Skip to main content
maro584
maro584
New Member
March 30, 2018
Question

Access to internet after clicking some message box

  • March 30, 2018
  • 1 reply
  • 12573 views

Because it is my first post on this forum I would like to say hello to everyone :)

 

I am wondering if there is any feature on Fortigate which should look like this:

 

User is opening a webbrowser and type some url after this some dialog window apper or any informational website where the user have to click that he accept some terms of using an internet. After that he is redirecting to the choosed website.

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    March 30, 2018

    Welcome to the community.

     

    Although I haven't used it other than wifi users, this is what you're looking for. It's called "Captive Portal".

    http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-authentication-54/CaptivePortals.htm?Highlight=captive%20portals

     

    maro584
    maro584Author
    New Member
    April 3, 2018

    Unfortunatelly this option We can not use for whole ip class and also not for only HTTPS traffic.

    kurtli_FTNT
    Staff
    kurtli_FTNT
    Staff
    April 4, 2018

    Hi there, 

       You can try to use user-auth in firewall policy. After that, right before reaching out, user has to authenticate successfully. For specific websites or services, use multiple firewall policies. You probably need to enable 'service-negate' on the last policy to allow all rest. Below is an example, authentication for HTTPs only. All non-https traffic will pass thru.

     

     

    Thanks.

     

     

    ===

    config firewall policy edit 2 set uuid 8996b36c-2ba1-51e7-9b38-776f1bcac321 set srcintf "any" set dstintf "any" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "myhttps" set groups "kgp" set users "kurt" set nat enable next edit 1 set uuid ca4b18b4-2a19-51e7-6f66-be5f38e11d54 set srcintf "any" set dstintf "any" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "myhttps" set service-negate enable set nat enable next end

    ===

    Terms & ConditionsAccessibility statement