Provision the Onboarding and Secure WiFi networks

To provision the Smart Connect enabled "Onboarding" SSID:

1. Go to Wi-Fi & Switch Controller > SSID, and click Create New.
2. Under Create New SSID, set the following:
   1. Profile name: Enter a name for the profile, for example Onboarding.
   2. Traffic mode: Tunnel.
3. Under Address, set the following:
   1. IP/Netmask: Enter the interface IP address for the Onboarding SSID.
4. Under DHCP Server, enable the DHCP Server setting and set the following:
   1. Leave Address range, Netmask, Gateway, and Lease time in their default states.
   2. DNS server: Select Same as Interface IP or specify a local DNS server that can resolve your FortiAuthenticator FQDN. If you are using the DNS database on FortiGate, select Same as Interface IP.
      
5. Under Network, leave the Decide detection setting enabled.
6. Under WiFi Settings, set the following:
   1. SSID: Enter the SSID, for example Onboarding.
   2. Security mode: Captive Portal.
   3. Portal type: Authentication.
   4. Authentication portal: Select External, and enter the FortiAuthenticator Smart Connect portal redirection URL obtained when configuring Smart Connect on FortiAuthenticator.
   5. User groups: Select the previously configured user group, for example Onboarding.
   6. Exempt destinations/services: Select FortiAuthenticator.
   7. Leave all other settings as their default state.
      
7. Click OK.
   

To provision the "Secure Wi-Fi" network:

1. Go to WiFi & Switch Controller > SSID, and click Create New.
2. Configure the following settings:
   1. Profile name: Enter a profile name, for example Secure Wi-Fi.
   2. Traffic mode: Bridge.
   3. SSID: Enter the SSID name, for example Secure Wi-Fi.
   4. Security mode: WPA2 Enterprise.
   5. Authentication: Choose RADIUS Server, and select the FortiAuthenticator.
   6. Optional VLAN ID: This setting is optional and can be configured if WiFi traffic needs to be tagged by the AP to a VLAN configured on your local switch. Dynamic VLAN assignment is also supported.
      
3. Click OK.
   

To assign SSIDs to FortiAP profiles:

1. Go to WiFi & Switch Controller > FortiAP Profiles.
2. Select the relevant AP profile(s) and assign the previously created SSIDs (Onboarding and Secure Wi-Fi) to the AP radio interfaces.
3. Confirm the SSIDs are broadcasting and can be seen by WiFi enabled devices.
   
4. Click OK.
   

To create a new FortiAuthenticator object to use with firewall policies:

1. Go to Policy & Objects > Addresses, and click Create New > Address.
2. Configure the following settings:
   1. Name: Enter a name, for example FAC.
   2. Type: Subnet.
   3. IP/Netmask: The FortiAuthenticator IP address.
   4. Interface: any.
      
3. Click OK.

To create a firewall policy for the Onboarding SSID:

1. Go to Policy & Objects > Firewall Policy, and click Create New.
2. On the New Policy page, set the following:
   1. Name: Enter a name, for example Onboarding Policy.
   2. Incoming Interface: Select the Onboarding SSID.
   3. Outgoing Interface: Select the Management VLAN.
   4. Source: Select all or the Onboarding address subnet range.
   5. Destination: Select FortiAuthenticator and the DNS server if you are using a third party DNS server.
   6. Service: DNS, HTTP, and HTTPS.
   7. Under Advanced, enable the Exempt from Captive Portal option.
      When using a FortiOS version earlier than 6.4.1, you can enable this setting in the CLI with the command set captive-portal-exempt enable.
      
3. Click OK.