Authentication for WiFi clients thru Captive Portal

Forum|Forum|11 years ago
July 16, 2014
7 replies
22865 views

Hi, I' m using FGT-600C with firmware v5.2.0,build0589. I have configured a guest group for Captive Portal with default authentication timeout settings. Everything is working fine. What I want to achieve: The client should re-authenticate whenever he/she re-connects to WiFi regardless of authentication timeout values. For example, auth-timeout-type is set to " hard-timeout" and auth-timeout is set to 8 hours. If a client connects and authenticates and disconnects from WiFi after 10 minutes of usage. Later he comes back again after 30 minutes and connects back. He does not need to re-authenticate. I want to change this behaviour to make him authenticate every time he connects. Is it possible to achieve.

nothingel

New Member

Are you sure you want this? Tablets and phones often disconnect quickly from wifi when their screens turn off either by a timer or by pressing the ' off' button. Your users will probably go crazy if asked to re-login via the captive portal every time their device wakes up.

imranrftAuthor

New Member

Is it possible to achieve? How to configure? First, I want to present the idea to my seniors along with its drawbacks. Then we' ll see all the possibilities. Thanks.

Nihas

New Member

You cannot achieve this as like what you expected. you can set an " authtimeout" to " 10 Minutes" or " 20 Minutes" , but every particular interval the user has to re login to the captive portal to get connect back. edit " Guest Users Group" set group-type guest set authtimeout 0 set auth-concurrent-override disable set http-digest-realm ' ' end So, this is not recommended and you cannot implement this on a network where frequent guest user accounts needed. And if your plan is to highly restrict them , then there are lot of other options available like to restrict the services / put webfiltering etc.

Stryker412

New Member

I actually have the opposite problem. I created a group and they need to re-authenticate each time their device goes to sleep. I want them to only authenticate once, and not have it last until their account expires. Generally I have contractors in the building for 6-8 hrs and need them to be online while they' re here. I' m guessing the above commands are for the command line interface. I found the option for reauthenticate which is set to 5. However, I don' t see way to edit that per group. For instance, users on our student or faculty SSID, never have to reauthenticate. Seems the guest group is the only one.

Stryker412

New Member

Can anyone assist me with this?

Bromont_FTNT

Staff

Stryker... Guests authenticate via Captive portal and others via saved psk or radius?

Stryker412

New Member

Yes, guests using captive portal and staff using PSK. Although we' re integrating AD soon so I' m hoping our staff will be able to just use their school username to login to the wifi starting in Sept.

Nihas

New Member

Hi Stryker. By default the authentication timeout is set to 5 Minutes. FGT# show full-configuration user setting config user setting set auth-type http https ftp telnet set auth-cert " self-sign" set auth-ca-cert ' ' set auth-secure-http disable set auth-http-basic disable set auth-multi-group enable set auth-timeout 5 set auth-timeout-type idle-timeout set radius-ses-timeout-act hard-timeout set auth-blackout-time 0 set auth-invalid-max 5 set auth-lockout-threshold 3 set auth-lockout-duration 0 end You can change the authentication timeout for a particular group by doing the below command. FGT#config user group FGT (group) # edit " Guest Users Group" set group-type guest set authtimeout 480 ( You can use 1-480 Minutes ) set auth-concurrent-override disable set http-digest-realm ' ' end Hope this helps!

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded