Captive Portal provided by Cisco ISE for FortiAP

[istvanmarlok]

Hi,

I'm trying to do a FortiAP implementation where there is a hotspot ssid with Captive Portal authentication. 

The requested design is that Cisco ISE should provide the Hotspot portal for clients.

Did someone implement this design? Could it work?

I find some documentation where there is a config example for that but it didn't work for me.

My config is based on that, but it didn't work for me:

config wireless-controller vap
  edit wifi-cap
    set ssid "fortinet-guest"
    set security captive-portal
    set external-web "https://<ISE_Portal>:8443/portal/g?p=jN9z47goOJg75HpaXxV8WZPQgd"
    set radius-mac-auth enable
    set radius-mac-auth-server "ISE"
    set radius-mac-auth-usergroups "AuthorizedGuest"
    set local-bridging enable
    set portal-type external-macauth
    set schedule "always"
  next

 Or the config from FortiGate side is only that, and we should look at ISE side?

Thank you!

[rameshn]

Can anyone tell me weather fortiap managed in fortigate is possible for GUEST sponsor portal with cisco ISE. if so kindly share any relevant documentation for the same solution

Thank's in advance

[Anand_Narayana]

Working Configuration on FortiGate that uses the Cisco ISE Captive Portal

config wireless-controller vap
edit "GUEST"
set pre-auth disable
set ssid "GUEST"
set security open
set external-web "https://<ise portal>:8443/portal/PortalSetup.action?portal=56h5a3fg-dc1a-7689-fhk9-43256gew0a06&sessionId=3b0877060000000967ac87c1&action=cwa"
set captive-portal enable
set selected-usergroups "ISE"
set security-exempt-list "GUEST-exempt-list"
set security-redirect-url "https://cisco.com"
set intra-vap-privacy enable
set schedule "always"
set captive-portal-fw-accounting enable
set probe-resp-suppression enable
set probe-resp-threshold "-67"
next
end