Guest Access

FortiOS Guest Access Fundamentals

• FortiOS Guest Access Features: FortiGate provides several mechanisms to securely manage guest access to wireless networks:

  • Guest SSID: Allows for the configuration of entirely separate guest networks. These can have unique security profiles, firewall policies, and user authentication methods.

  • Internal Captive Portal: Provides a local landing page hosted on FortiGate that must be interacted with before network access is granted.

  • External Captive Portal: Redirects guests to a specified external URL for authentication, disclaimers, or other onboarding processes.

  • Guest Management: Includes local tools on FortiGate to create and distribute temporary guest accounts.

• Virtual Access Point (VAP): FortiGate uses VAPs to deploy multiple SSIDs using existing hardware. VAPs ensure that SSIDs are isolated from one another, allowing administrators complete control over traffic, including specific firewall policies and security profiles for each network.

• Architecture Requirements: FortiGate will only allow access to resources after a valid response is received from the authentication server (local or external).

Guest SSID and Wireless Configuration

• Seamless Hardware Deployment: Separate guest networks do not require additional hardware; FortIAP supports multiple wireless LANs on the same physical device.

• Traffic Control and Security:

  • Tunnel SSIDs: It is recommended to deploy guest networks in tunnel mode. This ensures all traffic is sent to the FortiGate via a CAPWAP data channel.

  • Policy Application: Using tunnel mode ensures FortiGate maintains full control and can apply security profiles to eliminate threats before traffic enters the egress interface.

• SSID Availability: Guest SSIDs should be restricted to physical locations where guest users are expected to be present to optimize resource usage.

• Wireless Performance Warning: You should carefully plan the number of SSIDs being broadcast. An excessive number of SSIDs can negatively impact wireless performance.

Captive Portal Architectural Types

• Primary Functions: The captive portal acts as a landing page for accessing network resources. It is typically used for disclaimers, authentication pages, and presenting terms of use.

• Operational Flow: Access is granted only after a user accepts a disclaimer or successfully authenticates with credentials. Until this occurs, the portal is returned in response to any HTTP request.

• Interface Applicability: Captive portals can be applied to both wired and wireless interfaces.

• Specific Portal Types:

  • Authentication: Prompts users for login credentials (username and password) before granting access.

  • Disclaimer + Authentication: A two-step process where users must first accept a disclaimer and then provide valid credentials.

  • Disclaimer Only: Users are allowed network access immediately after accepting the disclaimer page. This is a local-only feature.

  • Email Collection: Presents a disclaimer and a mandatory field for the user to enter their email address before access is granted.

• Authorization: Captive portals can be configured to allow web access only to members belonging to specific user groups.

Authentication Portal Locations

• Local Portals: The FortiGate built-in portal page is used. All configuration and landing pages are hosted locally on the FortiGate device.

• External Portals: FortiGate redirects users to an external FQDN or IP address. After the user fulfills the external server requirements, FortiGate allows access based on firewall policy.

• Configuration Path: SSID settings are found in WiFi & Switch Controller > SSID or AP Manager > SSIDs in FortiManager.

Security Policies and Traffic Exemption

• Default Deny State: By default, FortiGate blocks all user traffic behind an interface with security mode set to captive portal. HTTP traffic is redirected; all other traffic is dropped.

• Traffic Exemption for External Portals: If using an external portal, traffic to that server MUST be exempted or the user will never reach the login page.

• Two-Step Exemption Process:

  1. Selection: Select destinations and services on the SSID configuration in the "Exempt Destinations" or "Exempted Services" section.

  2. Firewall Policy: Deploy a specific firewall policy via FortiManager on the captive portal interface that leads to the external server.

• Alternative Exemption Method: Create a separate firewall policy to reach the portal server (and supporting services like DNS or Windows AD) and enable the "Exempt from Captive Portal" option.

• Use Cases for Exemption: Useful for devices unable to fulfill HTTP/HTTPS portal conditions, such as printers requiring internet access for firmware upgrades.

• FQDN Requirements: If HTTPS is enforced, the portal address must be an FQDN matching the Common Name (CN) on the certificate used by the FortiGate.

• Authenticated User Policy: A firewall policy from the guest interface to the internet must be created. If a user group is required, it must be the Source User Group. The "Exempt from Captive Portal" option must NOT be enabled for this policy, or the portal will be bypassed.

External Captive Portal Workflow

• Detailed Packet Flow (12 Steps):

  1. Client requests an internet page (HTTP).

  2. FortiGate wireless controller intercepts and redirects to the FortiAuthenticator web login page.

  3. FortiAuthenticator presents the login page.

  4. Client submits credentials.

  5. FortiAuthenticator instructs the browser to POST credentials to FortiGate.

  6. The browser performs an HTTPS POST of login credentials to FortiGate.

  7. FortiGate sends a RADIUS Access-Request to FortiAuthenticator.

  8. FortiAuthenticator validates against a database (Local, LDAP, or RADIUS) and sends an Access-Accept (which may contain attributes like session duration or bandwidth).

