Fortinet FortiGate / FortiAP setup

Connect CaptiFi to FortiAP access points managed by a FortiGate. The FortiGate's wireless controller sends guests on your guest SSID to your CaptiFi sign-in page (Fortinet calls this an external captive portal), and CaptiFi's RADIUS server tells the FortiGate when to let each guest online. Tunnel mode and bridge mode SSIDs both work; the steps follow tunnel mode, and the differences for bridge mode are under Bridge mode SSIDs in Step 3.

This guide is for FortiAPs managed by a FortiGate. FortiAPs managed by FortiLAN Cloud, with no FortiGate in front of them, are not covered: contact hello@captifi.io before you start.

Enter the values exactly

The portal URL, RADIUS shared secret and NAS identifier must be entered on the FortiGate exactly as shown on my.captifi.io. One wrong character stops guests getting online.

Prerequisites

• A FortiGate running FortiOS 7.0 or later. FortiOS 7.2.4 or later is needed to set a custom NAS identifier; on older firmware see Firmware older than 7.2.4.
• FortiAP access points managed by that FortiGate, with a guest SSID that already gets guests online, in tunnel or bridge mode.
• Admin access to the FortiGate GUI and CLI. The CLI is needed for the NAS ID and the hard timeout.
• Outbound UDP 1812 allowed from the FortiGate to radius.captifi.io.
• A CaptiFi account at my.captifi.io with a Fortinet location created. The location shows your portal URL, RADIUS shared secret and NAS identifier (Step 1).
• A certificate the guests' phones trust on the FortiGate's authentication portal (Fortinet's auth-cert setting), because the sign-in is handed to the FortiGate over HTTPS in Step 5. With the FortiGate's factory certificate, phones show a certificate warning at that point.

Paid WiFi and WiFi vouchers are not yet offered on Fortinet locations; the standard sign-in page is what guests see.

Overview

1. Create the location in CaptiFi and copy its values.
2. Add CaptiFi as a RADIUS server on the FortiGate and put it in a user group.
3. Point the guest SSID's captive portal at CaptiFi.
4. Exempt the CaptiFi hosts so the sign-in page loads before a guest is authenticated.
5. Set the authentication timeout to match your session length.
6. Test with a phone.

Each step gives the FortiGate GUI path and the matching CLI where there is one.

---

Step 1: Create the location in CaptiFi

1. Sign in to my.captifi.io.
2. Go to My Locations, click Add location and choose Fortinet FortiAP. If you are setting up your account for the first time, pick the same card in the set-up wizard.
3. Name the venue and finish the wizard.
4. The wizard shows three values, each with a copy button: your portal URL, your RADIUS shared secret and your NAS identifier. They stay available afterwards on the location's card under My Locations.

Your portal URL has this form, where YOUR_SITE_ID is the site ID CaptiFi assigned to the location:

app.captifi.io/guest/fortinet/YOUR_SITE_ID

The FortiGate appends the guest's details, such as the MAC address and access point, to this URL itself, so do not add anything after the site ID. Enter it on the FortiGate without https:// (Step 3).

---

Step 2: Add CaptiFi as a RADIUS server and create the user group

After a guest completes your sign-in page, the FortiGate asks CaptiFi's RADIUS server whether to let that device online. Without this step guests see the sign-in page but never get internet.

RADIUS server

Go to User & Authentication, then RADIUS Servers, and click Create New.

Setting	Value
Name	CaptiFi-RADIUS
Authentication method	Specify: PAP
Primary server IP/Name	radius.captifi.io
Primary server secret	The shared secret from Step 1

The form has no port field: the FortiGate uses the standard RADIUS port 1812, which only changes under config system global with set radius-port. Accounting is not needed for CaptiFi. The custom NAS ID is CLI only and needs FortiOS 7.2.4 or later, so set it with this block, which creates the whole server entry and can be used in place of the GUI form:

config user radius
    edit "CaptiFi-RADIUS"
        set server "radius.captifi.io"
        set secret "YOUR_SHARED_SECRET"
        set auth-type pap
        set nas-id-type custom
        set nas-id "YOUR_NAS_IDENTIFIER"
    next
end

Replace YOUR_SHARED_SECRET and YOUR_NAS_IDENTIFIER with the values from Step 1. On firmware older than 7.2.4, leave out the two nas-id lines and see Firmware older than 7.2.4.

User group

Go to User & Authentication, then User Groups, and click Create New.

1. Name the group CaptiFi-Guests.
2. Set the type to Firewall.
3. Under Remote Groups click Add, choose CaptiFi-RADIUS as the remote server and leave the group filter as Any.
4. Click OK.

CLI:

config user group
    edit "CaptiFi-Guests"
        set member "CaptiFi-RADIUS"
    next
end

---

Step 3: Point the guest SSID at the CaptiFi portal

Go to WiFi & Switch Controller, then SSIDs, and edit your guest SSID.

Setting	Value
Security mode	Captive Portal (on FortiOS 7.6 the GUI shows Captive Portal as a toggle under the security mode; 7.2 and 7.4 list it as a security mode)
Portal type	Authentication
Authentication portal	External, with the portal URL from Step 1 entered without https://
User groups	CaptiFi-Guests
Exempt destinations/services	The CaptiFi address objects from Step 4

These settings are for a tunnel mode SSID. If your guest SSID has local bridging turned on, see Bridge mode SSIDs below.

No https:// in the portal field

Fortinet's own note on this field says not to include http:// or https://. Enter app.captifi.io/guest/fortinet/YOUR_SITE_ID and nothing more.

CLI (tunnel mode):

config wireless-controller vap
    edit "YOUR_GUEST_SSID"
        set security captive-portal
        set external-web "app.captifi.io/guest/fortinet/YOUR_SITE_ID"
        set selected-usergroups "CaptiFi-Guests"
        set security-exempt-list "CaptiFi-Exempt"
    next
end

CaptiFi-Exempt is the exempt list you build in Step 4. If you are working in the CLI, create it first under config user security-exempt-list, or leave that line out and add the exempt destinations to the SSID in the GUI.

Bridge mode SSIDs

On a bridge mode SSID (local bridging turned on) two settings differ from the table above. Portal type is External Authentication, and the RADIUS server is chosen on the SSID itself, in the RADIUS Server field that bridge mode adds; the user group is not used. Everything else, including the portal URL and the exempt destinations, is the same.

config wireless-controller vap
    edit "YOUR_GUEST_SSID"
        set local-bridging enable
        set security captive-portal
        set portal-type external-auth
        set external-web "app.captifi.io/guest/fortinet/YOUR_SITE_ID"
        set radius-server "CaptiFi-RADIUS"
        set security-exempt-list "CaptiFi-Exempt"
    next
end

If your guest SSID runs in bridge mode, email hello@captifi.io before go-live with your FortiOS version so we can check the sign-in hand-off with you.

---

Step 4: Exempt the CaptiFi hosts

Before a guest signs in, their phone must be able to reach CaptiFi to load the sign-in page. On a FortiGate this list is called Exempt destinations (other vendors call it a walled garden).

1. Go to Policy & Objects, then Addresses, and create an address object for each row:

Name	Type	Value
CaptiFi-app	FQDN	app.captifi.io
CaptiFi-root	FQDN	captifi.io
CaptiFi-wildcard	FQDN	*.captifi.io
Google-Fonts-API	FQDN	fonts.googleapis.com
Google-Fonts-Static	FQDN	fonts.gstatic.com

Every object is Type FQDN, including *.captifi.io, which you enter as an FQDN value with the wildcard in it. Fortinet's separate Wildcard FQDN Addresses table cannot be used in the exempt list.

2. Go back to the guest SSID from Step 3, add all five objects under Exempt destinations/services with the services HTTP, HTTPS and DNS, and save.

The two Google Fonts hosts let the sign-in page load its fonts.

TIP

If FQDN objects are not resolving for unauthenticated guests on your FortiGate, add an IP address object for 46.62.168.7 to the same list.

---

Step 5: Set the authentication timeout

The FortiGate's authentication timeout decides how long an authenticated guest stays online before the FortiGate asks again. The default is 5 minutes of idle time, so without this step guests drop off after a short pause and see your sign-in page again.

Go to User & Authentication, then Authentication Settings.

