FortiGate Captive Portal

A Captive Portal is a convenient way to authenticate web users either on wired or WiFi networks using an HTML (web) form that requires a username and password (active authentication).

 

You must first create a user group and then add a user to the group. To create a new user, go to User & Authentication > Create New.

 

Notice there's a guest user created by default.

Select Local User > Next.

Type Username: cp-user > type Password: fortinet > click Next.

Leave the Two-factor Authentication disabled > click Next.

Leave the User Account Status Enabled > leave the User Group disabled.

 

We can't create a new User Group from here since the cp-user hasn't been created and therefore not selectable yet.

 

To create a new User Group, go to User & Authentication > User Groups > Create new.

 

Notice there's Guest-group and SSO_Guest_Users created by default.

 

Type a Name: CP-GROUP-1 > select Type: Firewall > click add (+) in Members > select cp-user > click Close > OK.

To enable Captive Portal, go to Network > Interfaces > select port2 > click Edit (or just double-click). This would be the port for the incoming wired traffic.

Scroll down > enable Security Mode: Captive Portal > select Authentication portal: Local > select User access: Restricted to Groups > select User groups > CP-GROUP-1 > click Close > OK.

Enable the Captive Portal Disclaimer Message via CLI (for wired users).

FG-1 # config firewall policy

 

FG-1 (policy) # edit 1

 

FG-1 (1) # set disclaimer

enable     Enable user authentication disclaimer.

disable    Disable user authentication disclaimer.

 

FG-1 (1) # set disclaimer enable

 

FG-1 (1) # end

 

 

I tested the Captive Portal by accessing the website training.fortinet.com from 172.16.1.100 (Windows 7 VM).

 

You'll be redirected to FortiGate Authentication web page. Type the username: cp-user > type password: fortinet > click Continue.

Once login, a Firewall Disclaimer is presented. Click Yes, I agree to continue.

To view the Firewall User/Captive Portal logs, go to Log & Report > Events > User Events.

Notice the User Events for cp-user.

Select a specific log > click Details.

You can also view and Deauthenticate Firewall user under Dashboard > Users & Devices > click Firewall Users > Expand to full screen.

Select a specific User Name: cp-user > click Deauthenticate.

Click OK to continue.

Notice cp-user was cleared.

I refreshed the web browser in 172.16.1.100 (Windows 7 VM) but it required me to login again to the FortiGate Captive Portal.

FortiGate Network Address Translation (NAT)

You can use either Source NAT (SNAT) or Destination NAT (DNAT) for traffic passing through a FortiGate. There are two ways to configure Source NAT and Destination NAT:

1. Firewall Policy NAT
2. Central NAT

 

NAT via a Virtual IP (VIP)

 

Virtual IP (VIP) are used to translate an external or public IP address (Internet) to an internal or private IP address.

 

A VIP is a Destination NAT (DNAT), which you can only select in a Firewall Policy destination address field.

 

To create a VIP, go to Policy & Objects > Virtual IPs > Create New > Virtual IP.

 

Type a Name: FTP_SERVER_VIP > optionally type a Comment > select Interface: port1 > leave default Type: Static NAT > type External IP address/range: 192.168.1.200 > type Mapped IP address/range: 172.16.1.100 > click OK.

Create a Firewall Policy using the VIP created as destination address.

 

Go to Firewall Policy > Create New.

 

Type a Name: FTP_ACCESS > select Incoming Interface: port1 > select Outgoing Interface: port2 > select Source: all (from Internet) > select/search Destination: FTP_SERVER_VIP (under VIRTUAL IP/SERVER).

Leave default Schedule: Always > select Service: HTTP > leave default Action: ACCEPT > leave default Inspection Mode: Flow based > disable NAT

Select Log Allowed Traffic: All Sessions > leave the other settings in default > click OK.

I was able to FTP from 192.168.1.100 (Windows 10) to 192.168.1.200 (NAT VIP for Windows 7 VM).

To view the FortiGate NAT session entries, use the get system session list command.

 

Notice the 192.168.1.200 was translated (DESTINATION-NAT) to 172.16.1.100.

 

FG-1 #  get system session

list      List the current VDOM IPv4 sessions.

status    List the current VDOM IPv4 session count.

 

FG-1 #  get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3599   192.168.1.100:53070 -                192.168.1.160:80 -              

tcp     3600   192.168.1.100:53068 -                192.168.1.160:22 -              

tcp     3512   192.168.1.100:53045 -                192.168.1.200:21 172.16.1.100:21

udp     179    192.168.1.160:1772 -                208.91.112.52:53 -              

udp     179    192.168.1.160:1772 -                208.91.112.53:53 -              

tcp     3599   192.168.1.100:53069 -                192.168.1.160:80 -              

tcp     0      192.168.1.160:6686 -                173.243.132.27:443 -   

 

 

Use the diagnose sys session clear command to clear all existing sessions (including the SSH session).

