Technical Tip: FortiNAC Guest Captive Portal configuration and workflow

Sx11 · ‎06-24-2022

Description

This article describes how to set up a Guest Registration portal with Sponsor approval in FortiNAC.

Scope

A standard setup will include the following products: FortiSwitch, FortiGate and FortiNAC.

This article only discusses the flow and steps to configure the portal on FortiNAC.

It is expected the customer has already performed integration of FortiNAC and FortiGate by referring to the following articles and documentation:

It is also expected that FortiNAC is deployed and configured with the isolation subnet where Rogue devices will be initially moved and presented the Eth1 captive interface.
On FortiNAC, it is necessary DHCP scopes in order for FortiNAC to assign isolation IP to the connecting Rogue devices.
FortiNAC will act as DNS server for hosts in Isolation. All HTTP and HTTPS requests will be redirected to FNAC eth1 where captive portal services will be available to users.

Other necessary elements:

- DHCP helper address pointing to the ETH1 interface of FortiNAC.

- In the VLANs routed interface, an L3 ACL is necessary in order to route everything to ETH1 of FortiNAC.

Solution

A) Operation flow for the host making a wired connection to the FortiSwitch port:

The host connects to the network.
The Switch sends a MAC Notification trap to FortiNAC.
FortiNAC enforces Isolation on the Port and presents the portal to the user. The host appears as Rogue(?) in FortiNAC host view and will have an Isolation IP assigned.
The user completes Registration form and sends request to FortiNAC.
The request is sent to the Sponsor (who needs to approve it under User & Hosts -> Account Requests by 'right-clicking' the request under the 'status pending' section and selecting 'Accept').
After approval, FortiNAC sends user + password information to the Guest.
The user logs in with credentials. (The post is sent to FortiNAC.)
In the FortiNAC host view, the guest user associated with the host is displayed. The guest user is now registered and matching the needed Network Access policy with the guest VLAN logical configuration.
FortiNAC will change the VLAN on the port to the GUEST VLAN depending on the integration method and on how FortiNAC performs VLAN changes on the switch (SNMP, CLI, API, RADIUS, ...).
The user achieves network access through FortiGate Policies.

B) Operation flow for a host connecting wirelessly to the SSID

In these scenarios, FortiNAC learns about the Host MAC address through RADIUS protocol.
After connecting to the SSID the Host sends a Radius Authentication Request (MAB).
FortiNAC authenticates the host and returns the Isolation VLAN. The host appears as Rogue(?) in FortiNAC host view and will have an Isolation IP assigned.
All HTTP and HTTPS requests will be redirected to FortiNAC (which is acting as DNS server in isolation), which will present the Captive portal services.
The user completes the form and sends a request to FortiNAC.
The request is sent to the sponsor (who needs to approve it under User & Hosts -> Account Requests by 'right-clicking' the request under the 'status pending' section and selecting 'Accept').
After approval, FortiNAC sends the user + password information to the guest.
The user logs in with credentials (the post is sent to FortiNAC).
In the FortiNAC host view, the guest user associated with the host is displayed. The guest user is now registered and matching the necessary Network Access policy with the guest VLAN logical configuration.
FortiNAC sends a RADIUS CoA disconnect request to de-authenticate the host from its current isolation state.
The NAS (Switch) will disconnect the Host from the isolation state(VLAN) and send a RADIUS COA ACK to FortiNAC.
The host sends a new RADIUS authentication request to which FortiNAC responds with an Accept-Accept response that includes the 'Tunnel-Private-Group-Id' attribute, which contains the Guest VLAN access value.
The user has network access through FortiGate policies.

Before proceeding to the Portal and guest templates, the following will be necessary to have:

A guest VLAN configured on the FortiSwitch.
A logical network created for the Guest VLAN in FortiNAC.
A network access configuration/policy in FortiNAC matching the Guest_VLAN logical network.
A guest VLAN logical network is enforced and assigned an access value in the FortiGate model configuration.

Step 1. Create role and template for Guests.

Go to Policy and Objects -> Roles.

Select GuestSelfRegistration.

Edit the details if it will be necessary groups to be added to this role.

Step 2. Configure the Template for Guests.

Go to User & Devices and select 'Role: GuestSelfRegistration' from the previous step.

Edit the Data fields.

Step 3. Create a user host profile named 'Guest' to associate with the network access policy.

Add the Who/what attribute to Role:GuestSelfRegistration.

Step 4. Create a network access policy matching the previously created User/host profile and Network access configuration.

The network access configuration should specify the Guest_Vlan logical network.

Step 5. Enable the self-registration guest login:

Step 6. Enter a sponsor email if sponsor approval for guests is enabled.

Edit the 'Require sponsor approval' to 'Any User' and enable additional features if needed as below:

Step 7. Configure the email server and verify the sponsor's email address under Users View by modifying the user entry and configuring the email address.

Under Settings -> System Communication, go to Email settings and configure the Email server as needed.

Step 8. Put the Port where the host connects to the 'Force Registration' and 'Role Based Access' groups.

These are system groups that will provide enforcement to all ports that are marked as members.

Force Registration - Enforces isolation when unregistered hosts connect.
Role-Based Access - Enforces Network access policies on the member ports and port groups.

In order to do this, include all the needed ports in a port group and then make this group a member of both system groups above.

For a simple test with one port, it is possible to go to the Network device in Inventory view, select the port, and select Group Membership.

Enable membership for both system groups.

Related articles: