Technical Tip: Captive Portal on Apple devices

[jiahoong112]

Description	This article describes how to ensure the captive portal on Apple devices is working after performing the initial configuration from here: FortiAuthenticator as a Wireless Guest Portal for FortiGate To verify whether the initial captive portal configuration is correct, test it on a Windows or Android device first.
Scope	FortiOS non-EOS versions. When Captive Portal authentication is used.
Solution	The following Address Objects have to be created first. DNS Object: Captive.apple.com FQDN object: There are extra steps required for Captive Portal authentication to work on Apple devices. These configuration steps have to be carried out on the FortiGate: Exempt captive.apple.com and DNS under 'Exempt Destinations' of the captive portal as such: Create a firewall policy where the Destinations are only captive.apple.com and the DNS server so that the Apple devices can resolve DNS and reach captive.apple.com before being able to hit the captive portal page. config firewall policy     edit 26         set name "captive-portal-exempt"         set srcintf "captiveportal"         set dstintf "virtual-wan-link" "port4"         set action accept         set srcaddr "all"         set dstaddr "google dns" "fac" "captive.apple.com"         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable     next end Configure DHCP Option 114 for the purpose of ensuring the redirection to the public URL is correct after the captive portal. This ensures that redirection to the webpage is successful after captive portal authentication. It also allows the network to advertise to the device that it is the captive portal rather than a traffic interceptor: https://developer.apple.com/news/?id=q78sq5rv