Apple Devices with Captive Portal

[Jasys]

Having had quite a few issues, there is one annoying one that is remaining, I have a Fortigate running an SSID using the FAC as the Portal for registration etc, which is working fine on Android, Laptops etc. but any apple device when selecting the SSID redirects to the "captive.apple.com" page on the phones and displays the message "Hotspot login, cannot open the page, the server cannot be found"

if the user browses to this captive address you do get the "success" message. Im raising this here as there are a few articles that tell you , on the Fortigate to "exempt" captive.apple.com from the SSID, which I have done. this article: Captive Portal on Apple devices - Fortinet Community doesnt do anything, is anyone able to offer some assistance? is this because the iphone has cellular data turned on or related setting?

thanks

[Markus_M]

I don't want to bother too much about that beautiful article and its documented steps and will stop on referencing it, but it is important to understand to what the browser is connecting when receiving that warning.

"No internet connection" is not helpful, it will say that the browser is getting redirected to its built-in captive portal check, which would in case of the Edge browser, a Microsoft page. The packet capture towards the client IP will show its communication and failures, if any.

Remember:

When the client connects, it will do DNS for captive detection pages, get an IP. TCP handshake to the IP, FortiGate blocks this and answers with a redirect to its own page, which would be https://fgt-fqdn:1003. Client will attempt DNS to resolve it, access the result (which must be the FortiGate interface IP) and then connect to it. FortiGate will again respond with an FQDN for redirect, which is then https://fac-fqdn. Again, client will DNS resolve the FortiAuthenticator and again TCP connect to it.

Entering an FQDN manually to the browser will circumvent the automatic attempt, if it otherwise fails. If that FQDN is an HTTPS page, FortiGate will still attempt blocking it, but in order to do so, it needs to resign the connection with its own untrusted CA certificate, resulting in a certificate warning.

All of the above is visible with a packet capture towards the client IP. As FortiGate will do NAT towards WAN, that traffic would be not part of such a filter, but it is also not important.

More for guesswork:

For Apple devices, you would need to have the FortiGate use the secure redirect to the FortiGate. FortiGate is required to have a valid certificate that the end user can verify without warnings. The result is that redirect #1 will go for tcp/1003 instead of tcp/1000:
config user setting
  set auth-secure-http enable
end

[Jasys]

Hi Markus, this all works flawlessly for any other device except apple.

The certs are valid , the auth is set.. the FortiGate has a cert signed by godaddy as does the FAC. The portal is being triggered as they get the untrusted warning with the fac FQDN

[distillednetwork]

When you look at the "invalid" certificate, are you seeing the entire chain on the client? (the cert, intermediate and root?)

[Jasys]

From memory, the cert that isn't trusted, is just the cert. The godaddy signed one for the FortiGate Interface "auth.portal.xxxxxx.uk"  expiry is in 2026

[martijndhondt]

Did you use Tunnel mode for the SSID? I had more success with the tunnel-mode.
Also, policy from guest-range to DNS-server to allow resolving and HTTPs to the FortiAuth.
I also used a wildcard-cert on my FortiGate for authentication and set the following:

config firewall auth-portal
    set portal-addr "guestportal.xxxx.com"
end

config user setting
    set auth-type http https
    set auth-cert "star-xxxx-com"
    set auth-secure-http enable
end

 I also exempted the destination of the firewall auth-portal (see above) and the DNS-servers on my SSID as well as the IP of the FortiAuth.

[Jasys]

Hi, yes, all of this is correct, it all works, tested for myself today, Android, Google Phone, Windows Laptop, all trust and display the portal registration.  This is only happening on Apple phones, and its getting so annoying, I cant find anything on Fortinet or Apple communities, Certs are valid and trusted chain is installed. The FAC has a DNS entry on the gate which resolves correctly. its only apple devices that fail, so I kind of know the FAC and GATE are setup correctly, thank you for your comments though :)

is your set auth-ca-cert set to anything? wonder if that would help?

[martijndhondt]

We have nothing on that setting.