Captive portal and intra-ssid traffic

[PhilLeme]

Good day people,

Is there a way to block intra-ssid traffic when using a captive portal ? At the moment, the only way to block intra-ssid traffic is to use a WPA/WPA2 security mode.

On a side note, why is it not possible to block intra-ssid traffic when using a captive portal ?

[mnantel_FTNT]

Hi Philippe,

I'm not clear on why this wouldnt work on your end. It does behave fine on my unit here (albeit granted, I am currently running 5.4 pre-release code). Are you able to change it in the CLI but not in the GUI?

config wireless-controller vap
    edit "SANSFILGRATUIT"
        set vdom "root"
        set ssid "SANSFILGRATUIT"
        set security captive-portal
        set portal-type disclaimer
        set intra-vap-privacy enable
        set local-switching disable
    next
end
 

--

Mathieu Nantel - NSE4, CCIE 24349

Principal System Engineer / Consultant Technique Senior, Office of the CTO

[PhilLeme]

Hi Mathieu, thank you for responding.

The current configuration I have is:

config wireless-controller vap
    edit "ESICaptiveTest"
        set vdom "root"
        set ssid "esi_captive_portal_test"
        set security captive-portal
        set portal-message-override-group "captive-portal-ESICaptiveTest"
        set selected-usergroups "CaptivePortalTest"
        set intra-vap-privacy enable
        set local-switching disable
    next
end

When I select the Captive portal security mode, the option to block intra-ssid traffic disapears from the web interface.

Even with the current configuration which states "intra-vap-privacy enable", devices connected to that SSID can still see each other.

I'm running on FortiOS 5.0.