FortiGate Captive Portal
Setup Guide

1 6-step setup overview

As of September 2026, CaptiFi integrates with Fortinet through the FortiGate's external captive portal plus RADIUS authentication. The FortiGate wireless controller redirects each new guest to your CaptiFi sign-in page. When the guest submits the form, CaptiFi adds the device to its RADIUS allow-list and hands the sign-in back to the FortiGate, which confirms it against radius.captifi.io before letting the guest online. Tunnel mode and bridge mode both work. FortiAPs managed by FortiLAN Cloud without a FortiGate are not covered by this guide: contact support about those.

Step 1	Create the Fortinet location in CaptiFi to get your portal URL, shared secret and NAS identifier.
Step 2	Add CaptiFi as a RADIUS server on the FortiGate and put it in a firewall user group.
Step 3	Set the guest SSID to Captive Portal with an external authentication portal at your CaptiFi URL.
Step 4	Exempt the CaptiFi hosts so the sign-in page loads before authentication.
Step 5	Set the authentication timeout to your CaptiFi session length.
Step 6	Test end to end.

2 Create the location in CaptiFi

Log in to my.captifi.io, go to My Locations → Add location (or choose your hardware during onboarding) and select Fortinet FortiAP. Give the location a name and finish the wizard. CaptiFi then shows your portal URL, the RADIUS server details, a shared secret and a NAS identifier, plus a FortiGate configuration pack your network team can paste in: keep these to hand for the next steps. The wizard shows when the FortiGate has started sending RADIUS traffic and when the first guest has reached the sign-in page.

Your portal URL has this form (replace YOUR_SITE_ID with the site ID from your dashboard):

Portal URL	app.captifi.io/guest/fortinet/YOUR_SITE_ID

3 Add CaptiFi as a RADIUS server and create the user group

The FortiGate puts guests online using RADIUS. After a guest submits the sign-in form, the FortiGate sends an Access-Request to CaptiFi's RADIUS server, which accepts the device CaptiFi has just authorised. Without this step guests see the sign-in page but never get internet.

Go to User & Authentication → RADIUS Servers → Create New and enter:

Name	CaptiFi-RADIUS
Authentication method	PAP
Primary server IP/Name	radius.captifi.io
Primary server secret	The shared secret shown in your CaptiFi dashboard

The form has no port fields: the FortiGate sends RADIUS to UDP 1812 by default, which is what CaptiFi listens on. Only change radius-port under config system global if your FortiGate has already been moved off it. Accounting is not required.

Then go to User & Authentication → User Groups → Create New, choose type Firewall, name the group CaptiFi-Guests and add CaptiFi-RADIUS under Remote Groups.

The NAS identifier is set in the CLI only, on FortiOS 7.2.4 or later. Open the CLI console and enter the block below with the shared secret and NAS identifier from your CaptiFi dashboard (it also creates the user group, so you can run it instead of the GUI steps above):

4 Configure the guest SSID captive portal

Go to WiFi & Switch Controller → SSIDs and open your guest SSID, or create one. The settings differ slightly between tunnel mode and bridge mode, so follow the one that matches your SSID.

Tunnel mode

Security mode	Captive Portal (on FortiOS 7.6 this is a Captive Portal toggle under the security mode)
Portal type	Authentication
Authentication portal	External, with your CaptiFi portal URL from step 2 (no https://)
User groups	CaptiFi-Guests
Exempt destinations and services	The CaptiFi hosts from step 5 with HTTP, HTTPS and DNS, once you have created the address objects

CLI equivalent:

Bridge mode

In bridge mode (local bridging) the portal type is External Authentication, and the RADIUS server is chosen on the SSID itself rather than through the user group. Bridge-mode venues should email hello@captifi.io with their FortiOS version before go-live so we can check the hand-off with them.

5 Add the exempt destinations (walled garden)

Exempt destinations are the FortiGate's walled garden: hosts a guest can reach before they have authenticated. Without them the sign-in page cannot load. Create an address object for each host under Policy & Objects → Addresses → Create New, all five with Type set to FQDN. Enter *.captifi.io as an FQDN value with its wildcard; the separate Wildcard FQDN Addresses table cannot be used here. Put the five objects in a security exempt list named CaptiFi-Exempt with the services HTTP, HTTPS and DNS, and select it on the guest SSID:

• app.captifi.io Copy
• captifi.io Copy
• *.captifi.io Copy
• fonts.googleapis.com Copy
• fonts.gstatic.com Copy

6 Set the authentication timeout

By default the FortiGate signs an authenticated user out after 5 minutes idle, which would drop your guests part way through a visit. Go to User & Authentication → Authentication Settings and set Authentication Timeout to your CaptiFi session length in minutes (1 to 1440; for example 240 for a four-hour session). On the same page enable Redirect HTTP Challenge to a Secure Channel (HTTPS) so the sign-in hand-off between CaptiFi and the FortiGate is encrypted.

The GUI value is an idle timeout. To make it a hard timeout, so the session ends at the set length even while the guest is active, set the type in the CLI:

7 Test the solution

Connect a phone or laptop to the guest WiFi. The CaptiFi sign-in page should appear automatically. On some devices you may need to open a browser and visit an HTTP site (for example http://example.com) to trigger the redirect. Complete the sign-in form: you should have internet access within a few seconds.

Check the guest landed in your CaptiFi dashboard under Guest Visits. If the guest shows up there, you are live.

Works with your existing Fortinet kit, or use our included device

You do not need to buy anything new. There are two paths: your existing kit works on every plan, and the plug-and-play device is included with every plan.

Use your existing Fortinet kit	If you already run FortiAPs from a FortiGate, follow the steps above. CaptiFi sits in front as the external portal and RADIUS server. No extra hardware.
Use our included plug-and-play device	No FortiGate, or you would rather your IT team did not touch it? We post you a pre-configured CaptiFi device. Plug it into your existing network by Ethernet, enter its 8-digit activation PIN from your phone, and it pulls its config from the cloud. Guest WiFi is live in about five minutes, start to finish, with no controller, static IP or firewall change.

Related guides and pages

FortiGate captive portal FAQ