Fortinet

How to connect a FortiGate's external captive portal to Kiwire with RADIUS — for FortiAP access points, a FortiWiFi's own radio, or the FortiGate's own interfaces. All of them use the FortiAP entry.

Device type in Kiwire	FortiAP
Redirect URL	https://<kiwire-host>/login/fortiap (entered on the FortiGate without https://)
RADIUS	auth 1812 / acct 1813 (UDP), sent by the FortiGate
Identity must equal	the MAC in the redirect (apmac: the AP's MAC, or the FortiGate's own MAC for a FortiGate interface; apname when the MAC is empty), and the NAS-Identifier the FortiGate sends in RADIUS (normally its host name; add its MAC as well)
Disconnect / live changes (CoA)	standard RADIUS CoA / Disconnect to the FortiGate, port 3799, once RADIUS CoA is enabled on it
Data caps	time limits only (Session-Timeout)

Which entry to pick

• FortiAP: any FortiGate captive portal set to an external portal — an SSID on FortiAPs or a FortiWiFi, or a FortiGate interface. The FortiGate sends the same parameters in each case.
• FortiOS: a different, server-side login method that is not available yet. You don't need it for a FortiGate captive portal; use FortiAP. See FortiOS.

How a login works

Steps 2 and 4 are the controller's side of the portal, step 5 is its RADIUS side. When the page loads but the login never completes, the break is almost always at step 4 (the login address) or step 5 (the Identity or the shared secret).

1. The FortiGate sends the guest to Kiwire with the guest's MAC and IP, the AP's MAC and name, a one-time magic value and a post address — the FortiGate's own authentication page (usually on port 1000 or 1003, path /fgtauth).
2. After the portal, the guest's browser posts magic, username and password to that post address.
3. The FortiGate checks the credentials against Kiwire over RADIUS and lets the guest out.

The guest's browser must be able to reach the FortiGate's authentication address; Kiwire itself does not call the FortiGate for this entry.

Before you start

From Kiwire:

• the RADIUS server address shown in the Setup Guide checklist ("Before you add your controller" › "RADIUS Authentication & Accounting");
• a shared secret of at most 64 characters;
• <kiwire-host>.

On the FortiGate: admin access (GUI and CLI), the guest SSID, and the MAC address of every FortiAP that serves it.

On the controller

Menu names and commands vary between firmware versions; the values are what matter. The commands follow Fortinet's FortiWiFi and FortiAP configuration guide (FortiOS 7.x).

1. RADIUS server (User & Authentication › RADIUS Servers, or the CLI):

   config user radius
    edit "kiwire"
     set server "<radius-server-ip>"
     set secret <shared-secret>
     set nas-id-type custom
     set nas-id "site1-forti"
     set radius-coa enable
    next
   end

   nas-id-type / nas-id need FortiOS 7.2.4 or later. On older firmware leave them out and check which NAS-Identifier arrives (see Test it). radius-coa lets Kiwire disconnect guests; check the option on your firmware version. Also turn on RADIUS accounting to <radius-server-ip> port 1813 with the same secret (in the RADIUS server's accounting settings; the exact command varies by firmware version).
2. User group: create a firewall user group (for example kiwire-guests) with the kiwire RADIUS server as a remote server.
3. SSID (WiFi and Switch Controller › SSIDs): enable Captive Portal, Portal Type = Authentication, Authentication Portal = External with <kiwire-host>/login/fortiap — Fortinet's guide says to leave out https:// here — and User Groups = kiwire-guests. The same in the CLI:

   config wireless-controller vap
    edit "<guest-vap>"
     set captive-portal enable
     set portal-type auth
     set external-web "<kiwire-host>/login/fortiap"
     set selected-usergroups "kiwire-guests"
     set security-exempt-list "kiwire-walled-garden"
    next
   end

4. Walled garden (Exempt Destinations/Services, the security-exempt-list): allow <kiwire-host>, fonts.googleapis.com, fonts.gstatic.com and anything your portal design loads. See Walled garden and redirect.
5. Redirect after Captive Portal: choose the page guests land on after login (Kiwire does not pass the original page back for FortiAP).

Let Kiwire generate the FortiGate settings

For a FortiGate (FortiOS 7.0 or later), Device › Controllers → select the FortiGate → Site Provisioning, with FortiGate chosen, builds the CLI for that controller: the RADIUS server with accounting, the NAS-Identifier set to the controller's unique ID, disconnect (CoA) support and the guest user group, plus — only if you name the interface — the captive portal pointing at Kiwire and a policy that lets guests reach Kiwire before they sign in. Paste it into the FortiGate console over SSH; any line FortiOS does not accept is shown as Command fail. Then test RADIUS with diagnose test authserver radius kiwire-radius pap <user> <password>.

In Kiwire

1. System › Device Controller › add one record per AP:
   • Vendor: FortiAP.
   • Identity: the AP MAC exactly as the FortiGate sends it in apmac (Controller Test shows the format). If apmac arrives empty or as 00:00:00:00:00:00, Kiwire uses the AP name (apname) instead — register that.
   • Shared Secret Key: <shared-secret> — the same on every record.
   • Advanced Configuration › Network Configuration: IP Address = the FortiGate's address as Kiwire can reach it, COA Port = 3799.
2. Add one more record whose Identity is the NAS-Identifier from step 1 (site1-forti), with the same secret: the RADIUS requests come from the FortiGate, not from each AP. See Identity and virtual NAS. Each record counts toward your licence's device limit.
3. Check the redirect parameters with Redirect and login config: Kiwire reads usermac, userip, apmac, post and magic.
4. Add a zone rule and journey: Controllers and zones, Portal designer.

Test it

1. Portals › Troubleshoot › Controller Test › Start Capture, connect a phone, and check that usermac, apmac, post and magic arrive and the AP shows as registered.
2. Log in as a real guest. If the FortiGate refuses the login, the guest comes back to the portal with an error and can try again; check the RADIUS server and user group on the FortiGate, and the NAS-Identifier record in Kiwire.
3. Reporting › Login › Active Session lists the guest once the FortiGate sends accounting.

Limits to know

• The guest's original page is not passed back; the FortiGate's Redirect after Captive Portal setting decides where the guest lands.
• No Fortinet data-cap attribute: profile quotas are enforced by time only.
• Disconnect and profile changes are sent to the FortiGate's IP Address on the record, as standard RADIUS Disconnect / CoA on port 3799. RADIUS CoA must be enabled on the FortiGate to use them.
• The Identity must match the separators exactly: aa:bb:cc:dd:ee:ff and aa-bb-cc-dd-ee-ff are different (upper or lower case does not matter).

FortiOS

Status: not available yet. A FortiGate captive portal doesn't need this entry: set its external portal to https://<kiwire-host>/login/fortiap and follow the FortiAP steps above, for wireless or wired interfaces alike.

On a FortiGate interface the redirect's apmac is the FortiGate's own MAC (it starts 00:09:0f) and apname is its model, so register that MAC as an Identity. In RADIUS the FortiGate sends its host name as the NAS-Identifier, and sometimes its MAC, so register the host name too.

Vendor reference

• Fortinet: Captive portal security (FortiWiFi and FortiAP configuration guide)
• Fortinet: Custom RADIUS NAS-ID
• Fortinet: Troubleshooting tip — captive portal flow