Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Zeihold_von_SSL
New Contributor

Captive Portal redirection

Hello everybody, I have a question and hope you can help me. I have set up a captive portal and everythings works fine like I planned it. But there is one issue I ran into, that I didn' t plan with. If the traffic which triggers the captive portal is https traffic, then we get a certificate warning. Let me explain this: 1) I join the captive portal based wlan 2) I open a browser and surf to https://www.google.com 3) I get a certificate warning in the webbrowser 4) If I ignore this warning I' am redirected to the captive portal 5) If I authenticate myself with correct credentials I will be redirected to the original website. The thing is, that I want to get rid of the certificate warning. I found this little config switch wich allows me to choose the certificate I want to use: config user setting set auth-cert xxx end I tried it with our official thawte certificate but that didn' t help. So I tried some other certificates (but this will only help our employees and not other guests) but this didn' t work either. And then I found this page: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30760&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38506158&stateId=0 This was nearly the situation that I have. So I tried this setting, because this could be a win win situation (it could solve my problem and could help to increase the security level of my guest wlan). config user setting set auth-secure-http enable end Sadly, I now get redirected to the gateway IP and STILL get a certificate warning (cause there is no matching certificate which includes the gateway ip). So I' am stuck here. Cause I can' t use this setting: config firewall policy edit <my_policy_ID> set auth-redirect-addr " my.fortigate.com" next end This is because we use address based policies and no identity based policies. So I' am searching for another way to get rid of the certificate warning for _all_ users. Is there anyone who might help me?

Regards Rene ---

[size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size]

Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B

Regards Rene --- [size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size] Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
1 Solution
flex10

Here's the solution provided by FortiNet-Support, successfully tested on my FGT 500D with FortiOS 5.4.4:

 

- set a publicly trusted SSL-certificate under "User & Device" -> "Authentication Settings" which includes the common-name you wish to use (for example: captive.domain.com)

- create a public DNS-entry "captive.domain.com" which points to the internal IP of your captive portal.

- go to the CLI and enter the commands below:

# config firewall auth-portal

# set portal-addr captive.domain.com

# end

 

Now users will be redirected to https://captive.domain.com:1003 without any ssl-errors 

View solution in original post

21 REPLIES 21
Bromont_FTNT
Staff
Staff

The problem here is that your browser is expecting a secure connection to https://www.google.com so will only work with a certificate that displays CN=www.google.com or CN=*.google.com and also signed by a CA your browser trusts. When I connect to captive portals when travelling I have to remember to open and HTTP only page first in order to get through the disclaimer, otherwise most of the time my browser times out. If another vendor has found a solution for this I' d be interested to see how they got around this problem.
Zeihold_von_SSL
New Contributor

You are totally right, and the fortigate does EXACTLY that with its certificate (man in the middle attack). It generates a certificate for https://*.google.com. I think it is the same procedure as with deep packet inspection. Cause we use deep packet inspection, we have already deployed severeal Fortinet certificates on our company machines. But these clients STILL gets the certificate warning!

Regards Rene ---

[size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size]

Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B

Regards Rene --- [size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size] Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
Bromont_FTNT
Staff
Staff

When you get the certificate warning take a look at the presented certificate... Does it have the expected website in the CN field or is it the FGT serial number etc.?
Zeihold_von_SSL
New Contributor

Wow, I have overlooked that little detail. I was wrong, it does NOT generate a new certificate on each https request (like it happens when you use deep packet inspection). It presents a static certificate (depending on which certificate you have configured) and that is why we still get this error message. So it is impossible to get rid of this message unless I don' t use the redirection feature (which needs identity based firewall policies instead of address based firewall policies). Fu**... So either I have to switch from address to identity based policies (which is not my preffered solution) or Fortinet have to expand the " set auth-redirect-addr " my.fortigate.com" " feature to address based policies. Thanks for waking me up. ;)

Regards Rene ---

[size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size]

Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B

Regards Rene --- [size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size] Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
Bromont_FTNT
Staff
Staff

Even if the FGT rewrote the certificate so the CN field matches what the browser expects this wouldn' t help guest users that don' t have the trusted root installed... For corporate users I wouldn' t use anything but WPA2 enterprise for wireless security. The new Dynamic VLAN feature makes placing users into different vlans based on group membership very easy
Zeihold_von_SSL
New Contributor

No, that is not what I ment... I was more thinking about this solution: 1) I try to access https://www.google.de 2) The Fortigate redirects me to a captive portal page like https://my.fortigate.com for which I have a certificate signed by a public CA 3) If I' am authenticated successfully the Fortigate redirects me back to the page I originally wanted to access and presents me their certificate. I think this should work! But the thing is, that I only can specify a fqdn to redirect to if I use identity based policies.

Regards Rene ---

[size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size]

Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B

Regards Rene --- [size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size] Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
Bromont_FTNT
Staff
Staff

Right, however initially the Fortigate would need to rewrite the certificate to match the expected website, then it could re-direct to my.fortigate.com
Zeihold_von_SSL
New Contributor

Damn, you are right. So there is no solution to that particullar problem. Am I right?

Regards Rene ---

[size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size]

Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B

Regards Rene --- [size="1"]FCNSA.v5, FCNSP.v5, FCESP[/size] Home: FWF60D FortiAP 220B Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
Bromont_FTNT
Staff
Staff

None I know of...
Labels
Top Kudoed Authors