Fortigate Hotspot

[ITEL]

I have a Fortigate where I have two VLANs with different networks configured with hotspot. Both point to the same external radius server.

When I connect to the SSID of VLAN A, the portal pops up and I register without any problems. My username (which is the MAC) appears in Firewall Users along with the IP.

When I connect to the SSID of VLAN B, the portal pops up again because the user and IP pair is not the same. So far, everything is normal. But I have MAC authentication bypass enabled “set security-mac-auth-bypass enable”.

As I understand it, MAB should be pre-authentication, and when I connect to SSID B, before the portal pops up, it should consult the server. When the server sees that the user is already authenticated, it responds to Fortigate with an “accept” and puts the user with the new IP in Firewall Users without the portal popping up.

But it doesn't work as I expect, and when I connect to the SSID, the portal pops up directly without consulting the radius.

The same thing happens with a single SSID and the user authenticates, has a 2-day lease, the user leaves and returns after 3 days, when connecting to the same SSID, the portal pops up even though they are already authenticated in radius.

Does anyone know of a way to make it query the server first?