Helpful ReplyHot!Captive Portal redirection

Page: 12 > Showing page 1 of 2
Author
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
2013/10/16 01:57:07 (permalink)
0

Captive Portal redirection

Hello everybody,

I have a question and hope you can help me.

I have set up a captive portal and everythings works fine like I planned it.

But there is one issue I ran into, that I didn' t plan with.

If the traffic which triggers the captive portal is https traffic, then we get a certificate warning.

Let me explain this:

1) I join the captive portal based wlan
2) I open a browser and surf to https://www.google.com
3) I get a certificate warning in the webbrowser
4) If I ignore this warning I' am redirected to the captive portal
5) If I authenticate myself with correct credentials I will be redirected to the original website.

The thing is, that I want to get rid of the certificate warning.

I found this little config switch wich allows me to choose the certificate I want to use:

config user setting
set auth-cert xxx
end

I tried it with our official thawte certificate but that didn' t help. So I tried some other certificates (but this will only help our employees and not other guests) but this didn' t work either.

And then I found this page:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30760&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=38506158&stateId=0

This was nearly the situation that I have.

So I tried this setting, because this could be a win win situation (it could solve my problem and could help to increase the security level of my guest wlan).

config user setting
set auth-secure-http enable
end

Sadly, I now get redirected to the gateway IP and STILL get a certificate warning (cause there is no matching certificate which includes the gateway ip).

So I' am stuck here. Cause I can' t use this setting:

config firewall policy
edit <my_policy_ID>
set auth-redirect-addr " my.fortigate.com"
next
end

This is because we use address based policies and no identity based policies.

So I' am searching for another way to get rid of the certificate warning for _all_ users.

Is there anyone who might help me?

< Message edited by Zeihold_von_SSL -- 10/16/2013 5:39:25 AM >

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#1
Bromont_FTNT
Platinum Member
  • Total Posts : 557
  • Scores: 43
  • Reward points: 0
  • Joined: 2012/11/19 07:22:36
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:13:01 (permalink)
0
The problem here is that your browser is expecting a secure connection to https://www.google.com so will only work with a certificate that displays CN=www.google.com or CN=*.google.com and also signed by a CA your browser trusts.

When I connect to captive portals when travelling I have to remember to open and HTTP only page first in order to get through the disclaimer, otherwise most of the time my browser times out.

If another vendor has found a solution for this I' d be interested to see how they got around this problem.
#2
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:16:53 (permalink)
0
You are totally right, and the fortigate does EXACTLY that with its certificate (man in the middle attack). It generates a certificate for https://*.google.com. I think it is the same procedure as with deep packet inspection.

Cause we use deep packet inspection, we have already deployed severeal Fortinet certificates on our company machines.

But these clients STILL gets the certificate warning!
< Message edited by Zeihold_von_SSL -- 10/16/2013 5:18:16 AM >

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#3
Bromont_FTNT
Platinum Member
  • Total Posts : 557
  • Scores: 43
  • Reward points: 0
  • Joined: 2012/11/19 07:22:36
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:21:24 (permalink)
0
When you get the certificate warning take a look at the presented certificate... Does it have the expected website in the CN field or is it the FGT serial number etc.?
#4
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:38:37 (permalink)
0
Wow, I have overlooked that little detail.

I was wrong, it does NOT generate a new certificate on each https request (like it happens when you use deep packet inspection). It presents a static certificate (depending on which certificate you have configured) and that is why we still get this error message.

So it is impossible to get rid of this message unless I don' t use the redirection feature (which needs identity based firewall policies instead of address based firewall policies).

Fu**...

So either I have to switch from address to identity based policies (which is not my preffered solution) or Fortinet have to expand the " set auth-redirect-addr " my.fortigate.com" " feature to address based policies.

Thanks for waking me up. ;)

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#5
Bromont_FTNT
Platinum Member
  • Total Posts : 557
  • Scores: 43
  • Reward points: 0
  • Joined: 2012/11/19 07:22:36
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:50:35 (permalink)
0
Even if the FGT rewrote the certificate so the CN field matches what the browser expects this wouldn' t help guest users that don' t have the trusted root installed...

For corporate users I wouldn' t use anything but WPA2 enterprise for wireless security. The new Dynamic VLAN feature makes placing users into different vlans based on group membership very easy
#6
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
RE: Captive Portal redirection 2013/10/16 05:57:42 (permalink)
0
No, that is not what I ment...

I was more thinking about this solution:

1) I try to access https://www.google.de
2) The Fortigate redirects me to a captive portal page like https://my.fortigate.com for which I have a certificate signed by a public CA
3) If I' am authenticated successfully the Fortigate redirects me back to the page I originally wanted to access and presents me their certificate.

I think this should work!