  9. FortiGate sends a RADIUS Accounting-Request to verify or establish the session.

  10. FortiAuthenticator sends a RADIUS Accounting-Response after recording the data.

  11. FortiGate redirects the browser to the original requested URL.

  12. Client is allowed access to the internet, and the session countdown begins.

Technical Parameters and HTTPS POST

• HTTPS POST Security: Protects user credentials within an SSL tunnel during the authentication process.

• Default Port Settings:

  • HTTP authentication default port: $1000$.

  • HTTPS authentication default port: $1003$.

• Configurability: These ports are configured on a per-device basis via the CLI or FortiManager (System: Settings). They cannot be used with provisioning templates.

• Authentication Certificates: By default, FortiGate uses a self-signed factory certificate which causes browser warnings. Administrators should install a publicly signed certificate to avoid these warnings. This certificate is distinct from the Wi-Fi certificate used for controller authentication.

• Redirect Parameters: When FortiGate redirects a user, it appends data to the URL. Key parameters include:

  • magic: The Session ID (e.g., $000a038293d1f411$) used to track request info.

  • usermac: The MAC address of the client device.

  • apmac: The MAC address of the Access Point.

  • apip: The IP address of the Access Point.

  • userip: The IP address of the user client.

  • ssid: The name of the Guest SSID.

  • apname: The hostname/serial of the AP.

  • bssid: The BSSID of the radio.

  • device_type: Information on the client device (e.g., windows-pc).

  • post: The specific URL for the browser to submit credentials (e.g., $https://10.0.3.254:1003/fgtauth$).

FortiAuthenticator Guest Portal Capabilities

• Scalability: While the captive portal is available via one URL, FortiAuthenticator uses mapping rules to serve multiple different portals based on incoming criteria.

• Pre-login Services: Available without authentication. Includes account registration, account validation via Email/SMS, social login, disclaimers, and password resets.

• Post-login Services: Offered after authentication. Includes profile updates (name, phone), password changes, token registration (reprovisioning mobile tokens), and downloading Smart Connect profiles.

• Mapping Rules Criteria: Rules can be based on subnet address, AP MAC address, SSID, or AP location.

• Guest User Groups: New users are automatically put into designated groups. The RADIUS attribute sent to FortiGate (the group name) is case-sensitive and must match the FortiGate configuration for proper authorization.

FortiAuthenticator Portal Configuration

• Defining Portals: Portals are created in Authentication > Portals > Portals. Each must have a unique name.

• SMS Gateways: Can be used for activation codes. If no hardware gateway is present, the FortiGuard Messaging Service can be used with a valid license.

• Account Controls:

  • Account Expiry: Validity periods can be set for self-registered accounts.

  • Admin Approval: Requirement for an administrator to manually enable self-registered accounts.

  • Account Validation: Mandatory validation via activation code sent by SMS or Email.

• Portal Policies: Configured via a wizard in Authentication > Portals > Policies. These determine which portal is presented and how the user is authenticated.

• Mapping Rule Operators:

  1. exact_match

  2. substring_match

  3. in_range (Used for IP ranges, e.g., Value: $10.0.3.0/24$ for userip).

• Authorized Clients: Page presentation can be restricted to specific Access Points or RADIUS clients defined in Authentication > RADIUS Service > Clients.

• Identity Sources: Specifies the backend (Local/Remote users) and social platforms (Facebook, Google, Twitter, LinkedIn). Social logins require configured OAuth servers.

Guest User Sponsorship

• Sponsor Role: Administrators or users with the "Sponsor" role can create accounts for visitors so they don't have to self-register.

• Creation Modes:

  • Express: Bulk generates multiple usernames and passwords automatically.

  • From CSV file: Imports users from a prepared file using the format: <first name>, <last name>, <email>, <mobile>, <group>.

  • Manual Input: Requires manual entry of names, addresses, and manually defined credentials.

• Management of Accounts:

  • All self-registered accounts appear on the Local Users page.

  • All sponsored accounts appear on the Guest Users page.

Monitoring and Reporting

• Logging on FortiAuthenticator: Logs all authentication details including username, timestamp, status, IP address, and the specific portal used (Logging > Log Access > Logs).

• Monitoring on FortiGate: Active sessions are viewed in the "Firewall Users" monitor (Dashboard > Users & Devices). This lists:

  • Username

  • User Group

  • Session Duration

  • IP Address