The following instructions outline how to setup a ForitNet FortiGate network for the Smart WiFi Platform. This guide covers details such as configuring RADIUS, walled garden entries, and captive portals. This guide assumes that your Fortigate is already operational and on a live network. Please make sure any firewall rules, web content filters, and other security measures have been configured to interface with the platform.
- Login to your Fortigate appliance
- Use the navigation panel to the left to open User & Authentication and click on RADIUS Servers
- Click Create New and configure with the following settings
- Name: SmartWiFi
- Authentication Method: Specify
- Method: PAP
- Primary Server IP: Contact support for your IP
- Secret: Contact support for your secret
- Secondary Server IP: Contact support for your IP
- Secret: Contact support for your secret
- Click OK to save the RADIUS Server
- Using the navigation panel to the left click on User Groups under the User & Authentication section
- Click Create New and configure with the following settings
- Name: SmartWiFi
- Type: Firewall
- Remote Groups: Click Add and choose Smart WiFi as the Remote Server
- Click OK to add the Remote Server
- Click OK to save the User Group.
- Use the navigation panel to the left to open Policy & Objects and click on Addresses
- Click Create New > Address Group and configure with the following settings
- Group Name: SmartWiFi
- Type: Group
- Members: Click the + icon to add to the group
- Using the Select Entries menu click +Create > Address and configure with the following settings
- Name: SmartWiFi Online
- Type: Subnet
- IP Range: 10.5.50.0/255.255.255.0
- Interface: Any
- Click OK to save the Address
- Click the +Create > Address again and configure with the following settings
- Name: insert wildcard domain here (Example- *.smartwifiplatform.com)
- Type: FQDN
- FQDN: insert wildcard domain here (Example- *.smartwifiplatform.com)
- Click OK to save the Address
- Name: insert wildcard domain here (Example- *.smartwifiplatform.com)
- Complete step 7.5 for each wildcard entry found in the default walled garden entries for the platform.
- Using the Select Entries menu add all the entries created in steps 7.4 and 7.5 to the group
- Click OK to Save the Address Group
- Use the navigation panel to the left to open WiFi & Switch Controller and click on SSIDs
- Click Create New > SSID and configure with the following settings
- Name: SmartWiFi
- Type: WiFi SSID
- Traffic mode: Tunnel
- IP/Netmask: 10.5.50.1/255.255.255.0
- DHCP Server: Enabled
- DNS Server: Specify- 8.8.8.8
- SSID: Guest WiFi (Or whatever name you want)
- Broadcast SSID: Enabled
- Security Mode: Captive Portal
- Portal Type: Authentication
- Authentication Portal: External
External URL: Contact support for your External URL
- User Groups: SmartWiFi
- Exempt Destinations/Services: SmartWiFi
- Redirect after Captive Portal: Specific URL
Specific URL: Contact support for your Specific URL - Click OK to save
- Use the navigation panel to the left to open Policy & Objects and click on Firewall Policy
- Click Create New and configure with the following settings
- Name: SmartWiFi
- Incoming Interface: Guest WiFi or whatever you named the SSID(SmartWiFi)
- Outgoing Interface: Select your configured WAN
- Source: SmartWiFi
- Destination: all
- Schedule: always
- Service: ALL
- Action: Accept
- Enable this policy: Enabled
- Click OK to save
- This complete the configuration through the user interface. The following steps must be completed using a command line.
- Use the menu panel on the top to open a new CLI Console window
- To configure RADIUS Accounting enter the following commands. Fill in the “x.x.x.x” and XXXXXX in the instructions below with the RADIUS Server IPs and Secret you used in step 3 of this guide.
config user radius edit "SmartWiFi" config accounting-server edit 1 set status enable set server "x.x.x.x" set secret XXXXXX next edit 2 set status enable set server "x.x.x.x" set secret XXXXXX next end end
- To enable RADIUS COA enter the following commands
config user radius edit "SmartWiFi" set radius-coa enable set acct-all-servers enable next end end
Troubleshooting Tips
- If devices are redirected but the page fails to load please ensure all of the walled garden entries have been configured and added to the address group assigned to the Exempt Destinations/Servers of the of the Guest WiFi SSID.
- If devices are redirected but presented a hotspot deactivated message please ensure that the MAC of all access points broadcasting the Guest WiFi SSID have been reported to support.