Configuring wildcard address in captive portal walled garden

This topic describes how to add and apply wildcard domain names to the walled garden of captive-portal SSID.

Captive portal SSID supports the walled garden function where WiFi clients can access preconfigured hostnames and addresses that are exempted from portal authentication.

You can configure FQDN entries using wildcard domain names, for example, *.google.*, *.facebook.com, and so on, so that one entry can have multiple matches.

Sample topology

This example uses the wildcard address feature in the following ways:

• A tunnel mode captive portal works with the third-party cloud based portal server cloud4wi.com.
• Connected wireless clients can access Facebook and Google websites directly even before firewall authentication via FortiGate.
• Connected wireless clients opens the portal page of cloud4wi.com and can access other Internet resources as soon as they pass authentication by FortiGate.

Sample configuration

To create the wildcard FQDN address - GUI:

1. Go to Policy & Objects > Addresses and click Create New > Address.
2. In the New Address page, enter the address Name, for example, facebook and google.
3. For Type, select FQDN.
4. For FQDN, enter a wildcard FQDN name, for example *.facebook.com and *.google.*.
5. Click OK.

This wildcard FQDN type firewall address is different from entries in Policy & Objects > Wildcard FQDN Addresses that cannot be used directly in firewall policy source or destination addresses.

To create a third-party cloud portal server address - GUI:

1. Go to Policy & Objects > Addresses and click Create New > Address.
2. In the New Address page, enter the address Name, for example, cloud-portal.
3. For Type, select FQDN.
4. For FQDN, enter the FQDN name, for example, cloud4wi.com.
5. Click OK.

To create a captive portal VAP with the third-party cloud portal server - GUI:

1. Go to WiFi Controller > SSID and select Create New > SSID.
2. For Traffic Mode, select Tunnel.
3. In the Address section, enter the IP/Network Mask, for example, 10.10.80.1/24.
4. Optionally, you can change the DHCP Address Range in the DHCP Server section.
5. In the WiFi Settings section:
   1. Enter the SSID name, for example, Fortinet-Captive.

   2. For Security Mode, select a Security mode.

      Note: Captive Portal is not supported for WPA/WPA2-Enterprise or WPA3-Enterprise Security modes.

   3. Enable Captive Portal.
   4. For Portal Type, select Authentication.
   5. For Authentication Portal, select External and enter cloud4wi.com.
   6. Click User Groups and select the created user group, for example, group-local; or click Create to create a new user group.
6. Click OK.

To support a third-party cloud portal, use one of the following methods.

To support a third-party cloud portal using Exempt Destinations/Services - GUI:

1. Go to WiFi Controller > SSID.
2. Select the SSID you created, for example, Fortinet-Captive and click Edit.
3. In the WiFi Settings section, click Exempt Destinations/Services.
4. In the Select Entries pane Address list, select the wildcard FQDN addresses, for example, facebook and google, and the cloud portal address, for example, cloud-portal.
5. Still in the Select Entries pane, click Service and select HTTP, HTTPS, and DNS.
6. Click OK.

To support a third-party cloud portal using firewall policy - GUI:

1. Go to Policy & Objects > Firewall Policy and click Create New.
2. Enter the Name, for example, Exempt Service.
3. Click Incoming Interface and select wifi-vap.
4. Click Outgoing Interface and select wan1.
5. Click Source and select all.
6. Click Destination and select the wildcard FQDN addresses, for example, facebook and google, and the cloud portal address, for example, cloud-portal.
7. Click Service and select HTTP, HTTPS, and DNS.
8. Click OK.
9. Use CLI commands to enable captive-portal-exempt. In this example, the policy_id is 2.

   config firewall policy
     edit 2
         set captive-portal-exempt enable
     next
   end

To create the wildcard FQDN address - CLI:

config firewall address
   edit "facebook"
     set type fqdn
     set fqdn "*.facebook.com"  <-- New support for "*" in fqdn address 
   next
   edit "google"
     set type fqdn
     set fqdn "*.google.*"      <-- New support for "*" in fqdn address 
   next
end

To create a third-party cloud portal server address - CLI:

config firewall address
   edit "cloud-portal"
     set type fqdn
     set fqdn "cloud4wi.com"
   next
end

To create a tunnel mode captive portal VAP with the third-party cloud portal server - CLI:

config wireless-controller vap
    edit "wifi-vap"
        set ssid "Fortinet-Captive"
        set security wpa3-sae
        set captive-portal enable
        set external-web "cloud4wi.com"
        set selected-usergroups "group-local"
        set intra-vap-privacy enable
    next
end

To create security-exempt-list and select it in vap - CLI:

config user security-exempt-list
    edit "wifi-vap-exempt-list"
        config rule
            edit 1
                set dstaddr "facebook" "google" "cloud-portal"
                set service "HTTP" "HTTPS" "DNS"
            next
        end
end
config wireless-controller vap
    edit "wifi-vap"
        set security-exempt-list "wifi-vap-exempt-list"
    next
end

To create a captive-portal-exempt firewall policy and move it before the regular outgoing policy - CLI:

config firewall policy
    edit 2
        set name "Exempt Service"
        set srcintf "wifi-vap"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "cloud-portal" "facebook" "google"
        set action accept
        set schedule "always"
        set service "DNS" "HTTP" "HTTPS"
        set captive-portal-exempt enable
        set nat enable
    next
    edit 1
        set name "outgoing"
        set srcintf "wifi-vap"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    move 2 before 1
end

Although destination-hostname-visibility is enabled by default, ensure this setting is enabled so that FQDN addresses can be resolved.

To enable destination-hostname-visibility

config system network-visibility
    set destination-hostname-visibility enable
end