Wi-Fi employee access – Fortinet

In this topic, you will learn how to configure FortiGate firewalls with FortiAP access points to authenticate Wi-Fi devices with Portnox™ Cloud using 802.1X, 802.1X over RadSec, MAC-based authentication, and identity pre-shared keys (IPSK).

Important:

This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.

Important:

All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

FortiGate with FortiAP

In this section, you will learn how to configure a FortiGate firewall and the FortiAP access points that it manages to work together with Portnox™ Cloud.

Note:

This section assumes that your FortiAP access points are authorized and online in the FortiGate web interface, in WiFi & Switch Controller > Managed FortiAPs.

Note:

This configuration was tested on a FortiGate-40F running FortiOS 7.6.2 with a FortiAP-233G access point running firmware 7.6.0. The capabilities and the user interface on other versions of the platform may differ.

Add a RADIUS server

In this section, you will add a Portnox™ Cloud RADIUS server to the FortiGate using the CLI. You will use this server later when you configure your SSIDs.

Note:

The FortiGate web interface has no field for the RADIUS port, so you must add the server using the CLI.

Note:

The FortiGate supports only one Cloud RADIUS server, so you can use only one Cloud RADIUS region.

In the FortiGate web interface, click on the >_ icon in the top-right corner to open the CLI console.

Run the following commands:

config user radius
    edit "Portnox Cloud"
        set server cloud_radius_ip
        set secret "shared_secret"
        set radius-port authentication_port
        config accounting-server
            edit 1
                set status enable
                set server cloud_radius_ip
                set secret "shared_secret"
                set port accounting_port
            next
        end
    next
end

Replace the placeholders with the values from Portnox Cloud:

cloud_radius_ip: the Cloud RADIUS IP value.
shared_secret: the Shared Secret value.
authentication_port: the Authentication port value.
accounting_port: the Accounting port value.

Result: The Portnox Cloud server appears in the FortiGate web interface, in User & Authentication > RADIUS Servers.

Optional: Add a RadSec server

Add a server for one-way RadSec

In this section, you will add a server that connects to the Portnox Cloud RADIUS server using RadSec.

Note:

In this section, you create a one-way RadSec connection. The FortiGate verifies Portnox Cloud, but Portnox Cloud does not verify the FortiGate. To enable mutual verification, see the next section.

Before you begin, in Portnox Cloud, go to Settings > Services > CLOUD RADIUS SERVICE > Cloud RADIUS instance, select the relevant RADIUS instance, and select ⋮ > Edit. Activate the Enable RADIUS over TLS (RadSec) option, disable the Validate NAS Client Certificate (RadSec) option, and click on the Save button.

The FortiGate includes the DigiCert Trusted Root G4 certificate of the Cloud RADIUS servers by default, as DigiCert_Trusted_Root_G4. You do not need to download or import it.

In the FortiGate web interface, click on the >_ icon in the top-right corner to open the CLI console.
Run the following commands:
```
config user radius
    edit "Portnox Cloud RadSec"
        set server "cloud_radius_fqdn"
        set secret "radsec"
        set radius-port authentication_port
        set transport-protocol tls
        set ca-cert "DigiCert_Trusted_Root_G4"
    next
end
```
Replace the placeholders with the following values:
- cloud_radius_fqdn: the FQDN (fully qualified domain name) of the Portnox Cloud RADIUS server, not its IP address. To find the FQDN of your Cloud RADIUS server, see the following topic: What are the fully qualified domain names (FQDNs) of Cloud RADIUS servers.
- authentication_port: the Authentication port value from Portnox Cloud.
Warning:
If you use the IP address instead of the FQDN, this configuration will not work.

Note:
The shared secret for RadSec connections is always radsec, not the Shared Secret value from Portnox Cloud.

Result: You added a RadSec server. When you configure an SSID, select this server instead of the non-RadSec server.

Optional: Configure mutual authentication (mTLS)

In this section, you will configure Portnox Cloud to verify the certificate of the FortiGate during the RadSec connection.

Important:

Before you begin, you must complete the previous section: Add a server for one-way RadSec.

Warning:

If you configure Portnox Cloud for mTLS authentication, all your NAS devices that use RadSec with the same Cloud RADIUS instance must be configured for mTLS.

During the RadSec connection, the FortiGate presents a factory certificate signed by the Fortinet certificate authorities. In this section, you configure Portnox Cloud to trust these certificate authorities. As a result, Portnox Cloud trusts the factory certificate of any Fortinet device, not only your FortiGate.

