CONFIGURATION GUIDE

The purpose of the following manual is to describe the necessary configuration of Fortiwifi equipment for integration with Octopus Platform

1- Pre-requisites

• If there is a firewall in the network that might block the traffic, you will need to allow access to some domains to enable user's authentication:

  • Radius Servers:

    • Primary: <IP_Radius_1> 1812 and 1813 UDP ports

    • Secondary: <IP_Radius_2> 1812 and 1813 UDP ports

  • Splash Portal server: 

    • Domain <captive_portal_domain> 80 and 443 TCP ports

• For the operation of the Guest and Enterprise modules configuration, it will be necessary to previously contract the Octopus platform licenses with the respective modules.

2- Guest module configuration

2.1 Radius Servers

First of all, to configure the external captive portal in a SSID, it is necessary to set up the Radius Server that the user's authentication requests will be sent to. Go to the section User & Device > RADIUS Servers and add a new Radius Server with the following configuration:

Once the Radius Server configuration has been added, it is necessary to create the user group that will use this server. Go to the section User & Device > User Groups and add a new group with the following parameters:

Once the Radius Server has been added, it is necessary to SSH into the Fortinet machine and execute the following code to activate the Accounting Server.

config user radius
	edit "Radius_Guest"
	set acct-interim-interval 600
	config accounting-server
		edit 1
		set status enable
		set server <IP_Radius_1>
		set secret <Secret>
		set port 1813
		next
	end
	next
end

To enable HTTPS authentication access the Fortinet device via SSH or console and execute the following commands: 

config user setting
	set auth-secure-http enable
end

2.2 Captive Portal

The next step is to add the WLAN that will be linked to the external captive portal. Go to the section WiFi & Switch Controller > SSID and click on Create New SSID to add a new WLAN. Then, perform the following configuration:

2.3 Walled Garden

To configure the domains to which users will have free access before validation go to Policy & Objects > Addresses and add a new Address with the following configuration:

Repeat the process to add a new Address for each of the domains required for the operation of the captive portal depending on the validation methods chosen:

Then you need to create an Address Group that includes all of the above domains. To do this, click on Create New Address Group and configure the following parameters:

Once all the addresses have been added, it is necessary to associate each one of them with a specific policy. To do this, go to Policy & Objects > IPv4 Policy and add a new policy with the following configuration:

In addition, it is required to add a policy that allows access to the DNS servers. So add a new policy and perform the following configuration:

If you are going to enable WifiArea validation via social networks you will also need to add the following policy.

The next step is to enable the bypass of the Walled Garden policies so that it is not affected by the configured external captive portal. To do this, access the equipment through the console and execute the following code, changing the policy_id for the corresponding one.

config firewall policy
  edit <policy_id>
    set captive-portal-exempt enable
  end

To finalize this configuration, an Internet access policy must be created for authenticated users with the following configuration:

2.4 Authorized MAC Addresses

For user validation to work properly it is necessary to identify the NAS that will be able to make authentication requests to the Radius Server. In this case it is necessary to add the MAC address of each AP and the MAC addresses assigned to the WiFi interface of the APs in which the SSID will be radiated with the captive portal in both 2.4GHz and 5GHz.

To check these MAC addresses, it is necessary to access the Fortinet through SSH and execute the following command inside the corresponding VDOM:

diagnose wireless-controller wlac -d all

By the way, to find out the AP MAC address, execute the following command:

get wireless-controller wtp-status

3- Enterprise module configuration

In order to integrate the configurations of this module with the platform, it is necessary to contract the Octopus Wifi Enterprise Module.

3.1  MAC Authentication

To enable MAC authentication it is necessary to edit the created SSID Profile. To do this, it is necessary to access the equipment through SSH or console and execute the following commands indicating the name of the corresponding SSID profile.

config wireless-controller vap
	edit <name>
		set mac-auth-bypass enable
	next
end

----

3.2 Configuration of “Access Profiles” funtionality in the Octopus Platform

Through the Octopus platform it is possible to configure a series of reply attributes of the Access-Accept packages, grouped in the so-called Access Profile. These Access Profiles allow to activate a series of functionalities in the Fortiwifi Although the most common and proprietary Fortiwifi radius dictionaries are available, the following is a list of some of the most interesting ones: