Set up Fortinet FortiGate/FortiAP with MyWiFi

What you'll need

• Admin access to your FortiGate GUI, plus CLI access for one verification step
• The MyWiFi RADIUS server host, shared secret, and ports from your MyWiFi device registration screen — RADIUS is the standard protocol your hardware uses to ask MyWiFi whether a guest may go online
• Someone who can create or check a firewall local-in policy — inbound traffic on port 1003 from your guest VLAN must be allowed (covered below)

Steps

1. In your FortiGate GUI, go to WiFi & Switch Controller > SSIDs and create or edit your guest SSID — the WiFi network name guests see when connecting. Set Security Mode to "Captive Portal" (the mini-browser window a phone opens automatically when a guest joins the network), Portal Type to "External," and paste your MyWiFi splash page URL — the branded login page guests see in that window — into the External Web Server field.
2. Create a firewall address object for MyWiFi's portal IPs and add it to the captive-portal exemption (walled garden) list, so guests can reach your splash page before they've authenticated.
3. In User & Authentication > RADIUS Servers, add MyWiFi's RADIUS server (host, shared secret, ports 1812/1813). Create a user group that references this RADIUS server, then assign that group to your SSID's "Permitted user groups" setting.
4. In the FortiGate CLI, confirm your local-in policy allows inbound TCP on port 1003 from your guest VLAN subnet to the FortiGate interface IP (config firewall local-in-policy). This is the step most commonly missed, and without it, guest logins fail with no visible error — the completed login never makes it back to the firewall.
5. In the MyWiFi dashboard, go to Devices and click Add Device.
6. Select the Location, name the device, and under Select Your Hardware choose Fortinet FortiGate/FortiAP.
7. Enter your FortiGate interface IP and any other connection details as prompted, and save.

Best practice: If your FortiGate's captive portal interface uses a self-signed certificate, some guests' browsers will silently block the login handoff on port 1003, producing intermittent "stuck on login" complaints. Install a CA-signed certificate on that interface to avoid this.

Related articles

• Set up EnGenius Cloud with MyWiFi
• Set up Extreme Networks XIQ with MyWiFi