch Controller > SSIDs

2. Click Create New > SSID

3. Configure the following:

Basic Settings

Security Mode Settings

Note: Open security is required because authentication is handled by the external captive portal, not WPA/WPA2.

Additional Settings

Important: Enabling "Block Intra-SSID Traffic" prevents guest users from communicating with each other, which is an important security measure for public WiFi networks.

Click OK to save.

9. Configure Firewall Policies

Firewall policies control traffic flow for guest users.

9.1 Guest to Internet Policy

This policy allows authenticated guest users to access the internet.

1. Navigate to Policy & Objects > Firewall Policy

2. Click Create New

3. Configure the following:

Note: If you have an existing "Any to WAN" policy, the Guest VLAN traffic will automatically be included in NAT'd outbound traffic.

9.2 Block Guest Access to Internal Networks (If Required)

If you have VPN tunnels or internal networks that should not be accessible from the guest network:

1. Create a new firewall policy

2. Configure the following:

Ensure this DENY policy is placed above any ACCEPT policies in the policy list.

Important: Policy order matters in FortiGate. The DENY policy must be positioned before any ACCEPT policies that might allow the same traffic.

10. Testing the Configuration

10.1 Pre-Flight Checks

Before testing with a device, verify:

1. The Guest VLAN interface shows as UP in Network > Interfaces

2. The SSID is broadcasting (check WiFi & Switch Controller > SSIDs)

3. RADIUS server connectivity is successful (test from User & Authentication > RADIUS Servers)

4. Address objects resolve correctly (for FQDN objects, check Policy & Objects > Addresses)

10.2 End-to-End Test

1. Connect a test device to the guest WiFi network

2. Verify the device receives a DHCP address in the correct range

3. Open a web browser and navigate to any HTTP website

4. Confirm you are redirected to the captive portal login page

5. Complete the authentication process

6. Verify internet access is granted after authentication

7. Check FortiView > Sources or Log & Report to confirm user sessions are being tracked

10.3 Common Test Points

11. Troubleshooting

Portal Page Not Loading

• Verify exempt destinations are correctly configured on the VLAN interface

• Check that FQDN address objects are resolving (may take a few minutes after creation)

• Ensure DNS is working for pre-authenticated clients

• Test connectivity to portal IPs: 138.68.152.191 and 5.101.109.44

Users Not Redirected to Portal

• Confirm Security Mode is set to "Captive Portal" on the VLAN interface

• Verify the external portal URL is correct and includes your Site ID

• Check that the SSID is tagged with the correct VLAN ID

• Ensure "Wireless Open Security" feature is enabled

Authentication Failing

• Test RADIUS server connectivity from the FortiGate

• Verify the RADIUS shared secret is correct

• Check that the user group is properly linked to the RADIUS server

• Review logs in Log & Report > Events for RADIUS errors

No Internet After Authentication

• Verify firewall policies allow traffic from Guest_Wifi to WAN

• Check that NAT is enabled on the outbound policy

• Ensure no DENY policies are blocking the traffic

• Verify the user is in the correct user group

Session Not Tracking

• Confirm RADIUS Accounting is enabled on the VLAN interface

• Verify the RADIUS server is receiving accounting packets

• Check the RADIUS server logs for session start/stop events

RADIUS Connection Failing / Port 1812 Blocked

Some FortiGate firewalls have local-in policies or implicit rules that block outbound RADIUS traffic on ports 1812 (authentication) and 1813 (accounting). If RADIUS connectivity tests fail:

Step 1: Check FortiGate Local-In Logs

1. Navigate to Log & Report > Local Traffic

2. Filter for traffic on port 1812 or 1813

3. Look for DENY entries related to RADIUS traffic

Alternatively, use CLI to view local traffic logs:

execute log filter category local-traffic
execute log filter field action block
execute log display

Step 2: Check Implicit Deny Logs

1. Navigate to Log & Report > Forward Traffic

2. Enable logging on implicit deny if not already enabled:

config firewall policy
    edit 0
        set logtraffic all
    next
end

Step 3: Create Local-In Policy for RADIUS (If Required)

If you identify that RADIUS traffic is being blocked by local-in policies, create an explicit allow rule:

config firewall local-in-policy
    edit 0
        set intf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "RADIUS"
        set schedule "always"
        set action accept
    next
end

Note: Replace wan1 with your actual WAN interface name.

Step 4: Verify RADIUS Service Object Exists

Ensure the RADIUS service object includes the correct ports:

1. Navigate to Policy & Objects > Services

2. Search for "RADIUS"

3. Verify it includes:

   • UDP port 1812 (Authentication)

   • UDP port 1813 (Accounting)

If the service doesn't exist, create it:

config firewall service custom
    edit "RADIUS"
        set protocol UDP
        set udp-portrange 1812-1813
    next
end

Step 5: Test RADIUS Connectivity via CLI

Use the built-in diagnostic commands to test RADIUS:

diagnose test authserver radius <server_name> <test_user> <test_password>

For example:

diagnose test authserver radius CaptiveWifi-Primary testuser testpass

This will show detailed connection attempts and any errors.

Step 6: Packet Capture for RADIUS Traffic

If issues persist, capture RADIUS traffic to identify where it's being blocked:

diagnose sniffer packet any "port 1812 or port 1813" 4 0 l

This captures all RADIUS traffic with verbose output. Look for:

• Outgoing requests to radius.captivewifi.io

• Whether responses are being received

• Any connection timeouts

Press Ctrl+C to stop the capture.

Step 7: Check Upstream Firewall/ISP

If the FortiGate is behind another firewall or the ISP blocks non-standard ports:

• Verify ports 1812 and 1813 UDP are permitted outbound

• Some ISPs block these ports; contact your ISP if external blocking is suspected

12. Quick Reference

Key Configuration Summary

Support Contacts

• RADIUS Secret Requests: Live chat or support@captivewifi.io

• Site ID Location: Captive WiFi Portal > WiFi Hardware section

Appendix A: CLI Commands Reference

For engineers who prefer CLI configuration, here are the key commands:

Create VLAN Interface

config system interface
    edit "Guest_Wifi"
        set vdom "root"
        set ip 172.16.1.1 255.255.248.0
        set allowaccess ping radius-acct
        set type vlan
        set vlanid 172
        set interface "fortilink"
        set device-identification enable
        set role lan
        set snmp-index 20
    next
end

Configure DHCP Server

config system dhcp server
    edit 1
        set interface "Guest_Wifi"
        set default-gateway 172.16.1.1
        set netmask 255.255.248.0
        set dns-server1 1.1.1.3
        set dns-server2 1.0.0.3
        config ip-range
            edit 1
                set start-ip 172.16.1.2
                set end-ip 172.16.7.254
            next
        end
    next
end

Configure RADIUS Server

config user radius
    edit "CaptiveWifi-Primary"
        set server "radius.captivewifi.io"
        set secret <YOUR_RADIUS_SECRET>
        set secondary-server "radius2.captivewifi.io"
        set secondary-secret <YOUR_RADIUS_SECRET>
    next
end

Create User Group

config user group
    edit "Captive_Guest_Wifi_UG"
        set member "CaptiveWifi-Primary"
    next
end

Configure Captive Portal on Interface

config system interface
    edit "Guest_Wifi"
        set security-mode captive-portal
        set security-redirect-url "https://getonline.captivewifi.io/guest/<YOUR_SITE_ID>"
        set security-external-web "https://getonline.captivewifi.io/guest/<YOUR_SITE_ID>"
    next
end

Document Version: 1.0
Last Updated: December 2024