External Captive portal with Forti OS 5.2

[SumaN1]

Hi Folks,

I am new in this forum and not sure if this is the correct board to post this.

I saw in FortiOS 5.2 release note, that its support external captive portal. Have any one implement this feature with good success.

Need some suggestion on this.

SumaN@boystown

[Marcel_Sueess]

SumaN@boystown wrote:

OK,

My external Captive portal server and and authentication server both are external and hosted by same server. lets say SERVER-1.

So for this scenario guest will get redirect to external page [hosted in SERVER-1] and after that guest will fill up credential field to get access, which will be check against the external server SERVER-1.

So in this case how guest auth req will go to SERVER-1 and what will the protocol for that?

How fortinet will comes to know that the guest has completed authentication?

Hi

who is checking the credentials in your scenario? Does SERVER-1 test your input against a Database? After you filled up your form, you have to post it back to your Fortigate with the following method, mentioned by Jeff: http://FGTIP:1000/fgtauth&magic=<sessionid>&username=<username>&password=<password>. With this data, the fortigate checks the credentials against the different authentication-sources (Radius, local User....). If the credentials are correct, fortigate  authenticates the user (can be seen on the Firewall in the User Monitor) an from now, all policies with the user in it are valid. So the fortigate nows when the authentication is complete because of the fact, that the Fortigate makes the authentication and not the external portal server. External server can hold for example a Radius, but the Radius-Request comes from the Fortigate. So the Portal-Server is only a "GUI" with less logic.

I hope this helps a little bit. I have a picture of the data flow between the different devices from fortinet but I don't know, if I may post it here.

Greets

Marcel

[Nihas]

https://forum.fortinet.com/tm.aspx?m=112063

I too asked the exactly same question before .

How  Fortigate knows whether the authentication has been successfully validated? 

I have done the testing the with one of our user portal ( It uses local MS-SQL Database).

The first part was perfect. When I open a new  browser page I got the external server page for the authentication.

But , even without entering the correct credentials I got the access to surf the internet. Ie, Fortigate doesn't know whether the external portal has successfully validated the credentials or not..!!

It would be great solution if we can successfully integrate the external captive portal.

I can enforce end user to Login to their "Company Portal" to get authenticated to connect the network..!

Thanks

Nihas

[SumaN1]

Waiting  for someone from Foritnet to reply  :)

[SumaN1]

Thanks Marcel Sueess ,

I think I got some idea.

Let me explain my scenario briefly.

1.Fortinet is broadcastin one captive SSID.

2. that SSID is linked to a external page which is stored in SERVER-1.

3.Guest credential is also stored in the same server.

So when guest user connect to the ssid and try to browse something, that user will redirect to that external CP page stored in

SERVER-1,

After that guest user has to give credential on that web page.

In the back end SERVER-1 listen to the credential and checks against local database of itself.

If user pass the authentication, SERVER-1 returns a auth success message to the controller.

If user does not pass the auth then SERVER-1 returns a auth reject message to the controller.

Based on message coming from SERVER-1 frotinet should make discussion on the user [authenticated/ rejected ]

[Marcel_Sueess]

Dear Suman

In your case the problem is, that the external server makes the check of the credential. In this case the only way I know get it to work is, if the external server would send Radius Accounting message to fortigate and fortigate listen to these Radius-Accounting messages. This is known by Fortigate under the name RSSO (Radius Single Sign On). The normal case with the external portal server is, that the Fortigate has to make the credential-check itself.

I could send you the image with the data flow or someone from Fortinet gives me the right to post the image from a Fortinet presentation from Eric Moque about "External L3 captive Portal".

[SumaN1]

You can upload the flow in google drive or box and share the link with me.

It will be great if you do .

Thanks

[yassine]

Hello

i cant access to my external captive portal , in my case http://192.168.11.20/auth/register ( Authentification ) ..

i have create a policy to allow access from all to this address ( 192.168.11.20) but didnt work.

the ( exempt list ) option ,  is to allow full access for users or addresses not to allow only access for my fortiauthenticator without authentification .

[yassine]

Hello i cant access to my external captive portal , in my case http://192.168.11.20/auth/register ( FortiAuthenticator ) .. i have create a policy to allow access from all to this address ( 192.168.11.20) but didnt work. the ( exempt list ) option ,  is to allow full access for users or addresses not to allow only access for my fortiauthenticator without authentification .

[jescobar]

Hi Im configuring a Fortigate100D with an external captive portal and external Radius server (test connection successful).

Currently the users are been redirect to the external captive portal, but I’m having troubles to receive the users and password information back to the fortigate to them authenticate it with the radius.  

I found the information is sending via:   https://<FGT_IP>:1000/fgtauth with data magic=session_id&username=<username>&password=<password>. But I can’t receive the info.

I have tried to access different ways the port 1000 and 1003, and via the browser  to the fortigate  with no connection ( https://192.168.1.2:1000/fgtauth orhttps://192.168.1.2:1003/fgtauth)  

Does anyone know how to open this ports on the fortigate or how to debug the connections of the captive portal users? I have already set auth-keepalive enable  with no result

Thank you

[Marcel_Sueess]

Hi

I'm also testing with the external captive portal and it is working for me. I didn't open any port on the fortigate and didn't set any special configuration. On my Fortigate (VM 5.4.4) it is working after I've activated the captive portal on an interface. As far as I saw, the initial received magic session id is only valid for one POST-request and a response from the Firewall is only sent, if the magic id is valid. If you try with an invalid magic id, you wouldn't get any response.

Greets

Marcel