To limit trust to your own devices, create your own certificate authority and use it to sign a client certificate for the FortiGate. Then, import this certificate on the FortiGate, select it with the set client-cert command in the RadSec server settings, and upload your certificate authority to Portnox Cloud instead of the Fortinet certificate authorities.

In the FortiGate web interface, in the left-hand side menu, select the System > Certificates option.

Note:
If you do not see the Certificates option, select the System > Feature Visibility option, activate the Certificates option, and click on the Apply button.
In the Remote CA Certificate section, right-click on the row representing the Fortinet_CA certificate to open a context menu, and click on the Download menu option.
In the Remote CA Certificate section, right-click on the row representing the Fortinet_Sub_CA certificate to open a context menu, and click on the Download menu option.
Open both downloaded files in a text editor, and copy their content into a new file, the Fortinet_Sub_CA certificate first. Then, save the new file, for example, as Fortinet_CA_chain.pem.
The file must have this structure:
```
-----BEGIN CERTIFICATE-----
(Fortinet_Sub_CA certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Fortinet_CA certificate)
-----END CERTIFICATE-----
```
In Portnox Cloud, go to Settings > Services > GENERAL SETTINGS > Trusted Root Certificates, and upload the Fortinet_CA_chain.pem file.
Go to Settings > Services > CLOUD RADIUS SERVICE > Cloud RADIUS instance, select the relevant RADIUS instance, select ⋮ > Edit, activate the Validate NAS Client Certificate (RadSec) option, and click on the Save button.

Result: The FortiGate and Portnox Cloud authenticate each other when the FortiGate connects using RadSec. The RadSec server and the SSIDs that use it need no changes.

Create an SSID for 802.1X authentication

In this section, you will create an SSID and configure it for WPA2 Enterprise authentication, using the RADIUS server that you created earlier.

In the FortiGate web interface, in the left-hand side menu, select the WiFi & Switch Controller > SSIDs option.
Click on the Create New button, and select the SSID option.
On the Create New SSID screen, configure the general settings:
1. In the Name field, enter a name for the SSID interface.
  
  The FortiGate uses this name to identify the SSID in other settings, such as firewall policies.
2. In the Traffic mode field, select the Tunnel or the Bridge option, as required by your network design.
  
  If you are not sure, select the Tunnel option.
Optional: If you selected the Tunnel option, in the Address section, activate the DHCP Server option, and leave the remaining settings at their default values.

Note:
The network settings are not part of the authentication setup. Configure them as required by your network design.
In the WiFi Settings section, in the SSID field, enter the network name that devices see when they search for Wi-Fi networks.
In the Security Mode Settings section:
1. In the Security mode field, select the WPA2 Enterprise option.
  
  Note:
  You can also select one of the WPA3 options. The configuration process is the same.
2. In the Authentication field, select the RADIUS Server option, and select the RADIUS server that you created earlier.
  
  Note:
  To use RadSec, select the RadSec server instead.
Leave the remaining settings at their default values unless your environment requires otherwise, and click on the OK button.
In the left-hand side menu, select the WiFi & Switch Controller > FortiAP Profiles option.
Optional: Make sure that your access points broadcast the SSID:
1. Check the SSIDs column of the profile that your access points use.
  
  If the column shows All Tunnel Mode SSIDs for each radio and you selected the Tunnel traffic mode, the access points broadcast the SSID automatically. In this case, skip the next step.
2. Otherwise, double-click the profile. For each radio, in the SSIDs field, select the Manual option, and select the SSID that you created. Then, click on the OK button.
  
  Note:
  The Manual option replaces the automatic list of SSIDs. Also select all other SSIDs that the radio must broadcast.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS server.

Create a firewall policy

In this section, you will create a firewall policy that allows traffic from the SSID to other networks. Without this policy, Wi-Fi devices authenticate and connect, but they cannot reach any other network.

Note:

If you selected the Bridge traffic mode, skip this section. Traffic from bridged SSIDs does not pass through the FortiGate.

In the left-hand side menu, select the Policy & Objects > Firewall Policy option.
Click on the Create new button.
On the Create New Policy screen, configure the policy:
1. In the Name field, enter a name for the policy.
2. In the Incoming interface field, select the SSID that you created.
3. In the Outgoing interface field, select the interface that connects the FortiGate to the internet, for example, wan.
4. In the Source field, click on the + icon, and select the all option.
5. In the Destination field, click on the + icon, and select the all option.
6. In the Service field, click on the + icon, and select the ALL option.
7. Leave the NAT option activated.
Leave the remaining settings at their default values unless your environment requires otherwise, and click on the OK button.

