Skip to main content
A
Anju
Visitor III
July 6, 2026
Question

FortiWLC 4200 WLC 500D External Captive Portal with Aruba ClearPass - RADIUS authentication succeeds but controller shows Authentication Failed

  • July 6, 2026
  • 3 replies
  • 75 views

Hi everyone,

I'm trying to integrate FortiWLC 8.6-5 build-8 (FortiWLC-500D) with Aruba ClearPass Guest (ClearPass Policy Manager 6.12.7.308288 on C3010 platform) as an external captive portal.

Current setup

The captive portal profile is configured as:

Authentication Type: radius
Captive Portal External Server Type: Fortinet-Presence
Success Redirect URL: https://<default redirect url>

Login flow
Client connects to SSID.
FortiWLC redirects the client to the ClearPass Guest portal.
The login page receives all FortiWLC parameters correctly, including:
magic
usermac
userip
serverip
apmac
apid
apnodeid
ssid
post=https://<controllerip>:8081/vpn/loginUser?

 

User enters username/password.
ClearPass successfully authenticates the user against the authentication source.
After successful authentication, ClearPass returns:
<meta http-equiv="refresh"
content="0; url=https://<controller ip>:8081/vpn/loginUser">

The browser is redirected to:

https://<controller ip>:8081/vpn/loginUser

which returns HTTP 200 OK.

 

Problem

Although authentication succeeds in ClearPass, the client is immediately shown:

Authentication Failed on the captive portal.

It appears that FortiWLC is not marking the client as authenticated, even though ClearPass has already validated the credentials.

Things verified
RADIUS authentication succeeds in ClearPass.
Username/password are correct.
Controller receives the redirect to /vpn/loginUser.
HTTP 200 is returned.
Username field is configured as:
userid
Password field is:
password

My question

Should ClearPass simply redirect the browser to:

https://<controller>:8081/vpn/loginUser

after successful authentication,

or is it expected to:

POST additional parameters back to /vpn/loginUser?
send a RADIUS CoA?
send a Vendor-Specific Attribute?
call another FortiWLC API to notify the controller that authentication has completed?

At the moment it feels like:

Browser
    ↓
ClearPass authenticates user ✔
    ↓
Redirect to /vpn/loginUser ✔
    ↓
FortiWLC never transitions the client to AUTHENTICATED
    ↓
Authentication Failed

 

When we see the device logs in fortiWLC cli, show station mac address <mac>
we get only webauth in L3 security state nothing else

 

Has anyone successfully integrated FortiWLC 8.6 with Aruba ClearPass Guest as an external captive portal?

If so, what is the expected authentication completion process after ClearPass validates the user?

I would also appreciate any working ClearPass login page examples or FortiWLC external captive portal configurations.

 

 

    3 replies

    Jean-Philippe_P
    Staff & Editor
    Jean-Philippe_P
    Staff & Editor
    July 10, 2026

    Hello Anju, 

     

    Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

     

    Regards,

    Jean-Philippe - Fortinet Community Team
      Jean-Philippe_P
      Staff & Editor
      Jean-Philippe_P
      Staff & Editor
      July 13, 2026

      Hello,

       

      We are still looking for an answer to your question.

       

      We will come back to you ASAP.

       

      Regards,

      Jean-Philippe - Fortinet Community Team
        ebilcari
        Staff
        ebilcari
        Staff
        July 13, 2026

        To find more details about URL redirections, refer to the following article:

        ClearPass need to process and redirect to the appropriate URL for the authentication to succeed.

        Emirjon
          A
          AnjuAuthor
          Visitor III
          July 21, 2026

          Thank you for your response.

          I think our issue is occurring earlier in the authentication flow than the example you described.

          In our deployment:

          • FortiWLC redirects the client to the ClearPass Guest portal.
          • ClearPass successfully authenticates the user.
          • However, after authentication, the client is not redirected to the original destination website.
          • Instead, the browser remains in the captive portal flow and eventually displays "Authentication Failed on the captive portal."

          Another important observation is that the ClearPass WebAuth service/policy is never hit during this process. We only see the initial authentication request. We never see the subsequent authentication request that we would expect FortiWLC to generate after the browser submits the credentials back to the controller.

          This makes us suspect that the issue is on the FortiWLC side rather than in ClearPass.

          Could someone who has deployed FortiWLC 8.6 with Aruba ClearPass Guest share the complete configuration required on the FortiWLC?

          In particular, we would like to verify:

          • The External Captive Portal configuration.
          • The correct External Server Type (we are currently using Fortinet-Presence).
          • The Captive Portal profile configuration.
          • Any required RADIUS server settings.
          • Any required WebAuth configuration.
          • Whether additional configuration is required for FortiWLC to trigger the backend RADIUS authentication after the captive portal login.
          • Whether /vpn/loginUser is the correct endpoint for FortiWLC 8.6, and if so, what the expected POST parameters are.

          At present, our observations are:

          • Initial redirect to ClearPass: ✔
          • User authentication in ClearPass: ✔
          • WebAuth policy in ClearPass: Not triggered
          • Redirect to original website: ✘
          • Station state on FortiWLC remains L3 Security State: WebAuth

          Because the WebAuth request is never reaching ClearPass, we believe we are either missing a required FortiWLC configuration step or using an incorrect external captive portal configuration.

          If anyone has a working FortiWLC 8.6 + ClearPass Guest deployment, we would greatly appreciate seeing the authentication flow or the relevant FortiWLC configuration so we can compare it with our setup.

            ebilcari
            Staff
            ebilcari
            Staff
            July 21, 2026

            Based on the description I still think that this step is the one that is failing: 
            - FortiAuthenticator redirects the end-user browser to the FortiGate/FortiWiFi's captive portal API specified in the 'post' parameter of the original captive portal redirect, e.g. http://192.168.30.1:1000/fgtauth in the above sample.
            The API call also contains the 'magic' parameter (also from the original redirect), in addition to a username and password.

            most probably ClearPass in this case is not properly parsing the post parameters of the URL.

            Emirjon
              Terms & ConditionsAccessibility statement