Technical Tip: Captive portal not redirecting to Entra ID or Google Cloud for Sign-in

FortiNAC captive portal can provide users with the option to register through an external Identity provider such as Azure Entra ID.

In some cases, users might be facing issues where redirection to the Entra ID login service is failing or the login page does not render, and a blank page is presented.

Figure 1. Guest registration option is failing redirection to Entra ID for sign-in .

When such errors are presented, it means that the endpoint is sending DNS queries toward specific domains where the Identity Provider hosts specific services required for the sign-in experience. FortiNAC will intercept these queries and break the continuation of the sign-in process.

FortiNAC keeps a list of Allowed Domains, where it stores the domains for which it will allow DNS query forwarding to the external DNS servers. Any domain not listed will have FortiNAC intercept and redirect connections to its Captive portal.

Solution:

To resolve such problems, it is required to identify the queried domains in isolation and add them to the 'Allowed Domains' list in System -> Settings -> Control.

Identify the domains that are queried by an isolated host in FortiNAC CLI:

execute enter-shell

logs

grep X.X.X.X -A1 named.log | grep PassThru | cut -d' ' -f10 |sort | uniq -c | sort -rg

 or

grep X.X.X.X -A1 named.log | grep PassThru | cut -d' ' -f11 |sort | uniq -c | sort -rg <-----Replace X.X.X.X with the IP that the host gets in Isolation.

A list of queried domains in isolation will be provided. Add any additional domains that are related to authentication or related to the specific IDP.