{"id":178,"date":"2022-03-11T04:23:35","date_gmt":"2022-03-11T09:23:35","guid":{"rendered":"https:\/\/opentextbc.ca\/fortigatefirewall\/chapter\/captive-portal\/"},"modified":"2023-08-29T16:26:58","modified_gmt":"2023-08-29T20:26:58","slug":"captive-portal","status":"publish","type":"chapter","link":"https:\/\/opentextbc.ca\/fortigatefirewall\/chapter\/captive-portal\/","title":{"raw":"5.1 Captive Portal","rendered":"5.1 Captive Portal"},"content":{"raw":"
\n

Learning Objectives<\/p>\n\n<\/header>\n

\n
    \n \t
  • Configure a Captive Portal<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
    Scenario<\/strong>: We are planning to enable Captive Portal on port2. Then, when users want to connect to the Internet, first they should enter their username and password and after that they are allowed to surf the Internet.<\/div>\n\n[caption id=\"attachment_168\" align=\"aligncenter\" width=\"921\"]\"Captive Figure 5.1: Main scenario[\/caption]\n\n
    \n\n\n\n\n\n
    Table 5.1: Devices configuration<\/caption>\n
    Device<\/th>\nIP address<\/th>\nAccess<\/th>\n<\/tr>\n
    WebTerm1<\/td>\n192.168.1.2\/24<\/td>\n-<\/td>\n<\/tr>\n
    FortiGate<\/td>\nPort 1: DHCP Client\n\nPort 2: 192.168.1.1\/24\n\nPort 3: 192.168.0.1\/24<\/td>\nICMP\n\nHTTP\n\nHTTPS<\/td>\n<\/tr>\n
    WebTerm (FMC)<\/td>\n192.168.0.2\/24<\/td>\n-<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
      \n \t
    1. Prerequisites:\n
        \n \t
      1. Set the IP addresses in the firewall as above table. The CLI is available as following:\n
        \n\nFGVM01TM19008000 # config system interface<\/em>\nFGVM01TM19008000 (interface) # edit port1<\/em>\nFGVM01TM19008000 (port1) # set mode dhcp<\/em>\nFGVM01TM19008000 (port1) # end<\/em>\n\nFGVM01TM19008000 # config system interface<\/em>\nFGVM01TM19008000 (interface) # edit port2<\/em>\nFGVM01TM19008000 (port2) # set ip 192.168.1.1\/24<\/em>\nFGVM01TM19008000 (port2) # end<\/em>\n\nFGVM01TM19008000 # config system interface<\/em>\nFGVM01TM19008000 (interface) # edit port3<\/em>\nFGVM01TM19008000 (port3) # set ip 192.168.0.1\/24<\/em>\nFGVM01TM19008000 (port3) # set allowaccess http https<\/em>\nFGVM01TM19008000 (port3) # end<\/em>\n\n<\/div><\/li>\n \t
      2. Set a static route in the firewall. You should always set the default route in the firewall (0.0.0.0 0.0.0.0 Internet IP).\n\n[caption id=\"attachment_169\" align=\"aligncenter\" width=\"863\"]\"Configure Figure 5.2: Configure a static route[\/caption]<\/li>\n \t
      3. Set a Firewall Policy from port2<\/strong> to port1.<\/strong>\n\n[caption id=\"attachment_170\" align=\"aligncenter\" width=\"863\"]\"Set Figure 5.3: Set a Firewall Policy[\/caption]<\/li>\n \t
      4. Set the static IP address in WebTerm1 (192.168.1.2\/24).\n\n[caption id=\"attachment_171\" align=\"aligncenter\" width=\"765\"]\"Set Figure 5.4: Configure a static IP address in WebTerm1[\/caption]<\/li>\n<\/ol>\n<\/li>\n \t
      5. Create a user and group. Go to User & Authentication<\/strong> > User Groups<\/strong>. Create a group name: CaptivePortal<\/strong>.\n\n[caption id=\"attachment_175\" align=\"aligncenter\" width=\"400\"]\"Create Figure 5.5: Create a group[\/caption]\n\nGo to User & Authentication<\/strong> > User Definition<\/strong> > Create a New User<\/strong> and assign your user in step 4 to A0ID-CaptivePortal Group.\n\n[caption id=\"attachment_175\" align=\"aligncenter\" width=\"500\"]\"Create Figure 5.6: Create a user[\/caption]\n\n[caption id=\"attachment_175\" align=\"aligncenter\" width=\"400\"]\"Step2- Figure 5.7: Create login credentials[\/caption]\n\n[caption id=\"attachment_175\" align=\"aligncenter\" width=\"885\"]\"Add Figure 5.8: Add user to the group[\/caption]<\/li>\n \t
      6. Go to Network<\/strong> > Interfaces and edit port 2<\/strong>. In the Admission Control section, set:\n
          \n \t
        • Security mode:<\/strong> captive portal<\/li>\n \t
        • Authentication Portal:<\/strong> Local<\/li>\n \t
        • User Access:<\/strong> Restricted to Group and assign the group you have created in the previous step.<\/li>\n<\/ul>\n[caption id=\"attachment_176\" align=\"alignnone\" width=\"1015\"]\"Configure Figure 5.9: Configure Captive Portal on port2[\/caption]<\/li>\n \t
        • Now, open the browser in WebTerm1 and type http:\/\/talebi.ca.\n\n[caption id=\"attachment_177\" align=\"aligncenter\" width=\"400\"]\"open Figure 5.10: Verify Captive Portal[\/caption]<\/li>\n<\/ol>","rendered":"
          \n
          \n