But the thing is, that I only can specify a fqdn to redirect to if I use identity based policies.
< Message edited by Zeihold_von_SSL -- 10/16/2013 5:58:36 AM >

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#7
Bromont_FTNT
Platinum Member
  • Total Posts : 557
  • Scores: 43
  • Reward points: 0
  • Joined: 2012/11/19 07:22:36
  • Status: offline
RE: Captive Portal redirection 2013/10/16 06:02:22 (permalink)
0
Right, however initially the Fortigate would need to rewrite the certificate to match the expected website, then it could re-direct to my.fortigate.com
#8
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
RE: Captive Portal redirection 2013/10/16 06:05:15 (permalink)
0
Damn, you are right. So there is no solution to that particullar problem. Am I right?

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#9
Bromont_FTNT
Platinum Member
  • Total Posts : 557
  • Scores: 43
  • Reward points: 0
  • Joined: 2012/11/19 07:22:36
  • Status: offline
RE: Captive Portal redirection 2013/10/16 06:29:18 (permalink)
0
None I know of...
#10
Zeihold_von_SSL
Silver Member
  • Total Posts : 99
  • Scores: 0
  • Reward points: 0
  • Joined: 2012/03/21 02:49:44
  • Location: Frankfurt, Germany
  • Status: offline
RE: Captive Portal redirection 2013/11/02 02:39:45 (permalink)
0
Okay, I have upgraded to OS 5.0.5 last night and it seems that Fortinet have implemented a (dirty) workaround.

I have tried (with Google Chrome so far) to open https://www.google.de.

I see an SSL error message but then a second browser tab pops up. In this tab the browser is trying to reach http://www.gstatic/<some_error_page> and shows the captive portal website.

After I have authenticated myself using the captive portal both tabs are redirected to the original url.

I have so test this with several other browsers and OS versions but for now it seems to work (for me).

Regards
Rene
---
FCNSA.v5, FCNSP.v5, FCESP
Home: FWF60D FortiAP 220B
Office: FWF60C, FWF60D, FGT110C, FGT200B, FortiManager, FortiAnalyzer, FortiAP 220B
#11
andrelhj
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/07/22 07:45:07
  • Status: offline
Re: Captive Portal redirection 2015/02/02 07:34:50 (permalink)
0
Hello,

I had a similar problem. I enabled secure authentication (HTTPS) through LDAP, to access a URL, for example: url.domain.com, the browser displays the alert invalid certificate.

The problem was solved by buying a certificate for the sub-domain: url.domain.com. You can buy a wildcard certificate (* .domain.com) and can be installed on multiple servers. You will receive an SSL certificate and the intermediate certificate. You have up to seven days to test and return the money in case of failure.

The steps were as follows:

1) System> Certificates> Local Certificates, I generate a new certificate.

2) Send the CSR generated certificate to the vendor.

3) It will return an SSL certificate and intermediate certificates.

4) Install the intermediate certificate in System> Certificates> CA Certificates.

5) Install the SSL certificate in System> Certificates> Local Certificates.

6) Use the options "auth-cert" and "auth-redirect-addr" in the firewall policy:
config firewall policy
    edit <policyID>
    set auth-cert CustomCert
    set auth-redirect-addr url.domain.com
end

It worked for my case and I hope it helps somebody else.

I'm using the FortiOS version 5.2.2.

URL for reference:
I can not tell what implications this type of configuration has security and what are the safe use of recommendations for certificates. Welcome to contribute.
 
Not knowing it was impossible He Dit It.

#12
Bernard Pauwels
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/06/22 05:47:54
  • Status: offline
Re: Captive Portal redirection 2017/04/27 05:39:28 (permalink)
0
Since HSTS this is not only a warning anymore but full blocking of the access. The workaround now is to first surf to a HTTP website, to avoid the HTTPS to be activated, where Chrome would detect that it is not the original certificate.
 
With Chrome on a Windows PC, just typing "badidea" stops the HSTS from blocking further action. However I could not start this "badidea" on a smartphone.
#13
dbert84
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/02/01 07:40:31
  • Status: offline
Re: Captive Portal redirection 2017/05/25 17:40:35 (permalink)
0
I think we need a real solution to this, provided by Fortinet
 
No normal user will know to browse to a http site to bypass this issue without training, they will just come to us and say 'it doesn't work!'
 
Also its getting harder and hard to find a website that isn't redirected to https anyway, more than 50% of the web is HTTPS now - google is 77% https traffic
#14
lpiris
New Member
  • Total Posts : 19
  • Scores: 0
  • Reward points: 0
  • Joined: 2011/08/09 19:55:13
  • Status: offline
Re: Captive Portal redirection 2017/06/30 12:00:09 (permalink)
0
I totally agree with dbert84, we need a solution provided by Fortinet, simply saying to access an HTTP site first is not solution.
I have a case exactly like this and the engineer's recommendation was this.
#15
flex10
New Member
  • Total Posts : 1
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/07/06 05:01:00
  • Status: offline
Re: Captive Portal redirection 2017/07/06 05:52:20 (permalink) ☄ Helpfulby Thomas Brittain 2017/09/01 09:34:25
5 (1)
Here's the solution provided by FortiNet-Support, successfully tested on my FGT 500D with FortiOS 5.4.4:
 
- set a publicly trusted SSL-certificate under "User & Device" -> "Authentication Settings" which includes the common-name you wish to use (for example: captive.domain.com)
- create a public DNS-entry "captive.domain.com" which points to the internal IP of your captive portal.
- go to the CLI and enter the commands below:
# config firewall auth-portal
# set portal-addr captive.domain.com
# end
 
Now users will be redirected to https://captive.domain.com:1003 without any ssl-errors 
#16
Baptiste
Gold Member
  • Total Posts : 141
  • Scores: 13
  • Reward points: 0
  • Status: offline
Re: Captive Portal redirection 2017/08/30 01:40:50 (permalink)
0
Hi 
this works well with only one subnet/interface
I want to use captive portal and redirection for LAN & Wifi (mode tunnel) on differents subnets.
 
