Fortigate - Captive portal if no authentication

[mdrabble]

We have a School Device SSID which has Windows laptops on it, which are authenticated at logon - no problem.

 

SLT gave the go ahead for Art to purchase 2 iPads for photoshop/drawing even though I pointed out the headache it would cause for internet usage

 

We have Unifi APs and Fortigate Firewall, so I was hoping it would be possible to get the iPads to use form of fortigate captive portal for authentication.

 

Is it possible for a device on an Fortigate Interface to be presented with a captive portal page if no authentication is found for that device? - looking to put the iPads on the same School Device SSID/VLAN

 

I hope that all makes sense........

 

Cheers

[Olliedawg]

This is how we do it with our Sophos XGS, maybe can do something similar on the Fortigate.

 

We have two class sets of iPads. The iPads have DHCP reserved IP addresses. A separate firewall rule was made & applied to that address range, which forces captive portal before granting internet access.

 

I had to add in another rule above that one for the same IP range to allow connection to MDM servers & MS servers to actually allow them to sign into the iPad prior to browsing the web.

[jslate1980]

I was looking at this over last summer with switchshop, if you have any firewall policies in place without user groups applied then the captive portal is bypassed.

[mdrabble]

We got our Fortigate devices with SwitchShop and have some engineer time available, so might get them to take a look and sort for me.

[RLR]

We have setup Outbound Firewall Authentication with Microsoft Entra ID as a SAML IdP

 

For users signing into windows devices with their entra account this is a seamless authentication. If a device doesn't have authentication then they are presented with a microsoft login box to sign into their microsoft account. The only issue with this is shared devices as the device will remember the user that signed into the browser most recently. There is a URL you can visit to force the logout but this would require the users to do this.