Good morning,
about our FortiGates (FortiOS 7.0.9) and FortiAPs we have published via Wireless-LAN incl. Captive Portal. Unfortunately, there are always problems with the connection of Apple iOS (iPhone / iPad) devices.
Among other things, the captive portal does not open or if a user leaves the reception area of the wireless LAN, he must always reconnect or authenticate at the captive portal. On the iPhone, we have already configured that no(!) private MAC address should be used. Unfortunately, it did not improve the situation.
The problems then affect the user programs, because there is no reasonable connection.
Hence my question,
what is the best practice configuration for WiFi incl. Captive Portal, if you want to provide the user access to the internal network as well as Internet.
Keyword: Idle Timeout, SSL Inspection, etc.
Regards
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
It seems you're mixing multiple different issues into the same questions. It might be better to have separate threads for separate issues.
Bellow are some generic tips:
config user setting
set auth-src-mac disable
end
Okay, thanks for the informations. Our iPhones and iPads are running the newest version of iOS 16.
I've try to access the captive portal manually via phone but the i cannot. i've using https://<ip>:1003. Where can i do some troubleshooting?
You can't access the captive portal manually. You'll need to be redirected there by the Fortigate. Just access http://example.com .
If you are using the HTTPS version on port 1003, ensure the client OS can verify the validity of all intermediate certificates used on the captive portal. Ensure intermediate CAs are imported into Fortigate and that CA servers are exempted from the captive portal. I don't think Apple CNA will prompt for login when captive portal certificate validation fails.
In any case, you should capture the client's traffic to have more visibility into the issue.
Okay, thanks. Do i have to exempt some destinations from captive portal for work of the captive portal? so should i allow some sites from apple or firefox for working with captive portal?
No, you only got to make sure that DNS works in order to resolve external pages so your client can make the HTTP request to them. The HTTP request will then be redirected. This is also expected and the client can know that it is behind a captive portal and ask the client "you must login, please click here to login".
If your captive portal isn't hosted on the FortiGate but on a FortiAuthenticator or other solution, must also be exempted.
Best regards,
Markus
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.