I tried this
config firewall policy
edit
set auth-cert CustomCert
set auth-redirect-addr url.domain.com
end


but I'm still redirect to the one set here :
config firewall auth-portal
set portal-addr captive.domain.comend

 
Edit :
If I unset global auth portal :
config firewall auth-portal
unset portal-addr

each subnet is redirect to FGT IP interface, not to FQDN.
 
Test on 100D running 5.2.10
post edited by Baptiste - 2017/08/30 03:55:24

FGT 100D 5.4.8 + FTK200
FGT 60E 5.6.3 & 6.0.0
FGT 40C 5.0.13
FAZ VM 6.0.0
FAP 210B/221C/223C/321C/421E
#17
Baptiste
Gold Member
  • Total Posts : 141
  • Scores: 13
  • Reward points: 0
  • Status: offline
Re: Captive Portal redirection 2017/08/31 01:29:55 (permalink)
0
I got an answer by TAC :
 
Please note that these are two different and separate authentication methods.

Captive portal takes precedence over any other authentication, therefore captive portal authentication is done first.

Captive portal has two "modes":
- Internal captive portal (hosted directly on the FortiGate)
- External captive portal (redirect to external website => external website gathers login details of users and sends them back to FortiGate to verify)

The internal captive portal uses either the interface's IP (default), or the FQDN configured in "config firewall auth-portal".

=> This is why you see the user traffic being redirected to "captive.domain.com" or the interface IP.


Authentication redirection in a policy is only triggered when traffic matches this policy and authentication is needed.
At that point, redirection to the URL specified in "auth-redirect-addr" happens.


I hope that clarifies the situation.
I would recommend to keep either the interface-captive portal, or the policy authentication-redirect, and remove the other.
(if you want the FortiGate to redirect to the URL specified in the policy, make sure to remove the captive portal from the interface)

 
So I remove captive portal mode from interface, set auth-redirect on each policy, create dns entry for each
 
 
it's working for both LAN & Wifi without any certificate warning (I bought a multi-domain certificate)
 
 

FGT 100D 5.4.8 + FTK200
FGT 60E 5.6.3 & 6.0.0
FGT 40C 5.0.13
FAZ VM 6.0.0
FAP 210B/221C/223C/321C/421E
#18
Mazino
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/01/10 21:08:33
  • Status: offline
Re: Captive Portal redirection 2018/01/10 21:15:41 (permalink)
0
Baptiste
I got an answer by TAC :
 
Please note that these are two different and separate authentication methods.

Captive portal takes precedence over any other authentication, therefore captive portal authentication is done first.

Captive portal has two "modes":
- Internal captive portal (hosted directly on the FortiGate)
- External captive portal (redirect to external website => external website gathers login details of users and sends them back to FortiGate to verify)

The internal captive portal uses either the interface's IP (default), or the FQDN configured in "config firewall auth-portal".

=> This is why you see the user traffic being redirected to "captive.domain.com" or the interface IP.


Authentication redirection in a policy is only triggered when traffic matches this policy and authentication is needed.
At that point, redirection to the URL specified in "auth-redirect-addr" happens.


I hope that clarifies the situation.
I would recommend to keep either the interface-captive portal, or the policy authentication-redirect, and remove the other.
(if you want the FortiGate to redirect to the URL specified in the policy, make sure to remove the captive portal from the interface)

 
So I remove captive portal mode from interface, set auth-redirect on each policy, create dns entry for each
 
 
it's working for both LAN & Wifi without any certificate warning (I bought a multi-domain certificate)
 
 


 
 
 
Hi Baptiste,

When you said you test it using WiFi, is it using Mobile Browser or Laptop Browser?
Because I'm having the same problem, but the certificate issue only occurs using Mobile browsers. When I tried to access the SSID with Captive Portal using Laptop, the certificate issue doesn't occurs and it redirects me straight to the Captive Portal. But when I tried to connect to the SSID using Mobile device, I got an certificate issue before I got into the Captive Portal.

Any thought guys?

Regards
#19
nero.kira
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/12/26 05:51:47
  • Status: offline
Re: Captive Portal redirection 2018/01/18 04:00:39 (permalink)
0
hello everyone i have a client who wants to add a video in the portal captive unsing fortipresence is it possible to do it
thanks
#20
Page: 12 > Showing page 1 of 2
Jump to:
© 2018 APG vNext Commercial Version 5.5