FortiAuthenticator Guest Captive Portal Cannot be reached from Client

[Jasys]

Had this working briefly, but somehow , something has changed in the environment, I have followed:

https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/578250/fortiauthenticator-as-a-...

A few tweaks here and there, but essentially, the Client connects to the OPEN ssid, the interface uses system DNS to look up the address of the external portal., then should be able to access the captive portal, this part is completely broken, no traffic arrives at the FAC, meaning the client just cant resolve the FQDN (it used too!)  I checked the clients ipconfig, and it gets the right DHCP IP, gateway (Fortigate wifi interface) and correct DNS (it picks up public DNS, but there are DNS-DATABASE entries for the FAC) 

there is an EXEMPT captive portal rule, from the GUEST source network, to the FAC on HTTPS, so that it can use the form to register, before browsing. there are no hits on this rule. I have tried everything now, I just dont know what is missing, I tried using interface DNS, system DNS on the WIFI interface, the SSID is correct , open with external captive portal.. the FAC is working as the other WIFI is working as well as SSL VPN users.. any suggestions would be great.

[kolebmo1]

I can answer the part about "SSL deep inspection using an already trusted CA certificate" and the answer no. To do SSL deep inspection you need the private key that a CA uses to prove it is not being impersonated and that being publicly available makes it no longer trustworthy.

[Jasys]

That has nothing to do with my question? Have you answered in the wrong post?

[funkylicious]

hi,

i would enable dns server listening on the ssid, where you have an entry for the captive portal hostname.

in the dhcp settings set to use the interface ip and then it should work.

make sure that you also have the fw rule from ssid intf to fac.

https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/960561/fortigate-dns-server 

[Jasys]

Hi There, Many thanks for replying, I have enabled DNS service on the SSID interface, this has an entry for the FAC, as its a public signed FQDN (there is an entry for 192.168.100.1 > https://myfac.mydomain.com)  and that address is assigned as the captive portal. the guest joins the open network,. getting the correct DHCP address, and the correct interface gateway and the same DNS as the interface. but the portal is never triggered, you can browse to a website and it still isnt triggered, just says this page is insecure with no option to override. 

I am at a loss as to what has broken! 

[funkylicious]

hi,

can you please share the configuration of the ssid, fw rules for this ssid and auth portal settings ( show firewall auth-portal / show user setting ) on the FGT ?

i assume that you went through all the steps described in the article above for the other settings, especially the settings on FAC side.

[Jasys]

Yes, I followed the article exactly, it was working at some point, someone has changed something whilst I was on leave,

config firewall auth-portal
set portal-addr "guest.auth.mypublicdomain.com"
end

(this is not the portal address, but a requirement according to the article)

config user setting
set auth-type https
set auth-cert "WIFICERT2025"
set auth-secure-http enable
end

(This is a public signed cert, with "guest.auth.mypublicdomain.com" in the SAN)

None of this has been changed.

The policies are basically, 1 "exempt" at the top:

config firewall policy
edit 22
set name "Exempt Portal"
set srcintf "WIFI INTERFACE"
set dstintf "INSIDE-NETWORK"
set action accept
set srcaddr "GUEST-WIFI-SUBNET"
set dstaddr "FORTIAUTHENTICATOR"
set schedule "always"
set service "DNS" "HTTP" "HTTPS"
set inspection-mode proxy
set logtraffic all
set nat enable
set port-preserve disable
set captive-portal-exempt enable
next
end

Then the Rule with the usergroup once they are Authenticated to access the internet:

config firewall policy
edit 24
set name "Guest Internet Access"
set uuid 11c2dfd6-03b8-51ef-b23f-147a6ad0602c
set srcintf "WIFI INTERFACE"
set dstintf "WWW"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "Web Access"
set utm-status enable
set inspection-mode proxy
set ssl-ssh-profile "certificate-inspection"
set av-profile "wifi-default"
set logtraffic all
set nat enable
set port-preserve disable
set groups "GUEST-SUBNET"
next
end

The FAC is on the inside network, and has a route etc...

The SSID:

config wireless-controller vap
edit "GUEST"
set ssid "GUEST-WIFI"
set security open
set external-web "https://FORTIAUTHENTICATOR.mypublicdomain.com/portal/"
set captive-portal enable
set selected-usergroups "GUEST-SUBNET"
set security-exempt-list "GUEST-exempt-list"
set security-redirect-url "https://www.google.co.uk"
set intra-vap-privacy enable
set schedule "always"
set quarantine disable
set beacon-advertising name
next
end

[funkylicious]

config firewall auth-portal
set portal-addr "guest.auth.mypublicdomain.com"
end

(this is not the portal address, but a requirement according to the article)

portal-addr setting must be an FQDN that resolves to the interface IP address of the guest SSID

here you should have a dns entry for the ssid interface.

in the firewall rule towards FAC you should disable captive-portal exempt as per the documentation and i would also disable NAT.

https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/625090/creating-firewall-polici... 

[Jasys]

I cant disable NAT, the FAC wont have a route back to the WIFI interface IP 192.168.x.x, 

[Markus_M]

Hey,

I recommend going through this article. It is basically a step-by-step of what must happen for the captive portal to work fine.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-General-captive-portal-explanation-f...
If a step isn't happening, that tells you where to look.
In your case - a client must, regardless of captive portal, be able to access the FortiAuthenticator FQDN, without certificate warnings. That'd be in the article step 8.

The FortiGate must have an exemption for the client to reach the FortiAuthenticator IP. Exempt either with policy or with the SSID itself (it has the option for exempt destinations).

Do a packet capture towards the client IP or on the client and see what DNS and HTTP traffic does and follow the articles steps.

In very short:
There must be some DNS query for one of those captive portal detection pages, then tcp handshake, HTTP GET. FortiGate must block/answer it with its own URL resolving to its own interface. Cycle repeats but FortiGate answers with the FortiAuthenticator URL ... and cycle repeats (DNS for FAC FQDN, TCP handshake, HTTP(S)). If there is another portal behind FortiAuthenticator, i.e. social login or even SAML IdP - then add another of those cycles (DNS, TCP, HTTP).

In any case, the client must be able to reach ALL captive portal instances without the need to authenticate first to reach the instance to authenticate to! That'd be a catch 22, so the authentication targets must be exempted.

Best regards,

Markus