1. Set Authentication timeout to your venue's session length in minutes, from 1 to 1440 (the 24 hour cap). This page sets an idle timeout only; the hard timeout is set from the CLI block below. Your session length is set on my.captifi.io under My Locations, Edit site, Session length; keep the two the same. If CaptiFi's session length is longer than 24 hours, enter 1440.
2. Turn on Redirect HTTP challenge to a secure channel (HTTPS), so the guest's sign-in is handed to the FortiGate over HTTPS.

The CLI sets both of those and also switches the timer to a hard timeout, which runs from the moment the guest signs in, whether or not they stay active:

config user setting
    set auth-timeout 240
    set auth-timeout-type hard-timeout
    set auth-secure-http enable
end

240 is four hours. Replace it with your session length in minutes.

---

Step 6: Test

1. Connect a phone to the guest WiFi.
2. Your CaptiFi sign-in page should open on its own. If it does not, open a browser and visit any http:// site, such as http://example.com.
3. Complete the sign-in. You should be online within a few seconds.
4. On my.captifi.io the guest appears under Guest Visits. If you are still in the set-up wizard, the Check the connection step shows its checks turning green: RADIUS traffic from the FortiGate, a phone reaching the sign-in page, and a completed sign-in.

---

FortiGate portal address on a hostname

CaptiFi hands each guest back to the FortiGate's own address on your network after they sign in. If your FortiGate answers that hand-off on a hostname (the portal-addr under config firewall auth-portal, or auth-portal-addr on a bridge mode SSID) and not on its own IP address, send the hostname to hello@captifi.io with the name of your CaptiFi location and support stores it against the location. Without that, sign-ins on a hostname-based portal are not completed.

---

Firmware older than 7.2.4

FortiOS added the custom NAS identifier in 7.2.4. On older firmware the FortiGate sends its own hostname, or the HA group name on an HA cluster, as the NAS identifier, so CaptiFi needs to know that name. Email hello@captifi.io with your FortiGate's hostname (System, then Settings, Host name), or the HA group name if you run a cluster, and the name of your CaptiFi location; support stores it against your location. Leave the two nas-id lines out of the Step 2 CLI. Everything else in this guide stays the same.

---

Troubleshooting

Issue	What to check
Sign-in page does not appear	Security mode is Captive Portal, Portal type is Authentication with Authentication portal set to External (External Authentication on a bridge mode SSID), and the portal URL matches my.captifi.io exactly with no https://
"Portal unreachable" or the page never loads	The exempt destinations include app.captifi.io, captifi.io and *.captifi.io (Step 4); add an IP object for 46.62.168.7 if FQDN objects are not resolving
Guests sign in but never get online	The RADIUS server points at radius.captifi.io with PAP, the shared secret matches, CaptiFi-Guests is selected under User groups on the SSID (on a bridge mode SSID, CaptiFi-RADIUS is selected in its RADIUS Server field), and the NAS ID matches your CaptiFi location (Step 2)
"Access denied" after sign-in	The shared secret does not match: copy it again from my.captifi.io and paste it
Guests dropped after 5 minutes	The authentication timeout is still the FortiGate default; set it to your session length (Step 5)
Custom NAS ID not available	The FortiGate is on FortiOS older than 7.2.4: see Firmware older than 7.2.4
HTTPS sites do not trigger the sign-in page	Visit an http:// site first, such as http://example.com; most phones do this on their own when they join the network

---

Multiple sites

Each CaptiFi location has its own portal URL, NAS identifier and splash page design, managed under My Locations. Venues on separate FortiGates each get Steps 1 to 5 with that venue's values. If one FortiGate serves several venues, create a RADIUS server entry and user group for each venue, each with that venue's NAS ID, and attach each pair to the venue's own SSID. Each additional CaptiFi location beyond the one included in your plan is charged at your currency's extra-venue rate.

---

Next steps

• Customise your splash page
• Set up email campaigns
• Common issues

---

Need help?

FortiGate menus differ between firmware versions. If a step does not match what you see, email hello@captifi.io with your FortiOS version and a screenshot of the SSID's captive portal settings, or use the live chat on captifi.io. Fortinet's own documentation is in the Fortinet Document Library.