Skip to content
Tech Docs Offline

Configure Authentication Portal with Loopback Interface

Overview

This guide will show you how to configure a secure authentication portal on FortiGate. This portal can be used across multiple networks as it is bound to a loopback interface.

This guide assumes that you either have local user definitions or remote users via LDAP or RADIUS already setup.

Procedure

  1. Configure a Loopback Interface for Portal Authentication:
Terminal window
config system interface
    edit "Loopback_Auth"
        set vdom "root"
        set ip 10.1.99.5 255.255.255.255
        set allowaccess ping                        # <--- Optional
        set type loopback
        set description "Loopback interface for Authentication/Captive Portal, do not disable captive portal!"
        set alias "Cap/Auth Portal Loopback"
        set security-mode captive-portal
    next
end
  1. Configure a Firewall Policy for Loopback Interface Access:
Terminal window
config firewall address
    edit "host-Loopback-Auth"
        set subnet 10.1.99.5 255.255.255.255
    next
end


config firewall service custom
    edit "tcp/1003"
        set tcp-portrange 1003
    next
    edit "tcp/1000"
        set tcp-portrange 1000
    next
end


config firewall policy
    edit 0
        set name "10.0.0.0/8 -> Auth Portal"        # <--- Change name if necessary
        set srcintf "any"
        set dstintf "Loopback_Auth"
        set action accept
        set srcaddr "net-10.0.0.0/8"                # <--- Change source to your inside addresses
        set dstaddr "Loopback_Auth address"
        set schedule "always"
        set service "PING" "tcp/1003" "tcp/1000"    # <--- Ping Optional
        set logtraffic all
    next
end
  1. Configure system settings for user authentication:
Terminal window
config user setting
    set auth-cert "authportal.yourcompany.local"    # <--- Set to a certificate that is trusted, this can be automated with ACME certificates too
    set auth-secure-http enable                     # <--- Does not have to be true if the certificate above is not set
end
  1. Create a firewall policy or adjust an interface which requires authentication:

To prevent your authentication prompt from being bypassed (when a more broad policy is matched), set auth-on-demand to always:

Terminal window
config user setting
    set auth-on-demand always
end

To add authentication to a firewall policy, add firewall groups to the policy. Example:

Terminal window
config firewall policy
    edit 481
        set name "My Policy"
        ...
        set groups "SomeUserGroup"                  # <--- Add groups here
    next
end

Make sure your firewall policy is using an Deep SSL inspection profile, with a trusted certificate authority!