Troubleshooting Tip: How to troubleshoot if captive portal not getting triggered in the firewall

[seshuganesh]

Description	This article describes to troubleshoot when the captive portal is not getting triggered.
Scope	FortiGate.
Solution	If the user is not getting the captive portal, it means the traffic is not matching the user-based policy. Configure the below settings in the firewall to get the captive portal triggered. Configure user based policy as shown below and keep it on top: With source IP as the concerned user IP, destination IP as ALL, and in place of source add the user information. After configuring this policy, the captive portal should trigger. If it is not triggering and can still access the internet, the traffic matches below IP-based policy. To match the top user-based policy, configure the below setting: config user setting     set auth-on-demand always end Note: It is recommended to make this change during the after-hours as it might affect the internet connection which might cause downtime. When configuring this setting, traffic will match the ser-based policy that has been created on the top and the captive portal should get triggered. Note: Make sure to create IP based DNS policy on top as shown below, to pass DNS traffic. Open the CLI of the DNS policy and make sure to enable captive-portal-exempt as well:  config firewall policy      edit <id>          set captive-portal-exempt enable  end  In the above policy example, the incoming interface (port2) is the LAN interface and the outgoing interface (port1) is the WAN/public facing interface.