Result: Wi-Fi devices connected to the SSID can reach the internet.

Optional: Create an SSID for MAC-based authentication

This is an optional task. Follow this task only if you want to authenticate devices, such as IoT devices, that do not support 802.1X, using their MAC address instead. Skip this task if you do not need MAC-based authentication.

In the FortiGate web interface, in the left-hand side menu, select the WiFi & Switch Controller > SSIDs option.
Click on the Create New button, and select the SSID option.
On the Create New SSID screen, configure the general settings:
1. In the Name field, enter a name for the SSID interface.
  
  The FortiGate uses this name to identify the SSID in other settings, such as firewall policies.
2. In the Traffic mode field, select the Tunnel or the Bridge option, as required by your network design.
  
  If you are not sure, select the Tunnel option.
Optional: If you selected the Tunnel option, in the Address section, activate the DHCP Server option, and leave the remaining settings at their default values.

Note:
The network settings are not part of the authentication setup. Configure them as required by your network design.
In the WiFi Settings section, in the SSID field, enter the network name that devices see when they search for Wi-Fi networks.
Configure the security settings:
1. In the Security Mode Settings section, in the Security mode field, select the Open option.
  
  Note:
  If the Open option is not available, select the System > Feature Visibility option, activate the Wireless Open Security option, and click on the Apply button. Then, log out of the FortiGate web interface and log in again.
2. In the Client MAC Address Filtering section, activate the RADIUS server option, and select the RADIUS server that you created earlier.
  
  Note:
  To use RadSec, select the RadSec server instead.
Leave the remaining settings at their default values unless your environment requires otherwise, and click on the OK button.
In the left-hand side menu, select the WiFi & Switch Controller > FortiAP Profiles option.
Optional: Make sure that your access points broadcast the SSID:
1. Check the SSIDs column of the profile that your access points use.
  
  If the column shows All Tunnel Mode SSIDs for each radio and you selected the Tunnel traffic mode, the access points broadcast the SSID automatically. In this case, skip the next step.
2. Otherwise, double-click the profile. For each radio, in the SSIDs field, select the Manual option, and select the SSID that you created. Then, click on the OK button.
  
  Note:
  The Manual option replaces the automatic list of SSIDs. Also select all other SSIDs that the radio must broadcast.
Optional: If you selected the Tunnel traffic mode, add the SSID to the firewall policy. Select the Policy & Objects > Firewall Policy option, and double-click the firewall policy that you created earlier. In the Incoming interface field, click on the + icon, select the SSID that you created, and click on the OK button.

Note:
If you do not have a firewall policy yet, create one as described in the following section: Create a firewall policy.

Result: You created a separate SSID that authenticates IoT devices by their MAC address using the Portnox Cloud RADIUS server on the basis of MAC-based accounts.

Optional: Create an SSID for IPSK authentication

This is an optional task. Follow this task only if you want to authenticate devices using RADIUS-based identity pre-shared keys (IPSK). FortiGate calls this feature MPSK (Multiple Pre-Shared Keys). Skip this task if you do not need IPSK authentication.

For more information about IPSK in Portnox Cloud, see the following topic: Create a MAC-based account.

Important:

You cannot use the same SSID for both WPA2/WPA3 Enterprise authentication and IPSK authentication. Create a separate SSID for IPSK, as described in this section.

In the FortiGate web interface, in the left-hand side menu, select the WiFi & Switch Controller > SSIDs option.
Click on the Create New button, and select the SSID option.
On the Create New SSID screen, configure the general settings:
1. In the Name field, enter a name for the SSID interface.
  
  The FortiGate uses this name to identify the SSID in other settings, such as firewall policies.
2. In the Traffic mode field, select the Tunnel or the Bridge option, as required by your network design.
  
  If you are not sure, select the Tunnel option.
Optional: If you selected the Tunnel option, in the Address section, activate the DHCP Server option, and leave the remaining settings at their default values.

Note:
The network settings are not part of the authentication setup. Configure them as required by your network design.
In the WiFi Settings section, in the SSID field, enter the network name that devices see when they search for Wi-Fi networks.
In the Security Mode Settings section:
1. In the Security mode field, select the WPA2 Personal option.
2. In the Pre-shared Key section, in the Mode field, select the Multiple option.
3. In the MPSK profile field, click on the Create button.
In the New MPSK Profile pane, configure the MPSK profile:
1. In the Name field, enter a name for the profile.
2. In the Type field, leave the WPA2 Personal option selected.
3. Leave the MPSK external server authentication option deactivated.
4. In the MPSK group list section, click on the Add button.
  
  Note:
  The FortiGate does not save an MPSK profile without a group and a key. You create them in the following steps.
In the New MPSK Group pane, configure the MPSK group:
1. In the Name field, enter a name for the group.
2. In the VLAN type field, leave the No VLAN option selected.
3. In the MPSK key list section, click on the Add button.
In the New MPSK Key pane, configure the MPSK key:

Note:
Devices get their keys from Portnox Cloud and never use this key. The FortiGate requires it only to save the MPSK profile.
1. In the Name field, enter a name for the key.
2. In the Type field, leave the WPA2 Personal option selected.
3. In the Pre-shared key field, enter a long, random string of characters.
  
  You can type random keys on the keyboard. You do not need to know or remember this passphrase.
4. Leave the remaining fields at their default values, and click on the OK button.
In the New MPSK Group pane, click on the OK button.
In the New MPSK Profile pane, click on the OK button.
Configure RADIUS authentication:
1. Activate the RADIUS MAC authentication option, and leave the Authentication timeout field at its default value.
2. In the Client MAC Address Filtering section, activate the RADIUS server option, and select the RADIUS server that you created earlier.
  
  Note:
  To use RadSec, select the RadSec server instead.
Leave the remaining settings at their default values unless your environment requires otherwise, and click on the OK button.
In the left-hand side menu, select the WiFi & Switch Controller > FortiAP Profiles option.
Optional: Make sure that your access points broadcast the SSID:
1. Check the SSIDs column of the profile that your access points use.
  
  If the column shows All Tunnel Mode SSIDs for each radio and you selected the Tunnel traffic mode, the access points broadcast the SSID automatically. In this case, skip the next step.
2. Otherwise, double-click the profile. For each radio, in the SSIDs field, select the Manual option, and select the SSID that you created. Then, click on the OK button.
  
  Note:
  The Manual option replaces the automatic list of SSIDs. Also select all other SSIDs that the radio must broadcast.
Optional: If you selected the Tunnel traffic mode, add the SSID to the firewall policy. Select the Policy & Objects > Firewall Policy option, and double-click the firewall policy that you created earlier. In the Incoming interface field, click on the + icon, select the SSID that you created, and click on the OK button.

Note:
If you do not have a firewall policy yet, create one as described in the following section: Create a firewall policy.

Result: You created a separate SSID that authenticates devices using identity pre-shared keys from Portnox Cloud.

Legacy setups

The following section applies only to older Fortinet setups.

Warning:

This topic contains documentation prepared by our support agents more than 12 months ago. It may not cover the newest models or the newest interfaces of NAS devices. We’re working on bringing you updated documentation for NAS devices in the near future. However, the methods of setting up third-party devices may still change when the manufacturers update their firmware or release new models.

FortiWLC

The following is a configuration process for the FortiWLC series of controllers, based on FortiWLC 50D with FortiOS 8.3.

In the FortiOS web interface, navigate to Configuration > Security > RADIUS, and click on Add to add a RADIUS server.
1. Specify a RADIUS Profile Name for the RADIUS server.
2. Set the RADIUS Server Timeout to 20 seconds.
3. Enter your Cloud RADIUS details.
Navigate to Configuration > Security > RADIUS, and click on Add to add a RADIUS accounting server.
1. Specify a RADIUS Profile Name for the RADIUS accounting server.
2. Set the RADIUS Server Timeout to 20 seconds.
3. Enter your Cloud RADIUS details.
  
  Note:
  The server IP and the secret are the same for both authentication and accounting, only ports are different.
Navigate to Configuration > Security > Profile, and click on Add to add a new security profile.
1. Specify a Security Profile Name.
2. In Security Mode, select WPA2/CCMP-AES.
3. In Primary RADIUS Profile Name, select the RADIUS server that you created in previous steps.
Navigate to Configuration > Wireless > ESS, and click on Add to add a new ESS profile.
1. In ESS Profile, specify a name for the ESS profile.
2. In SSID, specify the WLAN SSID.
3. In Security Profile, select the security profile you created in previous steps.
4. In Primary RADIUS Accounting Server, select the RADIUS accounting server that you created in previous steps.