Authentication for WiFi clients thru Captive Portal

[imranrft]

Hi, I' m using FGT-600C with firmware v5.2.0,build0589. I have configured a guest group for Captive Portal with default authentication timeout settings. Everything is working fine. What I want to achieve: The client should re-authenticate whenever he/she re-connects to WiFi regardless of authentication timeout values. For example, auth-timeout-type is set to " hard-timeout" and auth-timeout is set to 8 hours. If a client connects and authenticates and disconnects from WiFi after 10 minutes of usage. Later he comes back again after 30 minutes and connects back. He does not need to re-authenticate. I want to change this behaviour to make him authenticate every time he connects. Is it possible to achieve.

[nothingel]

Are you sure you want this? Tablets and phones often disconnect quickly from wifi when their screens turn off either by a timer or by pressing the ' off' button. Your users will probably go crazy if asked to re-login via the captive portal every time their device wakes up.

[imranrft]

Is it possible to achieve? How to configure? First, I want to present the idea to my seniors along with its drawbacks. Then we' ll see all the possibilities. Thanks.

[Nihas]

You cannot achieve this as like what you expected. you can set an " authtimeout" to " 10 Minutes" or " 20 Minutes" , but every particular interval the user has to re login to the captive portal to get connect back. edit " Guest Users Group" set group-type guest set authtimeout 0 set auth-concurrent-override disable set http-digest-realm ' ' end So, this is not recommended and you cannot implement this on a network where frequent guest user accounts needed. And if your plan is to highly restrict them , then there are lot of other options available like to restrict the services / put webfiltering etc.

[Stryker412]

I actually have the opposite problem. I created a group and they need to re-authenticate each time their device goes to sleep. I want them to only authenticate once, and not have it last until their account expires. Generally I have contractors in the building for 6-8 hrs and need them to be online while they' re here. I' m guessing the above commands are for the command line interface. I found the option for reauthenticate which is set to 5. However, I don' t see way to edit that per group. For instance, users on our student or faculty SSID, never have to reauthenticate. Seems the guest group is the only one.

[Stryker412]

Can anyone assist me with this?

[Bromont_FTNT]

Stryker... Guests authenticate via Captive portal and others via saved psk or radius?

[Stryker412]

Yes, guests using captive portal and staff using PSK. Although we' re integrating AD soon so I' m hoping our staff will be able to just use their school username to login to the wifi starting in Sept.

[Nihas]

Hi Stryker. By default the authentication timeout is set to 5 Minutes. FGT# show full-configuration user setting config user setting set auth-type http https ftp telnet set auth-cert " self-sign" set auth-ca-cert ' ' set auth-secure-http disable set auth-http-basic disable set auth-multi-group enable set auth-timeout 5 set auth-timeout-type idle-timeout set radius-ses-timeout-act hard-timeout set auth-blackout-time 0 set auth-invalid-max 5 set auth-lockout-threshold 3 set auth-lockout-duration 0 end You can change the authentication timeout for a particular group by doing the below command. FGT#config user group FGT (group) # edit " Guest Users Group" set group-type guest set authtimeout 480 ( You can use 1-480 Minutes ) set auth-concurrent-override disable set http-digest-realm ' ' end Hope this helps!