External Captive portal with Forti OS 5.2

[SumaN1]

Hi Folks,

I am new in this forum and not sure if this is the correct board to post this.

I saw in FortiOS 5.2 release note, that its support external captive portal. Have any one implement this feature with good success.

Need some suggestion on this.

SumaN@boystown

[Marcel_Sueess]

Hi

we have also the problem, that the redirection to the external page isn't working. We always get the internal disclaimer page with a Fortigate VM and a Fortigate 60D with physical interface for captive portal. Is there possibly a bug in 5.2.3 with not redirecting?

Thank you so much.

Marcel Süess

[SumaN1]

Today I tried hard to get the things working, but ended up with total disappointment.

The workflow is like below:

Guest is connecting to the captive SSID [Guest]

getting IP,

trying to browse,

fortinet is hijacking the req and presenting a declaimer page.

guest accept the declaimer.

now the times of external portal redirection, so guest browser is provided a predefined url [https:192.168.29.172/guest/self_reg.php   in my case after that fortinet is adding some other information with the url] and its trying to go there but here the whole process has stopped. Its not getting to redirect to there.

I'm suspecting that some pre authentication role is required to make it success, however not able to find out any good document from fortinet.

would like if someone from fortinet take a look on this.

[Jeff_FTNT]

If the "external Captive portal " is not in same interface with your PC, make sure to add a policy to permit the PC can reach the "External Captive portal". like :

config firewall policy     edit 3         set srcintf "switch"         set dstintf "port9"         set srcaddr "all"         set dstaddr "extportal"  ----- external portal ip         set action accept         set schedule "always"         set service "ALL"         set logtraffic all         set captive-portal-exempt enable --- need input from CLI, GUI is not support it.         set nat enable     next end

Thanks.

[Marcel_Sueess]

Hi all

I get it to work with my own php script! Thank you very much for the help. I don't know, why it doesn't get me redirected to the portal site. Now I get also redirected to every external captive portal I want..

My question now is: The username and password which get sent back via the post method are in plain-text. Is there any possibility to secure these informations?

Greets

Marcel

[Jeff_FTNT]

Try HTTPS, thanks.

[Marcel_Sueess]

Dear Jeff

how do I get the Fortigate-Post-URL with https instead of http via the variables?

Thanks Marcel

[Jeff_FTNT]

Sorry for later response, busy on works.

FGT just redirect URL to external portal, all authentication is done FGT.

CLI:dia debug  application  fnbamd  -1, it will show up debug

CLI: dia firewall auth list, it will ist use pass authentication.

FGT redirect with HTTPS using port 1003,thanks.

Marcel Sueess wrote:

Dear Jeff

how do I get the Fortigate-Post-URL with https instead of http via the variables?

Thanks Marcel

[SumaN1]

Does Fortinet support RFC 3576 and Radius COA protocol

[Jeff_FTNT]

As i know, not support it, thanks.

SumaN@boystown wrote:

Does Fortinet support RFC 3576 and Radius COA protocol

[SumaN1]

OK,

My external Captive portal server and and authentication server both are external and hosted by same server. lets say SERVER-1.

So for this scenario guest will get redirect to external page [hosted in SERVER-1] and after that guest will fill up credential field to get access, which will be check against the external server SERVER-1.

So in this case how guest auth req will go to SERVER-1 and what will the protocol for that?

How fortinet will comes to know that the guest has completed authentication?