Point FortiAP access points managed by a FortiGate at CaptiFi with an external captive portal plus RADIUS. Guests sign in on your branded page and their details land in your dashboard, ready for review requests and marketing. Works in tunnel mode and bridge mode.
As of September 2026, CaptiFi integrates with Fortinet through the FortiGate's external captive portal plus RADIUS authentication. The FortiGate wireless controller redirects each new guest to your CaptiFi sign-in page. When the guest submits the form, CaptiFi adds the device to its RADIUS allow-list and hands the sign-in back to the FortiGate, which confirms it against radius.captifi.io before letting the guest online. Tunnel mode and bridge mode both work. FortiAPs managed by FortiLAN Cloud without a FortiGate are not covered by this guide: contact support about those.
| Step 1 | Create the Fortinet location in CaptiFi to get your portal URL, shared secret and NAS identifier. |
|---|---|
| Step 2 | Add CaptiFi as a RADIUS server on the FortiGate and put it in a firewall user group. |
| Step 3 | Set the guest SSID to Captive Portal with an external authentication portal at your CaptiFi URL. |
| Step 4 | Exempt the CaptiFi hosts so the sign-in page loads before authentication. |
| Step 5 | Set the authentication timeout to your CaptiFi session length. |
| Step 6 | Test end to end. |
Log in to my.captifi.io, go to My Locations → Add location (or choose your hardware during onboarding) and select Fortinet FortiAP. Give the location a name and finish the wizard. CaptiFi then shows your portal URL, RADIUS shared secret and NAS identifier: keep these to hand for the next steps.
Your portal URL has this form (replace YOUR_SITE_ID with the site ID from your dashboard):
| Portal URL | app.captifi.io/guest/fortinet/YOUR_SITE_ID |
|---|
http:// or https://: the FortiGate's external portal field does not accept a scheme. The FortiGate appends the guest's MAC address and its own session parameters to this URL itself, so do not add anything after your site ID.The FortiGate puts guests online using RADIUS. After a guest submits the sign-in form, the FortiGate sends an Access-Request to CaptiFi's RADIUS server, which accepts the device CaptiFi has just authorised. Without this step guests see the sign-in page but never get internet.
Go to User & Authentication → RADIUS Servers → Create New and enter:
| Name | CaptiFi-RADIUS |
|---|---|
| Authentication method | PAP |
| Primary server IP/Name | radius.captifi.io |
| Primary server secret | The shared secret shown in your CaptiFi dashboard |
The form has no port fields: the FortiGate sends RADIUS to UDP 1812 by default, which is what CaptiFi listens on. Only change radius-port under config system global if your FortiGate has already been moved off it. Accounting is not required.
Then go to User & Authentication → User Groups → Create New, choose type Firewall, name the group CaptiFi-Guests and add CaptiFi-RADIUS under Remote Groups.
The NAS identifier is set in the CLI only, on FortiOS 7.2.4 or later. Open the CLI console and enter the block below with the shared secret and NAS identifier from your CaptiFi dashboard (it also creates the user group, so you can run it instead of the GUI steps above):
Go to WiFi & Switch Controller → SSIDs and open your guest SSID, or create one. The settings differ slightly between tunnel mode and bridge mode, so follow the one that matches your SSID.
| Security mode | Captive Portal (on FortiOS 7.6 this is a Captive Portal toggle under the security mode) |
|---|---|
| Portal type | Authentication |
| Authentication portal | External, with your CaptiFi portal URL from step 2 (no https://) |
| User groups | CaptiFi-Guests |
| Exempt destinations and services | The CaptiFi hosts from step 5 with HTTP, HTTPS and DNS, once you have created the address objects |
CLI equivalent:
In bridge mode (local bridging) the portal type is External Authentication, and the RADIUS server is chosen on the SSID itself rather than through the user group. Bridge-mode venues should email hello@captifi.io with their FortiOS version before go-live so we can check the hand-off with them.
