To troubleshoot captive portal connectivity issues related to DNS Override, follow these steps:
Validate the captive portal configuration on the SSID.
Navigate to: WiFi & Switch Controller -> SSIDs.
Identify the affected SSID and verify that the Captive Portal option is enabled.
Verify the captive portal configuration associated with the SSID and confirm that the affected wireless clients are connected to the expected SSID.
Additionally, verify the interface associated with the SSID: Network -> Interfaces.
Confirm that the SSID interface has the expected IP addressing, DHCP configuration, and DNS settings.
Validate the DNS configuration and DNS Override.
Navigate to: Network -> DNS.
Verify the configured DNS servers. Then navigate to: Network -> Interfaces.
Edit the affected ISP interface and verify Override internal DNS.
For DHCP or PPPoE interfaces, confirm the following CLI parameter:
show system interface <ISP_interface>
Verify:
set dns-server-override enable
If enabled, verify the ISP-provided DNS server and test its reachability and DNS resolution for the captive portal FQDN.
If the ISP-provided DNS server is unreachable or returns incorrect results, it can prevent successful captive portal connectivity.
Disable DNS Override on the affected ISP interface.
If the DNS server received from the ISP is unreachable or is causing incorrect DNS resolution, disable DNS Override on the affected ISP interface.
Navigate to: Network -> Interfaces.
Edit the affected ISP interface and disable:
config system interface
edit "<ISP_interface>"
set dns-server-override disable
next
end
After disabling the option, the FortiGate will use the DNS servers configured under the system DNS settings instead of the DNS servers received from the ISP.
Validate DNS traffic using a packet sniffer.
Capture DNS traffic to identify the DNS server receiving queries during the captive portal connection attempt.
Use the following commands depending on the required scope:
diagnose sniffer packet any 'port 53' 4 0 l
diagnose sniffer packet any 'host <client-IP> and port 53' 4 0 l
diagnose sniffer packet <ISP_interface> 'port 53' 4 0 l
Review the capture and verify:
Destination IP address of the DNS server.
DNS response received for the captive portal FQDN.
DNS requests without a corresponding response.
A capture showing DNS queries toward an unreachable ISP-provided DNS server can confirm that DNS Override is contributing to the captive portal connectivity issue.
Validate captive portal connectivity.
After disabling DNS Override, reconnect the wireless client to the affected SSID and repeat the captive portal connection test.
Validate the following:
The wireless client receives the expected IP configuration.
DNS resolution for the captive portal FQDN is successful.
The captive portal page is displayed correctly.
Authentication can be completed successfully.
Internet connectivity is established after successful authentication.
If DNS resolution and captive portal connectivity operate correctly after disabling DNS Override, the ISP-provided DNS configuration can be considered a contributing factor to the issue.
Refer to the following articles for more information regarding DNS troubleshooting and captive portal configuration:
