RADIUS VSAs for captive portal redirects NEW

RADIUS Vendor-Specific Attributes (VSA) for captive portal redirects provide a smoother user experience during captive portal redirects, especially in environments where vendor-specific attributes are heavily used, such as corporate networks or public Wi-Fi hotspots.

To configure RADIUS VSA for captive portal redirects:

1. Configure a RADIUS user:

   config user radius
       edit "pc05"
           set server "172.16.200.55"
           set secret ***************
       next
   end

2. Add the user to a group:

   config user group
       edit "radius-group"
           set member "pc05"
       next
   end

3. Configure the interface to use captive portal authentication and the group:

   config system interface
       edit "port2"
           set security-mode captive-portal
           set security-groups "radius-group"
       next
   end

4. Configure the firewall policy:

   config firewall policy
       edit 1
           set name "1"
           set srcintf "port2"
           set dstintf "mgmt"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set logtraffic all
           set nat enable
       next
   end

5. To check the configuration, on a client PC:

   1. Use a browser to access a web server.

   2. Authenticate using RADIUS.

   3. Browse the redirect to https://www.fortinet.com.

   4. Check the list of authenticated users:

      # diagnose firewall auth list
      
      10.1.100.11, 962341
              src_mac: 00:0c:29:61:d4:13
              type: fw, id: 0, duration: 752, idled: 2
              expire: 298, allow-idle: 300
              flag(10): radius
              server: pc05
              packets: in 8531 out 7654, bytes: in 7972540 out 1104574
              group_id: 1
              group_name: radius-group
      
      ----- 1 listed, 0 filtered ------