Retail environment guest access

Businesses such as coffee shops provide free Internet access for customers. In this scenario, you do not need to configure guest management, as customers can access the WiFi access point without logon credentials.

However, consider that the business wants to contact customers with promotional offers to encourage future patronage. You can configure an email collection portal to collect customer email addresses for this purpose. You can configure a security policy to grant network access only to users who provide a valid email address. The first time a customer’s device attempts WiFi connection, FortiOS requests an email address, which it validates. The customer’s subsequent connections go directly to the Internet without interruption.

This configuration consists of the following steps:

  1. Create an email collection portal.
  2. Create a security policy.
  3. Check for harvested emails.

Creating an email collection portal

The customer’s first contact with your network is a captive portal that presents a webpage requesting an email address. When FortiOS has validated the email address, the customer’s device MAC address is added to the Collected Emails device group.

To create an email collection portal using the GUI:
  1. Go to WiFi & Switch Controller > SSID and edit the SSID.
  2. From the Security Mode dropdown list, select Captive Portal.
  3. For Portal Type, select Email Collection.
  4. (Optional) In Customize Portal Messages, select Email Collection.
To create an email collection portal using the CLI:

This example modifies the freewifi WiFi interface to present an email collection captive portal.

config wireless-controller vap

edit freewifi

set security captive-portal

set portal-type email-collect


Creating a security policy

You must configure a security policy that allows traffic to flow from the WiFi SSID to the Internet interface but only for members of the Collected Emails device group. This policy must be listed first. Unknown devices are not members of the Collected Emails device group, so they do not match the policy.

To create a security policy using the GUI:
  1. Go to Policy & Objects > IPv4 Policy and select Create New.
  2. Configure the policy as follows:

    Incoming Interface


    Source Address


    Source Device Type

    Collected Emails

    Outgoing Interface


    Destination Address










  3. Select OK.
To create a security policy using the CLI:

config firewall policy

edit 3

set srcintf "freewifi"

set dstintf "wan1"

set srcaddr "all"

set action accept

set devices collected-emails

set nat enable

set schedule "always"

set service "ALL"



Checking for harvested emails

To check for harvested emails using the GUI:
  1. Go to User & Device > Device Inventory.
To check for harvested emails using the CLI:

FGT-100D # diagnose user device list


vd 0 d8:d1:cb:ab:61:0f gen 35 req 30 redir 1 last 43634s 7-11_2-int

ip ip6 fe80::dad1:cbff:feab:610f

type 2 'iPhone' src http c 1 gen 29

os 'iPhone' version 'iOS 6.0.1' src http id 358 c 1

email ''

vd 0 74:e1:b6:dd:69:f9 gen 36 req 20 redir 0 last 39369s 7-11_2-int

ip ip6 fe80::76e1:b6ff:fedd:69f9

type 1 'iPad' src http c 1 gen 5

os 'iPad' version 'iOS 6.0' src http id 293 c 1

host 'Joes’s-iPad' src dhcp

email ''