Technical Tip: Captive portal authentication using FortiAuthenticator with Usage profile

[rbraha]

Description	This article describes how to configure a captive portal with FortiAuthenticator including Usage Profile.
Scope	FortiAuthenticator, FortiGate.
Solution	On this configuration, it is required that WIFI users authenticated with a guest portal need to be disconnected after a specific time configured on FortiAuthenticatior. Enable Radius Accounting Service on FortiAuthenticator's Interface facing to FortiGate: Configure FortiGate as Radius Client on FortiAuthenticator: Create a usage profile, under Authentication -> User Management -> Usage Profile. An on-Time Limit of 5 minutes has been selected. Create a user group on FortiAuthenticator for guest users, select Usage profile, and configure on Radius Attribute -> Acct-Interim-Interval to 60 sec. Configure the guest portal and also configure an access point on FortiAuthenticator.   Configure captive portal policy on FortiAuthenticator. Configure FortiAuthenticator as a Radius Server on FortiGate, in this case,  MS-CHAPv2 is used, also FortiAuthenticator needs to be joined to the domain in order to use MS-CHAPv2. For more detailed info, check the below KB article: Technical Tip: Joining FortiAuthenticator in the active directory as a machine entity. Radius configuration is done on FortiGate through CLI: Create a user group on FortiGate: Create a wireless guest SSID on FortiGate. Configure firewall policies for guest access to DNS, FortiAuthenticator, and the internet. Test performed with one user 'beni'. Try to log in with SSID: after connecting, it will be requested to register, and fill all required fields there. After registration on a mobile phone, a message will appear: 'Your account has been created and is now ready to use'. Now, it is possible to log in with the new user and it is listed as a new registered user on FortiAuthenticator under Monitor -> Authentication -> Radius Sessions also the user is registered on FortiGate. After the time for 5 min on the next acct.-interim-interval, the user will be disconnected from FortiGate and FortiAuthenticator and will be saved as a Radius session as cumulative.   On FortiAuthenticator, the user will not be able to log in again because the user will be disabled with the status 'Usage limit exceeded'. For further troubleshot check Radius Authentication and Radius Accounting Monitor logs on FortiAuthenticator: https://<fac-ip>//debug/rad_accounting/ Note: After the user is disabled, it can be enabled manually by the administrator and the user can log in again with the same credentials without the need to register again.