New Member

Solved

Captive Portal redirection

Forum|Forum|12 years ago
October 16, 2013
12 replies
105650 views

Hello everybody, I have a question and hope you can help me. I have set up a captive portal and everythings works fine like I planned it. But there is one issue I ran into, that I didn' t plan with. If the traffic which triggers the captive portal is https traffic, then we get a certificate warning. Let me explain this: 1) I join the captive portal based wlan 2) I open a browser and surf to https://www.google.com 3) I get a certificate warning in the webbrowser 4) If I ignore this warning I' am redirected to the captive portal 5) If I authenticate myself with correct credentials I will be redirected to the original website. The thing is, that I want to get rid of the certificate warning. I found this little config switch wich allows me to choose the certificate I want to use: config user setting set auth-cert xxx end I tried it with our official thawte certificate but that didn' t help. So I tried some other certificates (but this will only help our employees and not other guests) but this didn' t work either. And then I found this page: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30760&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38506158&stateId=0 This was nearly the situation that I have. So I tried this setting, because this could be a win win situation (it could solve my problem and could help to increase the security level of my guest wlan). config user setting set auth-secure-http enable end Sadly, I now get redirected to the gateway IP and STILL get a certificate warning (cause there is no matching certificate which includes the gateway ip). So I' am stuck here. Cause I can' t use this setting: config firewall policy edit <my_policy_ID> set auth-redirect-addr " my.fortigate.com" next end This is because we use address based policies and no identity based policies. So I' am searching for another way to get rid of the certificate warning for _all_ users. Is there anyone who might help me?

Best answer by flex10

Here's the solution provided by FortiNet-Support, successfully tested on my FGT 500D with FortiOS 5.4.4:

- set a publicly trusted SSL-certificate under "User & Device" -> "Authentication Settings" which includes the common-name you wish to use (for example: captive.domain.com)

- create a public DNS-entry "captive.domain.com" which points to the internal IP of your captive portal.

- go to the CLI and enter the commands below:

# config firewall auth-portal

# set portal-addr captive.domain.com

# end

Now users will be redirected to https://captive.domain.com:1003 without any ssl-errors

Show previous replies

andrelhj

New Member

Hello, I had a similar problem. I enabled secure authentication (HTTPS) through LDAP, to access a URL, for example: url.domain.com, the browser displays the alert invalid certificate. The problem was solved by buying a certificate for the sub-domain: url.domain.com. You can buy a wildcard certificate (* .domain.com) and can be installed on multiple servers. You will receive an SSL certificate and the intermediate certificate. You have up to seven days to test and return the money in case of failure. The steps were as follows: 1) System> Certificates> Local Certificates, I generate a new certificate. 2) Send the CSR generated certificate to the vendor. 3) It will return an SSL certificate and intermediate certificates. 4) Install the intermediate certificate in System> Certificates> CA Certificates. 5) Install the SSL certificate in System> Certificates> Local Certificates. 6) Use the options "auth-cert" and "auth-redirect-addr" in the firewall policy:

config firewall policy
    edit <policyID>
    set auth-cert CustomCert
    set auth-redirect-addr url.domain.com
end

It worked for my case and I hope it helps somebody else.

I'm using the FortiOS version 5.2.2. URL for reference:

[ul]

https://stuff.purdon.ca/?page_id=171

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30760&sliceId=1&docTypeID[/ul]

I can not tell what implications this type of configuration has security and what are the safe use of recommendations for certificates. Welcome to contribute.

Not knowing it was impossible He Dit It.

Bernard_Pauwels

New Member

Since HSTS this is not only a warning anymore but full blocking of the access. The workaround now is to first surf to a HTTP website, to avoid the HTTPS to be activated, where Chrome would detect that it is not the original certificate.

With Chrome on a Windows PC, just typing "badidea" stops the HSTS from blocking further action. However I could not start this "badidea" on a smartphone.

dbert84

New Member

I think we need a real solution to this, provided by Fortinet

No normal user will know to browse to a http site to bypass this issue without training, they will just come to us and say 'it doesn't work!'

Also its getting harder and hard to find a website that isn't redirected to https anyway, more than 50% of the web is HTTPS now - google is 77% https traffic

nero_kira

New Member

hello everyone i have a client who wants to add a video in the portal captive unsing fortipresence is it possible to do it thanks

ergotherego

New Member

Is there a way to have the captive portal page launch from a loopback interface?

Our situation is that we have a hub-and-spoke network, with regional based hubs and 50+ sites. Tunnels are IPSec from spoke to hub, so the actual IP addresses users get re-directed to varies depending on which site they are coming from, making it virtually impossible to account for all of the various VPN tunnel interface IPs on the hubs.

In my testing on 5.4.7 I cannot get the loopback interfaces to listen/respond on the captive portal services at all.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded