What you'll need
- Admin access to your FortiGate GUI, plus CLI access for one verification step
- The MyWiFi RADIUS server host, shared secret, and ports from your MyWiFi device registration screen
- Someone who can create or check a firewall local-in policy — inbound traffic on port 1003 from your guest VLAN must be allowed (covered below)
Steps
- In your FortiGate GUI, go to WiFi & Switch Controller > SSIDs and create or edit your guest SSID. Set Security Mode to "Captive Portal," Portal Type to "External," and paste your MyWiFi splash page URL into the External Web Server field.
- Create a firewall address object for MyWiFi's portal IPs and add it to the captive-portal exemption (walled garden) list, so guests can reach your splash page before they've authenticated.
- In User & Authentication > RADIUS Servers, add MyWiFi's RADIUS server (host, shared secret, ports 1812/1813). Create a user group that references this RADIUS server, then assign that group to your SSID's "Permitted user groups" setting.
- In the FortiGate CLI, confirm your local-in policy allows inbound TCP on port 1003 from your guest VLAN subnet to the FortiGate interface IP (
config firewall local-in-policy). This is the step most commonly missed, and without it, guest logins fail with no visible error — the completed login never makes it back to the firewall. - In the MyWiFi dashboard, go to Devices and click Add Device.
- Select the Location, name the device, and under Select Your Hardware choose Fortinet FortiGate/FortiAP.
- Enter your FortiGate interface IP and any other connection details as prompted, and save.
Best practice: If your FortiGate's captive portal interface uses a self-signed certificate, some guests' browsers will silently block the login handoff on port 1003, producing intermittent "stuck on login" complaints. Install a CA-signed certificate on that interface to avoid this.
Comments
Please sign in to leave a comment.