 

FG-1 # diagnose sys session

sync         List session sync.

list         List session.

clear        Clear the sessions defined by filter.

stat         Stat session.

full-stat    Fully stat session.

exp-stat     Expectation session statistics.

ttl          TTL session.

filter       List session with filters.

help         Session help.

 

FG-1 # diagnose sys session clear

 

 

Notice the previous FTP session was cleared.

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3599   192.168.1.100:53099 -                192.168.1.160:22 -              

tcp     3595   192.168.1.100:53101 -                192.168.1.160:80 -

 

 

I tested Source NAT from 172.16.1.100 (Windows 7 VM). All egress or outgoing connections used the VIP 192.168.1.200.

 

Notice the 172.16.1.100 (Windows 7 VM) uses the VIP 192.168.1.200 for Source NAT instead of the IP address on egress/port1 (192.168.1.160).

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3600   192.168.1.100:53099 -                192.168.1.160:22 -              

udp     134    172.16.1.100:54959 192.168.1.200:54959 172.217.160.14:443 -

udp     146    172.16.1.100:54973 192.168.1.200:54973 74.125.24.95:443 -

udp     146    172.16.1.100:54955 192.168.1.200:54955 8.8.8.8:443      -

udp     133    172.16.1.100:54963 192.168.1.200:54963 157.240.7.26:443 -

udp     103    172.16.1.100:54954 192.168.1.200:54954 8.8.8.8:53       -

udp     108    172.16.1.100:54958 192.168.1.200:54958 157.240.13.35:443 -

udp     17     172.16.1.100:59660 192.168.1.200:59660 8.8.8.8:53       -              

udp     160    192.168.1.160:1772 -                208.91.112.52:53 -              

udp     173    192.168.1.160:1772 -                208.91.112.53:53 -              

udp     136    172.16.1.100:54956 192.168.1.200:54956 172.217.160.36:443 -

Dynamic NAT with IP Pools

IP Pools are used to translate the source address to an address from that pool, rather than the FortiGate egress interface IP address.

 

To create an IP pool, go to Policy & Objects > IP Pools > Create New.

Type a Name: IP_POOL_1 > leave default Type: Overload > type External IP address/range: 192.168.1.201-192.168.1.201 > leave the default ARP Reply enabled > click OK.

Edit the Firewall Policy to use the IP pool, go to Policy & Objects > Firewall Policy.

 

I temporarily disabled the Firewall Policies: FTP_ACCESS and DENY_PING_DNS by doing a right-click > Set Status > Disable.

 

Select the Firewall Policy: FG_LAN_INTERNET > click Edit (or just double-click it).

Select IP Pool Configuration > Use Dynamic IP Pool > select IP_POOL_1 created earlier > click Close.

Click OK.

I can access support.fortinet.com from 172.16.1.100 (Windows 7 VM).

 

To view the FortiGate NAT session table, use the get system session list command.

 

Notice the SOURCE-NAT is using the IP address 192.168.1.201 instead of the FortiGate egress interface IP address 192.168.1.160.

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3594   172.16.1.100:56543 192.168.1.201:56543 63.137.229.1:443 -

tcp     3594   172.16.1.100:56542 192.168.1.201:56542 63.137.229.1:443 -

udp     168    172.16.1.100:64393 192.168.1.201:64393 8.8.8.8:53       -

udp     173    172.16.1.100:64394 192.168.1.201:64394 8.8.4.4:443      -

tcp     3594   172.16.1.100:56541 192.168.1.201:56541 63.137.229.1:443 -              

tcp     3600   192.168.1.100:57481 -                192.168.1.160:22 -              

udp     174    172.16.1.100:64395 192.168.1.201:64395 74.125.24.103:443 -              

udp     145    192.168.1.160:1940 -                208.91.112.52:53 -              

udp     150    192.168.1.160:1940 -                208.91.112.53:53 -

Central Source NAT (SNAT)

A Central Source NAT (SNAT) policy is applied to multiple firewall policies, based on a configured central rule. You use the set central-nat enable command to enable Central SNAT in FortiGate.

 

When enabling Central SNAT, make sure to remove first the VIP and IP pool references from the existing Firewall Policies. Notice an error was prompted due to a VIP used in policy ID 3 even though it's currently disabled.

 

FG-1 # config sys setting

 

FG-1 (settings) # set central-nat enable

Cannot enable central-nat with firewall policy using vip (id=3).

