Retail environment guest access
Businesses such as coffee shops provide free Internet access for customers. In this scenario, you do not need to configure guest management, as customers can access the WiFi access point without logon credentials.
However, consider that the business wants to contact customers with promotional offers to encourage future patronage. You can configure an email collection portal to collect customer email addresses for this purpose. You can configure a security policy to grant network access only to users who provide a valid email address. The first time a customer’s device attempts WiFi connection, FortiOS requests an email address, which it validates. The customer’s subsequent connections go directly to the Internet without interruption.
This configuration consists of the following steps:
The customer’s first contact with your network is a captive portal that presents a webpage requesting an email address. When FortiOS has validated the email address, the customer’s device MAC address is added to the Collected Emails device group.
To create an email collection portal using the GUI:
- Go to WiFi & Switch Controller > SSID and edit the SSID.
- From the Security Mode dropdown list, select Captive Portal.
- For Portal Type, select Email Collection.
- (Optional) In Customize Portal Messages, select Email Collection.
To create an email collection portal using the CLI:
This example modifies the
freewifi WiFi interface to present an email collection captive portal.
config wireless-controller vap
set security captive-portal
set portal-type email-collect
You must configure a security policy that allows traffic to flow from the WiFi SSID to the Internet interface but only for members of the Collected Emails device group. This policy must be listed first. Unknown devices are not members of the Collected Emails device group, so they do not match the policy.
To create a security policy using the GUI:
- Go to Policy & Objects > IPv4 Policy and select Create New.
- Configure the policy as follows:
Source Device Type
- Select OK.
To create a security policy using the CLI:
config firewall policy
set srcintf "freewifi"
set dstintf "wan1"
set srcaddr "all"
set action accept
set devices collected-emails
set nat enable
set schedule "always"
set service "ALL"
To check for harvested emails using the GUI:
- Go to User & Device > Device Inventory.
To check for harvested emails using the CLI:
FGT-100D # diagnose user device list
vd 0 d8:d1:cb:ab:61:0f gen 35 req 30 redir 1 last 43634s 7-11_2-int
ip 10.0.2.101 ip6 fe80::dad1:cbff:feab:610f
type 2 'iPhone' src http c 1 gen 29
os 'iPhone' version 'iOS 6.0.1' src http id 358 c 1
vd 0 74:e1:b6:dd:69:f9 gen 36 req 20 redir 0 last 39369s 7-11_2-int
ip 10.0.2.100 ip6 fe80::76e1:b6ff:fedd:69f9
type 1 'iPad' src http c 1 gen 5
os 'iPad' version 'iOS 6.0' src http id 293 c 1
host 'Joes’s-iPad' src dhcp