Skip to main content
smxko
smxko
Visitor III
Nov 28, 2024 2:55 PM UTC
Solved

Extend disclaimer only timeout

Hi,

we have a VLAN on a 40F that is being provided through some 3rd party access points. We enabled the disclaimer portal for that VLAN for guest access. We don't want them to type in an E-Mail or provide guest accounts.

The disclaimer portal works well but we need to extend the (idle) timeout to more than 300 seconds.

Where can I do that? None of the settings seem to alter that value.

 

I tried:

config user setting > set auth-timeout X

config wireless-controller timers > set client-idle-timeout X
config system settings > set auth-timeout X

 

In this article using a mail collection portal, it is somehow set to 10 days (864000) by default

Retail environment guest access | FortiGate / FortiOS 7.6.0 | Fortinet Document Library

 

But mine always looks like this:

192.168.3.17
        src_mac: 98:69:8a:XX:XX:XX
        type: disclaimer, id: 14, duration: 368, idled: 210
        expire: 90, allow-idle: 300
        flag(1000): src_idle
 
How can allow-idle be modified or set to a hard timeout?
 
Thanks a lot
Duka
DukaAnswer
Explorer
Dec 11, 2024 8:38 AM UTC

Hi,
this can be solved with the following configuration:

 

Create Dummy User

config user local edit "CaptivePortal" set type password set passwd-time *** set passwd ENC *** next end

 

Create Group with the desired timeout (in this case 14 days of non-use)

config user group edit "CaptivePortalUsers" set authtimeout 20160 set member "CaptivePortal" next end

 

Activate captive portal on the interface

config system interface edit "lan1" set vdom "root" set ip *** set allowaccess ping set type physical set alias "lan" set security-mode captive-portal set security-groups "CaptivePortalUsers" set device-identification enable set role lan set snmp-index 2 next end

 

Customize the HTML page (System -> Replacment Messages -> Login Page) so that the values of the variables USERNAMEID and PASSWORDIT are predefined and hidden.

<input name="%%USERNAMEID%%" id="ft_un" type="hidden" autocorrect="off" autocapitalize="off" value="CaptivePortal"> <input name="%%PASSWORDID%%" id="ft_pd" type="hidden" autocomplete="off" value="Password">

 

Check with

diag firewall auth list

 

****, CaptivePortal

        src_mac: ******

        type: fw, id: 0, duration: 553, idled: 3

        expire: 1209597, allow-idle: 1209600

        packets: in 11556 out 4997, bytes: in 10975870 out 1244385

        user_id: 16777218

        group_id: 2

        group_name: CaptivePortalUsers

 

Best Regrads

Patrick

View in thread

9 replies

sjoshi
Staff
sjoshi
Staff
Nov 28, 2024 6:12 PM UTC
How can allow-idle be modified or set to a hard timeout? >> this can be changed under config user settings
 
Thanks, Salon
    smxko
    smxkoAuthor
    Visitor III
    Nov 29, 2024 8:26 AM UTC

    This is unfortunately limited to 1440 minutes. Is there a way to set it to 10 days as in the link I shared?

    sjoshi
    Staff
    sjoshi
    Staff
    Nov 29, 2024 8:51 AM UTC

    Time out can be increased till 30 days but in this case you need to set the timeout under user group

    Refer:-

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-timeout-setting-on-global-user/ta-p/327005#:~:text=FortiGate.&text=There%20are%20two%20ways%20to,is%20set%20to%205%20minutes.

    Thanks, Salon
      Terms & ConditionsAccessibility statement
      Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
      Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT