WiFi RADIUS authentication with FortiAuthenticator

In this example, you use a RADIUS server to authenticate your WiFi clients.

In the example, a FortiAuthenticator (v3.00-build0176) is used as a RADIUS server to authenticate users who belong to the employees user group.

Find this recipe for other FortiOS versions
5.2 | 5.4

1. Create the user accounts and user group on the FortiAuthenticator

Go to Authentication > User Management > Local Users and create a user account.

User Role settings are available after you click OK.

Create additional user accounts as needed, one for each employee.

user_def_fac

Go to Authentication > User Management > User Groups and create the local user group “employees” on the FortiAuthenticator.

Add users who are allowed to use the WiFi network.

 

usergroup_fac

2. Register the FortiGate as a RADIUS client on the FortiAuthenticator

Go to Authentication > RADIUS Service > Clients and create a user account.

Enable all of the EAP types.

reg_fgt_on_fac

3. Configure FortiGate to use the RADIUS server

Go to User & Device > Authentication > RADIUS Servers and add the FortiAuthenticator unit as a RADIUS server. fgt_radius

4. Create the SSID and set up authentication

Go to WiFi Controller > WiFi Network > SSID and define your wireless network. ssid-basic
Set up DHCP for your clients. ssid-dhcp
Configure WPA2 Enterprise security that uses the RADIUS server. ssid-security

5. Connect and authorize the FortiAP

Go to System > Network > Interfaces and configure a dedicated interface for the FortiAP. fap-interface

Connect the FortiAP unit. Go to WiFi Controller > Managed Access Points > Managed FortiAPs.

fap-discover

When the FortiAP is listed, select and authorize it.

fap-authorize

Go to WiFi Controller > WiFi Network > FortiAP Profiles and edit the profile. For each radio:

  • Enable Radio Resource Provision.
  • Select your SSID.
fap-profile

5. Create the security policy

Go to Policy & Objects > Policy > IPv4 and add a policy that allows WiFi users to access the Internet.

Results

Go to WiFi Controller > Monitor > Client Monitor to see that clients connect and authenticate. client-monitor

For further reading, check out the Deploying Wireless Networks in the FortiOS 5.2 Handbook.

Jonathan Coles

Jonathan Coles

Technical Writer at Fortinet
Jonathan Coles is part of the FortiOS Technical Documentation team in Ottawa. He has a B.A. in English from the University of Waterloo and an Electronics Technologist diploma from Conestoga College. Long ago at another company he convinced a documentation manager that he could write. After writing about telephone PBXs, text search software, cell tower planning software, and some less memorable things, he joined Fortinet around the time that FortiOS 3.0 was released.
Jonathan Coles

Latest posts by Jonathan Coles (see all)

Share this recipe:

Facebooktwittergoogle_pluslinkedin

Leave a comment:

Before commenting, please read the site's comment policy. Only questions related to documentation will be answered. For other concerns, please contact Fortinet support.

  • Cedric Gustave

    Good “recipe”. The stylish diagram is nice to look at but missing the subnets/ip addresses used in the recipe. A clear “traditional” network diagram would be welcome.

  • Rensley Pereira

    I followed this recipe down to every word, I got the Authentication to work, but after authentication, the users still get a captive portal to enter their credentials. How do i get rid of that page.

    • Adam Bristow

      Hello Rensley,

      It sounds like your FortiAuthenticator unit has Captive Portal general settings enabled. Go to Authentication > Captive Portal > General and disable anything in there that you may have enabled.

      Regards,

      Adam

      • Rensley Pereira

        Hi Adam, The FAC has everything unchecked under CP>General. I verified this by making changes to the replacement page from the FAC and then trying. I get this page even while using local users on the FGT. i have a feeling, there is some sort of rudimentary CLI command that triggers this additional browser page.