IPSec VPN and Device Identification

You could have solved this by setting up 2 SSIDs one for guest with policy ABC and one for Employees with XYZ Now this would not prevent a employee sharing his/her PSK to a guest. What you need to do is review fortigate review of BYOD and protections of resources. They a few papers and videos about how to tackle this. Google BYOD and fortinet. You could manage this via network logins controls within a captive environment.

All is not lost. hi, I can see why you would want to keep access to the WiFi via password and not via captive portal. So this should be held constant in a future solution. Second, sharing a password is never a good idea. Even if you would change the WiFi password now you wouldn' t have any guarantee that it would not be leaked in the future. So you will have to use the new (FortiOS v5) device recognition feature to discriminate your employees phones in order to apply different web filter profiles. Fortunately, you are using FortiWiFis as local APs and VPN gateways. I am assuming that these remote FGTs are used " as is" , i.e. not as remotely managed APs. In this case you would enable device recognition on the FortiWiFis which would enable you to enable two user groups to use different firewall policies, namely policies between " internal" and " VPN" . You would set up the device groups as sources which would make 2 policies available, one for users and one for employees. Here you could lead them through different VPN tunnels to your central FGT where the UTM takes place (web filter, schedules etc.). Does that sound like what you intend? Do you think it could work this way? I know this scheme does have a drawback, namely having 42x2 device groups to manage. At this point you should consider getting a FortiManager to handle your FGTs, policies and all that.