          Learning Objectives<\/p>\n<\/header>\n

          \n
            \n
          • Configure a Captive Portal<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
            Scenario<\/strong>: We are planning to enable Captive Portal on port2. Then, when users want to connect to the Internet, first they should enter their username and password and after that they are allowed to surf the Internet.<\/div>\n
            \"Captive
            Figure 5.1: Main scenario<\/figcaption><\/figure>\n
            \n\n\n\n\n\n\n
            Table 5.1: Devices configuration<\/caption>\n
            Device<\/th>\nIP address<\/th>\nAccess<\/th>\n<\/tr>\n
            WebTerm1<\/td>\n192.168.1.2\/24<\/td>\n–<\/td>\n<\/tr>\n
            FortiGate<\/td>\nPort 1: DHCP Client<\/p>\n

            Port 2: 192.168.1.1\/24<\/p>\n

            Port 3: 192.168.0.1\/24<\/td>\n

            		ICMP<\/p>\n

            HTTP<\/p>\n

            HTTPS<\/td>\n<\/tr>\n

            WebTerm (FMC)<\/td>\n192.168.0.2\/24<\/td>\n–<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
              \n
            1. Prerequisites:\n
                \n
              1. Set the IP addresses in the firewall as above table. The CLI is available as following:\n
                \n

                FGVM01TM19008000 # config system interface<\/em>
                \nFGVM01TM19008000 (interface) # edit port1<\/em>
                \nFGVM01TM19008000 (port1) # set mode dhcp<\/em>
                \nFGVM01TM19008000 (port1) # end<\/em><\/p>\n

                FGVM01TM19008000 # config system interface<\/em>
                \nFGVM01TM19008000 (interface) # edit port2<\/em>
                \nFGVM01TM19008000 (port2) # set ip 192.168.1.1\/24<\/em>
                \nFGVM01TM19008000 (port2) # end<\/em><\/p>\n

                FGVM01TM19008000 # config system interface<\/em>
                \nFGVM01TM19008000 (interface) # edit port3<\/em>
                \nFGVM01TM19008000 (port3) # set ip 192.168.0.1\/24<\/em>
                \nFGVM01TM19008000 (port3) # set allowaccess http https<\/em>
                \nFGVM01TM19008000 (port3) # end<\/em><\/p>\n<\/div>\n<\/li>\n

              2. Set a static route in the firewall. You should always set the default route in the firewall (0.0.0.0 0.0.0.0 Internet IP).
                \n
                \"Configure
                Figure 5.2: Configure a static route<\/figcaption><\/figure>\n<\/li>\n
              3. Set a Firewall Policy from port2<\/strong> to port1.<\/strong>
                \n
                \"Set
                Figure 5.3: Set a Firewall Policy<\/figcaption><\/figure>\n<\/li>\n
              4. Set the static IP address in WebTerm1 (192.168.1.2\/24).
                \n
                \"Set
                Figure 5.4: Configure a static IP address in WebTerm1<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n<\/li>\n
              5. Create a user and group. Go to User & Authentication<\/strong> > User Groups<\/strong>. Create a group name: CaptivePortal<\/strong>.
                \n
                \"Create
                Figure 5.5: Create a group<\/figcaption><\/figure>\n

                Go to User & Authentication<\/strong> > User Definition<\/strong> > Create a New User<\/strong> and assign your user in step 4 to A0ID-CaptivePortal Group.<\/p>\n

                \"Create
                Figure 5.6: Create a user<\/figcaption><\/figure>\n
                \"Step2-
                Figure 5.7: Create login credentials<\/figcaption><\/figure>\n
                \"Add
                Figure 5.8: Add user to the group<\/figcaption><\/figure>\n<\/li>\n
              6. Go to Network<\/strong> > Interfaces and edit port 2<\/strong>. In the Admission Control section, set:\n
                  \n
                • Security mode:<\/strong> captive portal<\/li>\n
                • Authentication Portal:<\/strong> Local<\/li>\n
                • User Access:<\/strong> Restricted to Group and assign the group you have created in the previous step.<\/li>\n<\/ul>\n
                  \"Configure
                  Figure 5.9: Configure Captive Portal on port2<\/figcaption><\/figure>\n<\/li>\n
                • Now, open the browser in WebTerm1 and type http:\/\/talebi.ca.
                  \n
                  \"open
                  Figure 5.10: Verify Captive Portal<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n","protected":false},"author":124,"menu_order":2,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-178","chapter","type-chapter","status-publish","hentry"],"part":167,"_links":{"self":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/users\/124"}],"version-history":[{"count":1,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/178\/revisions"}],"predecessor-version":[{"id":179,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/178\/revisions\/179"}],"part":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/parts\/167"}],"metadata":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/178\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/media?parent=178"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapter-type?post=178"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/contributor?post=178"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/opentextbc.ca\/fortigatefirewall\/wp-json\/wp\/v2\/license?post=178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}