Technical Tip: How to bind the captive portal to loopback interface

tino_p · ‎06-26-2024

Description

This article describes how to bind the captive portal to the loopback interface.

Scope

Loopback interface, authentication, FortiGate.

Solution

To define the user in the user group:

To define the loopback interface, and configure its captive portal, restrict the access to step 1's user group:

To define the LAN interface and configure its captive portal, restrict access to step 1's user group, and exempt source of loopback's IP address:

To define the firewall policies:

1 policy from the LAN interface to the loopback interface.
1 policy from the LAN interface to the WAN interface (with active authentication/user group in source address/NAT enabled) OR to any other interface that meets the business requirement.

As a result, the user needs to authenticate to access resources (i.e.: Internet). If the user wants to see the FQDN instead of the loopback interface's IP address, it needs to have a local DNS to resolve it.

Sample configurations on CLI:

config system interface
edit "Authen_int"
set vdom "root"
set ip 192.168.150.1 255.255.255.255
set allowaccess ping
set type loopback
set security-mode captive-portal
set security-groups "GRP1"
set role lan
set snmp-index 15
set ip-managed-by-fortiipam disable
next

edit "port5"
set vdom "root"
set ip 192.168.85.254 255.255.255.0
set allowaccess ping https ssh http
set type physical
set security-mode captive-portal
set security-exempt-list "port5-exempt-list"
set security-groups "GRP1"
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 5
next

config firewall policy
edit 2
set name "auth"
set uuid 393c0fbc-2de1-51ef-239a-d711a29c4d91
set srcintf "port5"
set dstintf "Authen_int"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set captive-portal-exempt enable
next

edit 1
set name "www"
set uuid b9a5a732-2ddf-51ef-56f9-eb5fd6fe2748
set srcintf "port5" <----- The LAN interface.
set dstintf "port1" <----- The WAN interface to access Internet.
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set groups "GRP1"
next
end

config authentication setting
set update-time 2024-06-18 19:09:42
set captive-portal "Authen"
end

config firewall auth-portal
set portal-addr "authen.fqdn.here" <----- Need local DNS to resolve.
end

Technical Tip: How to bind the captive portal to loopback interface

You are leaving our website