Exempt destinations are the FortiGate's walled garden: hosts a guest can reach before they have authenticated. Without them the sign-in page cannot load. Create an address object for each host under Policy & Objects → Addresses → Create New, all five with Type set to FQDN. Enter *.captifi.io as an FQDN value with its wildcard; the separate Wildcard FQDN Addresses table cannot be used here. Put the five objects in a security exempt list named CaptiFi-Exempt with the services HTTP, HTTPS and DNS, and select it on the guest SSID:
By default the FortiGate signs an authenticated user out after 5 minutes idle, which would drop your guests part way through a visit. Go to User & Authentication → Authentication Settings and set Authentication Timeout to your CaptiFi session length in minutes (1 to 1440; for example 240 for a four-hour session). On the same page enable Redirect HTTP Challenge to a Secure Channel (HTTPS) so the sign-in hand-off between CaptiFi and the FortiGate is encrypted.
The GUI value is an idle timeout. To make it a hard timeout, so the session ends at the set length even while the guest is active, set the type in the CLI:
Connect a phone or laptop to the guest WiFi. The CaptiFi sign-in page should appear automatically. On some devices you may need to open a browser and visit an HTTP site (for example http://example.com) to trigger the redirect. Complete the sign-in form: you should have internet access within a few seconds.
Check the guest landed in your CaptiFi dashboard under Guest Visits. If the guest shows up there, you are live.
You do not need to buy anything new. There are two paths and both are included with your plan.
| Use your existing Fortinet kit | If you already run FortiAPs from a FortiGate, follow the steps above. CaptiFi sits in front as the external portal and RADIUS server. No extra hardware. |
|---|---|
| Use our included plug-and-play device | No FortiGate, or you would rather your IT team did not touch it? We post you a pre-configured CaptiFi device. Plug it into your existing network by Ethernet, it pulls its config from the cloud, and a guest SSID appears in about two minutes. It needs no controller, static IP or firewall change. |
As of September 2026, CaptiFi supports FortiAP access points managed by a FortiGate wireless controller running FortiOS 7.0 or later, in tunnel mode or bridge mode. The FortiGate needs FortiOS 7.2.4 or later to set a custom NAS identifier; on older firmware, email hello@captifi.io with your FortiGate hostname (or the HA group name on a cluster) instead. FortiAPs managed by FortiLAN Cloud without a FortiGate are not covered: contact support to talk through your setup.
Check that the guest SSID's security mode is Captive Portal, the portal type is Authentication (tunnel mode) or External Authentication (bridge mode), and the authentication portal is External with an address that matches your dashboard exactly, with no http:// or https:// in front. If the browser reports the portal as unreachable, the exempt destinations are missing: add app.captifi.io, captifi.io and *.captifi.io to the security exempt list selected on the SSID.
That is the RADIUS step. The CaptiFi RADIUS server (radius.captifi.io, UDP 1812, authentication method PAP) must exist on the FortiGate, be a member of the user group selected on the guest SSID (or be the SSID's RADIUS server in bridge mode), and carry the NAS identifier shown in your dashboard. If guests see "Access denied" after signing in, the shared secret does not match: copy and paste it from your CaptiFi dashboard.
The FortiGate's default authentication timeout is 5 minutes idle. Set Authentication Timeout under User & Authentication → Authentication Settings to your CaptiFi session length in minutes (the GUI value is an idle timeout), then in the CLI set auth-timeout-type hard-timeout under config user setting so the session runs for the full length.
Guests may need to visit an HTTP site first (for example http://example.com) to trigger the portal redirect. This is standard captive portal behaviour on every vendor's hardware: HTTPS traffic cannot be transparently redirected.
Yes. Each location has its own splash page design, portal URL, shared secret and NAS identifier, managed under My Locations in your CaptiFi dashboard. Each additional CaptiFi location beyond the one included in your plan is charged at your currency's extra-venue rate.
CaptiFi partners resell at a 30-40% wholesale margin, with white-label available at the same wholesale rates. You set your own retail price and bill your clients directly. The full wholesale rate card is published in six currencies (GBP, USD, EUR, CAD, AUD and NZD).
Start a free 30-day trial, or watch a live demo first.