FortiGate Captive Portal – Logging Name + Phone + Email for Guest Users

Hello everyone,

I’m currently working on improving our guest WiFi captive portal logging on a FortiGate firewall and I’m trying to determine the best way to capture and later locate guest users if needed.

Current Setup

We are using a FortiGate email collection captive portal for guest wireless access.
I have customized the HTML replacement message so that the portal now asks for:

• Full Name

• Phone Number

• Email Address (existing FortiGate %%USERNAMEID%% field)

The page functions correctly and users must fill in all fields before connecting.

Goal

The main objective is to be able to identify a guest device later if there is a security or abuse issue.

Ideally we would like to log the following information:

• Name

• Phone Number

• Email Address

• Device MAC address

• IP address

• Date/time of connection

Then be able to search FortiGate logs later to locate the user associated with a specific device or activity.

Question

Is there a supported way in FortiGate to log additional captive portal fields (such as name and phone number) so they appear in system logs or traffic logs?

For example, I noticed the “Alternate User” field appears in the log column selection menu. Could this field be used to store additional information collected during captive portal authentication?

Or are the only supported values:

• username

• user

• email collection identifier

Alternative Approach

If FortiGate does not support storing additional captive portal form fields in logs, would the recommended approach be to use:

• External Captive Portal / External Authentication

• A custom portal that collects the information and then returns authentication to FortiGate

Objective

The goal is simply to maintain basic accountability on the guest network so that if we need to investigate a device later we can identify who was using it.

Any recommendations or best practices would be greatly appreciated.

Thanks!