|
To configure captive portal authentication with Cisco ISE on FortiGate, follow these steps:
- Go to WiFi & Switch Controller -> SSIDs and Create New SSID.
- Set SSID to the desired SSID name and set Security to Open.
- Set External Web to the Cisco ISE portal URL and set Captive Portal to Enable.
- Set Portal Type to Auth-MAC and set RADIUS MAC Auth to Enable.
- Configure the RADIUS server settings and set RADIUS MAC Auth Server to the Cisco ISE server IP address.
config wireless-controller vap
edit "GUEST-TEST"
set ssid "GUEST-TEST"
set security open
set external-web "https://x.x.x.x:8443/portal/PortalSetup.action?portal=35c9a5e7-ef78-43df-b200-7903c7714b8b&action=cw..."
set radius-mac-auth enable
set radius-mac-auth-server "OPs-ISE-01"
set radius-mac-auth-usergroups "ISE GROUP"
set captive-portal enable
set portal-type auth-mac
set schedule "always"
next
end
- Go to User & Authentication -> RADIUS Servers and edit the RADIUS configuration.
- Set Server to the Cisco ISE server IP address and set Secret to the shared secret key.
config user radius
edit "OPs-ISE-01"
set server "x.x.x.x"
set acct-interim-interval 60
set radius-coa enable
next
end
- Configure Firewall user group with RADIUS server.
config user group
edit "ISE GROUP"
set member "OPs-ISE-01"
next
- Configure the firewall policy to allow traffic from the VAP to the Cisco ISE server and DNS server with captive-portal-exempt enable.
config firewall policy
set name "Test-WIFI"
set srcintf "GUEST-TEST"
set dstintf "x3"
set action accept
set srcaddr "guest-test rang"
set dstaddr "x.x.x.x"
set schedule "always"
set service "ALL"
set logtraffic all
set captive-portal-exempt enable
next
set name "Test-WiFI_DNS"
set srcintf "GUEST-TEST"
set dstintf "x3"
set action accept
set srcaddr "guest-test rang"
set dstaddr all
set schedule "always"
set service "DNS"
set logtraffic all
set captive-portal-exempt enable
next
- Configure the firewall policy to allow internet traffic to user with user group
set name "test guest"
set srcintf "GUEST-TEST"
set dstintf "x2"
set action accept
set srcaddr "guest-test rang"
set dstaddr "all"
set schedule "always"
set service "Web Access"
set nat enable
set groups "Guest-group"
Cisco ISE:
Configuration image on the Cisco ISE side:
Troubleshooting tips:
- Check the Cisco ISE server logs for any authentication errors.
- Verify that the RADIUS server settings are correct and that the shared secret key matches.
- Check the FortiGate logs for any errors related to the captive portal authentication.
|