I removed all the configured Firewall Policy except for Implicit Deny.

I was able to issue the set central-nat enable command afterwards.

 

FG-1 # config sys setting

 

FG-1 (settings) # set central-nat enable

 

FG-1 (settings) # end

 

 

I logout and re-login the FortiGate GUI in order to display the Central SNAT option.

 

Go to Policy & Objects > Central SNAT > Create New.

 

Select Incoming Interface: any > select Outgoing Interface: any > select Source Address: all > select Destination Address: all.

Leave the NAT option enabled > IP Pool Configuration > Use Dynamic IP Pool > select IP_POOL_1 (192.168.1.201) > select Protocol: any > click OK.

Create a Firewall Policy to allow LAN traffic to the Internet. Go to Policy & Objects > Firewall Policy > Create New.

Type a Name: LAN_TO_INTERNET > select Incoming Interface: port2 > select Outgoing Interface: port1 > select Source: all > select Destination: all > select Service: ALL > leave the Action: Accept > leave the Inspection Mode: Flow based.

 

Notice there's no option to enable NAT within the Firewall Policy.

 

Select Log Allowed Traffic: All Sessions > leave the other settings in default > click OK.

To test the Central SNAT policy, I tried to go to docs.fortinet.com from 172.16.1.100 (Windows 7 VM).

To view the FortiGate NAT session table, issue a get system session list command.

 

Notice the IP 172.16.1.100 (Windows 7 VM) was translated using the SOURCE-NAT address 192.168.1.201 (IP_POOL_1).

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3595   192.168.1.100:60902 -                192.168.1.160:80 -              

tcp     3600   192.168.1.100:60899 -                192.168.1.160:22 -              

udp     148    172.16.1.100:53737 192.168.1.201:53737 74.125.24.139:443 -              

udp     138    172.16.1.100:55522 192.168.1.201:55522 8.8.8.8:53       -              

tcp     3595   192.168.1.100:60903 -                192.168.1.160:80 -              

tcp     3595   192.168.1.100:60900 -                192.168.1.160:80 -              

tcp     4      192.168.1.100:60904 -                192.168.1.160:80 -              

udp     137    172.16.1.100:53739 192.168.1.201:53739 172.253.118.102:443 -              

udp     139    172.16.1.100:55524 192.168.1.201:55524 8.8.8.8:53       -              

tcp     3      192.168.1.100:60901 -                192.168.1.160:80 -              

udp     159    172.16.1.100:55538 192.168.1.201:55538 74.125.68.95:443 -              

udp     151    172.16.1.100:53734 192.168.1.201:53734 74.125.24.103:443 -              

udp     139    172.16.1.100:55523 192.168.1.201:55523 8.8.8.8:53       -              

udp     159    172.16.1.100:53736 192.168.1.201:53736 8.8.4.4:443      -              

udp     176    192.168.1.160:4301 -                208.91.112.53:53 -              

udp     161    192.168.1.160:4301 -                208.91.112.52:53 - 

 

 

Create a second IP Pool to be used for the second Central SNAT policy. Go to Policy & Objects > IP Pools > Create New.

 

Type a Name: IP_POOL_2 > leave default Type: Overload > type External IP address/range: 192.168.1.202-192.168.1.202 > click OK.

Create a second Central SNAT policy, go to Policy & Objects > Central SNAT > Create New.

Select Incoming Interface: port2 > select Outgoing Interface: port1 > select Source Address: all > select Destination Address: PUBLIC_DNS (4.2.2.2)

Leave NAT enabled > IP Pool Configuration > Use Dynamic IP Pool > select IP_POOL_2 > select Protocol: any > click OK.

Like the Firewall Policy, a Central SNAT policy is processed from top to bottom. Re-order the newly created Central SNAT  policy (ID 2) and move it to the top.

I tried to ping the pubic DNS 4.2.2.2 from 172.16.1.100 (Windows 7 VM).

 

Notice the ICMP session was translated using the IP_POOL_2 (192.168.1.202).

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3599   192.168.1.100:61282 -                192.168.1.160:80 -              

tcp     0      192.168.1.160:7767 -                173.243.132.27:443 -              

tcp     3599   192.168.1.100:61280 -                192.168.1.160:80 -              

tcp     3599   192.168.1.100:61281 -                192.168.1.160:80 -              

tcp     3599   192.168.1.100:61270 -                192.168.1.160:22 -              

icmp    46     172.16.1.100:1   192.168.1.202:60417 4.2.2.2:8        -              

udp     163    192.168.1.160:1289 -                208.91.112.53:53 -              

udp     179    192.168.1.160:1289 -                208.91.112.52:53 - 

 

Central Destination NAT (DNAT) and VIP

In Firewall Policy NAT, a Virtual IP (VIP) is selected in the Firewall Policy as the destination address. In Central NAT, as soon as DNAT & Virtual IPs is configured, the FortiGate automatically creates a rule in the kernel to allow DNAT to occur with no additional configuration.

 

To create DNAT and VIP, go to Policy & Objects > DNAT & Virtual IPs.

 

Notice the previous DNAT configured: FTP_SERVER_VIP, which mapped the External IP address: 192.168.1.200 to Internal IP: 172.16.1.100 (Windows 7 VM).

 

Create an Egress-to-Ingress Firewall Policy, go to Policy & Objects > Firewall Policy > Create New.

Type a Name: DNAT_FTP_VIP > select Incoming Interface: port1 > select Outgoing Interface: port2 > select Source: all.

 

Notice you can't select the FTP_SERVER_VIP as the Destination since the FortiGate automatically creates a rule in the kernel for DNAT to occur.

 

Select Destination: all > select Service: FTP > leave default Action: Accept.

Select Log Allowed Traffic: All Sessions > click OK.

I tried to FTP from 192.168.1.100 (Windows 10) to 192.168.1.200 (NAT for Windows 7 VM).

To view the FortiGate NAT session table, issue a get system session list command.

 

Notice the 192.168.1.100 (Windows 10) was translated using DESTINATION_NAT 192.168.1.200 (VIP) to 172.16.1.100 (Windows 7 VM) without creating a DNAT policy.

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

tcp     3595   192.168.1.100:49166 -                192.168.1.160:80 -              

tcp     3571   192.168.1.100:49155 192.168.1.201:49155 192.168.1.200:21 172.16.1.100:21

tcp     3595   192.168.1.100:49167 -                192.168.1.160:80 -              

tcp     3595   192.168.1.100:49164 -                192.168.1.160:80 -              

udp     143    192.168.1.160:2896 -                208.91.112.52:53 -              

udp     176    192.168.1.160:2896 -                208.91.112.53:53 -              

tcp     3595   192.168.1.100:49165 -                192.168.1.160:80 -              

tcp     3599   192.168.1.100:65529 -                192.168.1.160:22 -

 

I tried to access fortinet.com from 172.16.1.100 (Windows 7 VM).

View the NAT table again. Notice the 172.16.1.100 used the Central SNAT IP_POOL_1 (192.168.1.201).

 

FG-1 # get system session list

PROTO   EXPIRE SOURCE           SOURCE-NAT       DESTINATION      DESTINATION-NAT

udp     92     172.16.1.100:53315 192.168.1.201:53315 172.217.194.103:443 -

udp     167    172.16.1.100:53329 192.168.1.201:53329 74.125.200.95:443 -

udp     179    172.16.1.100:61271 192.168.1.201:61271 172.217.194.95:443 -              

tcp     4      192.168.1.100:49226 -                192.168.1.160:80 -              

tcp     3593   172.16.1.100:56672 192.168.1.201:56672 91.199.212.52:80 -              

tcp     3342   192.168.1.100:49155 192.168.1.201:49155 192.168.1.200:21 172.16.1.100:21

udp     164    172.16.1.100:53337 192.168.1.201:53337 74.125.24.155:443 -              

udp     163    172.16.1.100:53333 192.168.1.201:53333 74.125.24.100:443 -              

tcp     3599   172.16.1.100:56677 192.168.1.201:56677 52.84.224.40:443 -              

tcp     3598   172.16.1.100:56673 192.168.1.201:56673 52.84.224.58:443 -              

udp     167    172.16.1.100:49759 192.168.1.201:49759 157.240.13.35:443 -              

udp     166    172.16.1.100:53343 192.168.1.201:53343 8.8.4.4:443      -              

tcp     3599   172.16.1.100:56675 192.168.1.201:56675 50.16.7.188:443  -              

udp     173    172.16.1.100:54230 192.168.1.201:54230 8.8.8.8:53       -              

udp     167    172.16.1.100:49758 192.168.1.201:49758 172.217.194.157:443 -              

tcp     3598   172.16.1.100:56671 192.168.1.201:56671 13.107.4.50:80   -              

tcp     3599   172.16.1.100:56676 192.168.1.201:56676 18.141.80.142:443 -              

udp     179    172.16.1.100:61272 192.168.1.201:61272 74.125.24.94:443 -              

tcp     4      172.16.1.100:56668 192.168.1.201:56668 50.116.239.150:443 -              

udp     92     172.16.1.100:53314 192.168.1.201:53314 8.8.4.4:443      -              

udp     50     172.16.1.100:56677 192.168.1.201:56677 8.8.8.8:53       -