Configuring a captive portal policy on FortiAuthenticator

To configure an allow access captive portal policy:

1. Go to Authentication > Portals > Policies, click Captive Portal and Create New.
2. In the Policy type tab:
   1. Enter a name for the policy. Optionally, enter a description for the policy.
   2. In Type, select Allow captive portal access. Copy the URL and store it on Notepad. The URL needs to be entered in the FortiGate configuration later.
   3. Choose a portal created in Creating a guest portal on FortiAuthenticator.
   4. Click Next.

      

3. In the Portal selection criteria tab:
1. In the HTTP parameter dropdown, select ssid to match.
2. In the Operator dropdown, select [string]exact_match.
3. In Value, enter the name of the interface configured on the FortiGate with captive portal authentication required. Here, Guest-Wired.
4. Click Next.



4. In the Authorized clients tab:
   1. From Access points, select the access point defined in Access points.
   2. From RADIUS clients, select the FortiGate RADIUS client defined in RADIUS clients.
   3. Click Next.

      

5. In the Authentication type tab, select Password/OTP authentication, then enable Local/remote user to verify credentials against one of the local or remote user accounts, and click Next.

   

6. In the Identity sources tab:
   1. For Username format, select username@realm.
   2. For Realms, select local realm. Optionally, enable Filter, click the pen icon, and from Available User Groups, move the group created in User Group to Chosen User Groups.
   3. Click Next.

      

7. In the Authentication Factors tab, click Next.
8. In the RADIUS response tab, review the policy, and click Save and exit.