User self-registration of MPSKs through FortiGuest

You can enable users to generate Multi Pre-Shared Keys (MPSK) through the FortiGuest self-registration portal. Users can self-register their devices through the portal, receiving a unique pre-shared key (MPSK) bound to their device's MAC address. When they connect to the SSID, FortiGate sends the client's passphrase and MAC address to FortiGuest during the 4-way handshake. Based the FortiGuest response, FortiGate authenticates or de-authenticates the client.

Example Topology

To configure a FortiGuest external MPSK server - GUI:

1. Go to System > Feature Visibility and enable Advanced Wireless Features.
2. Click Apply.

3. Go to WiFi & Switch Controller > Connectivity Profiles > MPSK Profiles and click Create new to create an MPSK profile.

4. Enter an MPSK profile Name and select a security Type.

5. Enable MPSK external server authentication and select an MPSK external server.

   

6. When you are finished, click OK.

To configure a FortiGuest external MPSK server - GUI:

1. Create an external FortiGuest server.

   config user radius
     edit "fortiguest"
       set server "172.16.200.117"
       set secret ENC *
     next
   end

2. Create an MPSK profile, enable MPSK external server authentication, and apply the external server you created.

   config wireless-controller mpsk-profile
     edit "wifi"
       set mpsk-external-server-auth enableset mpsk-external-server "fortiguest"
     next
   end

3. Apply the MPSK profile to a VAP.

   config wireless-controller vap
     edit "wifi"
       set ssid "FOS_81F_POE_MPSK"
       set schedule "always"
       set mpsk-profile "wifi"
       set dynamic-vlan enable
       set quarantine disable
     next
   end

To verify external MPSK authentication:

1. Using a wireless client, create a key in the FortiGuest self-registration portal.

   

   • The MAC address of the device is 54:27:1E:B7:4A:95.
   • The PSK key is 12345678.

2. Verify that you can connect the wireless client to the SSID using the configured PSK key of 12345678.

   # dia wireless-controller wlac -d sta online
      vf=0 mpId=0 wtp=4 rId=1 wlan=wifi vlan_id=0 ip=192.168.1.110 ip6=fe80::dc46:a41f:5546:f07f mac=54:27:1e:b7:4a:95 vci=MSFT 5.0 host=DESKTOP-05HBKE1 user= group= signal=-70 noise=-95 idle=1 bw=0 use=5 chan=11 radio_type=11N security=wpa2_only_personal mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=1
                   ip6=*fe80::dc46:a41f:5546:f07f,26,

3. Check the WiFi event log and verify there is a log with the action as EXT-MPSK-auth-success, indicating that the 4-way handshake is successful.

   # exe log display
   date=2024-03-13 time=09:02:06 eventtime=1710345725686198360 tz="-0700" logid="0104043657" type="event" subtype="wireless" level="notice" vd="root" logdesc="Wireless station association failed" sn="FP433GTY22001147" ap="FP433GTY22001147" vap="wifi" ssid="FOS_QA_Starr_81F_3G_psk" radioid=1 user="N/A" stamac="54:27:1e:b7:4a:95" signal=-45 snr=50 authserver="N/A" channel=11 security="WPA2 Personal" encryption="AES" action="EXT-MPSK-auth-success" reason="Reserved 0" msg="External MPSK authentication was successful for client 54:27:1e:b7:4a:95"