Ubiquity Unify Guest wifi with separate VLANs for guest and cloud key

[André]

Hello,

Some keywords:

Fortigate 60E

separate VLANs 

Ubiquity Unify Cloud key and AC-pro access points 

Guest wifi hotspot with captive portal and voucher system (ubiquity unify)

Problem: can't access the Ubiquity Unify captive portal from the guest wifi network

Setup: 

Fortigate 60E connects to internet via WAN port, switches connected with trunks to the internal ports on the Fortigate.

3 VLANs with DHCP pools for business (1), guest (30) and private (20) set up on Fortigate for wired and WIFI networks.

Ubiquity Unify (for WIFI) with cloud key and access points are connected to VLAN1.

Configuration works fine for wired ports as well as wireless. Depending on selected network (wired or WIFI) correct IPs are assigned, network access restrictions, internet policies applied and bandwidth restrictions are correct.  So far so good.

The moment I make in the Ubiquity control panel the guest network a hotspot with a captive portal for log in with vouchers for internet access I get a hick up: when connecting with a device to the guest WIFI (VLAN 30), a correct IP address gets assigned and the browser opens to get to the captive portal for log in. Problem is the page doesn't open and the browser gives a connection time out after a while.

My guess is that the captive portal is managed and issued by the unify cloud key, which has a VLAN1 IP address. The guest device that tries to connect to the captive portal so it can log in and get access to internet has a VLAN 30 IP address. There is a good reason that guest are on a separate VLAN and I want to keep that segregation for security purposes. I have experimented with creating a policy rule that allows traffic from VLAN 30 to the Cloud key specific IP but no luck so far.

How can I get this to work (guest on VLAN 30 to use the WIFI to access internet with a voucher and authentication through the captive portal) without compromising the separation between the VLANs? I think that the solution is in a policy between the 2 VLAN's to allow for this specific traffic but am not sure as the first few attempts to set up such a rule failed on me. 

Ubiquity support suggests creating DMZ for the cloud key, but I am not sure if a DMZ is what I am happy with. Maybe one of you has had this combination before and found a reliable and safe solution?

Thanks,

André Pasman

[LKaderavek]

Hello,

I'm facing nearly the same situations.

I'm using FGT50E with 6.2.2.

The guest portal is not opening, IP gets pulled and is turning into APIPA-169 after some seconds.

I've tried different devices, iOS, MacOS, WinDO(w)S10 and Android. With all devices the problems stay the same.

In WiFi-CTRL GuestPolicy I've entered the IP of Controller, DNS, Gateway (Controller-Subnet + Client-Subnet) for pre-auth possibilities.

In the controller the VLANs are configured as VLAN-Only Networks.

The policiy in FortiGate is set for Guest-Subnet > Controller and TCP 8880, 8843 - you've set 8080 and 8443 wrong - those are for administering, 8880 and 8843 are the guest portal ports - for testing I've also entered 8080 and 8443 - which didn't work.

I've already openend a thread with detailled coniguration:

https://community.ui.com/questions/UniFi-Guest-Portal-or-Problems-with-autorization-DHCP-Lease-APIPA...

Hopefully we could fix this!

Thanks

Lukas