FortiAuthenitcator for Guest Captive Portal in FortiAP/Fortigate in Bridge Mode

Kindly refer the below document for configuring the captive portal in bridge mode

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Captive-portal-for-local-bridge-mode-SSID/ta-p/200155

In addition to the excellent KB shared by my colleague, on FortiAuthenticator (as the device serving the captive portal), you will need to make sure your portal policy matches the incoming request.

-> ensure that the interface IP of the lan interface (which the AP is bridged to) is set as Access Point in the captive portal policy (unless you have a captive portal address set, in which case, use that as AP address in FortiAuthenticator)

-> ensure that you have the correct IP set as RADIUS client (the actual FortiGate interface IP that it will use to communicate with FortiAuthenitcator)

If you run into errors, you can check here: https://<FortiAuthenitcator>/debug/radius
-> the captive portal login will show here (look for requests with 127.0.0.1 to 127.0.0.1 and NAS-Identifier FAC_GUEST)

-> the RADIUS request that should follow captive portal (so FortiGate gets some group information) should also show, as request from FortiGate IP to FortiAuthenticator IP

Thanks folks.

the tunnel mode works perfectly. however, what happens now is for any known client (connected before to the bridge mode SSID), they won't be redirected to the FAC portal again but to the fortigate web authentication. it seems the users ip/mac got cached and known to the Access point. so when i issue the command below on AP:

PU231FTH20003968# fapportal_diag -d authed-sta

authed client list:

Client 04:56:e5:d5:a1:f1, username ryan, session_timeout 36000, remaining time 22117 seconds, authed by 00:0c:e6:fe:34:a0 192.168.3.10 PU231FTH20003968

i still can see the user name bound to the IP/MAC even if the user is disconnected or account is expired on FAC.

thanks

Osama