FortiAuthenticator Guest Captive Portal Cannot be reached from Client

[Jasys]

Had this working briefly, but somehow , something has changed in the environment, I have followed:

https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/578250/fortiauthenticator-as-a-...

A few tweaks here and there, but essentially, the Client connects to the OPEN ssid, the interface uses system DNS to look up the address of the external portal., then should be able to access the captive portal, this part is completely broken, no traffic arrives at the FAC, meaning the client just cant resolve the FQDN (it used too!)  I checked the clients ipconfig, and it gets the right DHCP IP, gateway (Fortigate wifi interface) and correct DNS (it picks up public DNS, but there are DNS-DATABASE entries for the FAC) 

there is an EXEMPT captive portal rule, from the GUEST source network, to the FAC on HTTPS, so that it can use the form to register, before browsing. there are no hits on this rule. I have tried everything now, I just dont know what is missing, I tried using interface DNS, system DNS on the WIFI interface, the SSID is correct , open with external captive portal.. the FAC is working as the other WIFI is working as well as SSL VPN users.. any suggestions would be great.

[Jasys]

Thankyou Markus., I just added some config above, there is absolutely an exempt policy to reach the FAC (DNS, HTTPS)  the FQDN of the portal is added as a DNS Database entry, that the SSID interface has DNS Interface Service enabled.

[Markus_M]

You want to then check exactly what happens when a client wants to browse the FortiAuthenticator. Check against FQDN and IP, just in case. What is the browsers complaint about it?

I would also refrain from adding the group on both the interface and the policy. Go for the interface and remove the group from the policy. It can only match anyway if the interface allows the group after authentication.

[Jasys]

if they browse direct to the FortiAuthenticator , they get the Fortinet 403 Forbidden page, which is what I would expect. as the request needs to be intercepted by the gate. they get the correct DHCP, gateway and DNS of the interface, so all that is correct, if they browse to a page on the internet, they get "your connection is not private" 

[Markus_M]

So the exempt policy works fine then.

Browsing an internet page will likely fail because captive portal is in place. From that article step 1 needs to happen which is plainly that the client must(!) try reaching some HTTP page unencrypted which will trigger the redirect to FortiGate. You can always test that with browsing one manually, packet capture and see how it behaves. http://detectportal.firefox.com is one of those pages. Browse it manually to start at step 1 and check whether the rest would work. If it does, you need to see why the client seems to not do this automatically, ending up asking the user to "you must login to use this network".

Have you also removed the group from the policy (this will cause issues)?

[Jasys]

if I remove the group, it will let people browse unauthenticated, or are you saying, its enough to have it in the SSID setting?  Ill remove it and test then

[Markus_M]

Hey,

 it is enough to keep the group on the SSID OR the policy. Both can trigger a captive portal on their own. Keeping however both may conflict with each other. Your config otherwise looks fine. There are common mistakes to have config firewall auth-portal contain the FortiAuthenticator FQDN, which however I don't read from your config bits, the rest seems also OK.

Best regards,

Markus

[Jasys]

Hi Markus,

config firewall auth-portal
set portal-addr "guest.auth.mypublicdomain.com"
end

this is the firewall FQDN, that resolves to the WIFI interface, so it is there, the External portal (FAC) has a DNS-Database also :) 

ill get it tested again today, but I am not hopeful! 

[funkylicious]

dumb question from my part, but have you enabled on FAC on the interface Captive Portals under Services for it ?

[Jasys]

Not dumb at all ;) that caught me out a while ago! yes its enabled, thank you

[funkylicious]

ok, so im kinda lost in the replies that you and Markus are having.

what is currently not working or what is working?

after the user connects to the wifi, it gets a ip and can resolve the wifi intreface fqdn and fac fqdn, right ?

is the captive portal being displayed when trying to access a resource ?