Wireless-LAN Captive Portal + Best Practice

[FortiGateAdmin]

Good morning,

about our FortiGates (FortiOS 7.0.9) and FortiAPs we have published via Wireless-LAN incl. Captive Portal. Unfortunately, there are always problems with the connection of Apple iOS (iPhone / iPad) devices.

Among other things, the captive portal does not open or if a user leaves the reception area of the wireless LAN, he must always reconnect or authenticate at the captive portal. On the iPhone, we have already configured that no(!) private MAC address should be used. Unfortunately, it did not improve the situation.
The problems then affect the user programs, because there is no reasonable connection.

Hence my question,
what is the best practice configuration for WiFi incl. Captive Portal, if you want to provide the user access to the internal network as well as Internet.
Keyword: Idle Timeout, SSL Inspection, etc.

Regards

[bpozdena_FTNT]

It seems you're mixing multiple different issues into the same questions. It might be better to have separate threads for separate issues.

Bellow are some generic tips:

• If inactive users are being de-authenticated you may need to tweak the timers.
• If you think your issue is related to client MAC addresses, you can try disabling source MAC address verification:

config user setting 
    set auth-src-mac disable 
end

• Also test if you can access the captive portal manually from browser, by accessing some non-HTTPS website (http://example.com). If you are redirected to the captive portal, then try updating the affected iPhone. There have been many bugs related to the Apple Captive Network Assistant.
• Ensure DNS is exempted from captive portal.
• Use WPA2/3 instead of captive portal if user self-registration is not required.

[FortiGateAdmin]

Okay, thanks for the informations. Our iPhones and iPads are running the newest version of iOS 16.

I've try to access the captive portal manually via phone but the i cannot. i've using https://<ip>:1003. Where can i do some troubleshooting?

[bpozdena_FTNT]

You can't access the captive portal manually. You'll need to be redirected there by the Fortigate. Just access http://example.com .

If you are using the HTTPS version on port 1003, ensure the client OS can verify the validity of all intermediate certificates used on the captive portal. Ensure intermediate CAs are imported into Fortigate and that CA servers are exempted from the captive portal. I don't think Apple CNA will prompt for login when captive portal certificate validation fails.

In any case, you should capture the client's traffic to have more visibility into the issue.

[FortiGateAdmin]

Okay, thanks. Do i have to exempt some destinations from captive portal for work of the captive portal? so should i allow some sites from apple or firefox for working with captive portal?

[Markus_M]

No, you only got to make sure that DNS works in order to resolve external pages so your client can make the HTTP request to them. The HTTP request will then be redirected. This is also expected and the client can know that it is behind a captive portal and ask the client "you must login, please click here to login".

If your captive portal isn't hosted on the FortiGate but on a FortiAuthenticator or other solution, must also be exempted.

Best regards,

Markus