Skip to main content

FortiGate - Passpoint Configuration

Configure Passpoint (Hotspot 2.0) on Fortinet FortiGate and FortiAP access points to enable automatic WiFi authentication through IronWifi's cloud RADIUS service. This eliminates manual network selection and provides WPA2/WPA3-Enterprise security across your wireless infrastructure.

Supported Platforms​

  • FortiGate - Integrated wireless controller
  • FortiAP - Managed access points
  • FortiWLC - Standalone wireless controller

Prerequisites​

In FortiGate:​

  • FortiGate with FortiOS 6.4 or later
  • FortiAP with firmware supporting Hotspot 2.0
  • Valid FortiCare license for wireless features

In IronWifi Console (complete these first):​

  1. Log in to IronWifi Management Console
  2. Navigate to Networks > select your network
  3. Enable Passpoint
  4. Note the following:
    • RADIUS Server IPs
    • RADIUS Secret
    • NAI Realm
    • Roaming Consortium OIs

FortiGate Configuration​

GUI Configuration​

Step 1: Configure RADIUS Server​

  1. Log in to FortiGate GUI
  2. Go to User & Authentication > RADIUS Servers
  3. Click Create New
  4. Configure:
    • Name: IronWifi
    • Primary Server IP/Name: IronWifi RADIUS IP
    • Primary Server Secret: Your RADIUS secret
    • Authentication Port: 1812
    • Accounting Port: 1813
  5. Click OK

Step 2: Create User Group​

  1. Go to User & Authentication > User Groups
  2. Click Create New
  3. Configure:
    • Name: Passpoint-Users
    • Type: Firewall
    • Remote Groups: Add IronWifi RADIUS server
  4. Click OK

Step 3: Configure Hotspot 2.0 Profile​

  1. Go to WiFi & Switch Controller > Hotspot 2.0
  2. Click Create New under HS2.0 Profiles
  3. Configure:

General:

  • Name: IronWifi-Passpoint
  • Internet: Enable
  • Hotspot 2.0: Enable

Venue Information:

  • Venue Group: Business
  • Venue Type: Unspecified

Network Authentication Type:

  • Type: Acceptance of terms and conditions (or as needed)

Step 4: Configure Domain Name​

  1. In HS2.0 profile, find Domain Name
  2. Add: ironwifi.net

Step 5: Configure Roaming Consortium​

  1. Go to Hotspot 2.0 > HS2.0 Roaming Consortium

  2. Click Create New

  3. Add:

    • Name: OpenRoaming-Settled
    • OI: 5A03BA0000

  4. Repeat for:

    • Name: OpenRoaming-Free
    • OI: 004096

  5. Associate with HS2.0 profile

Step 6: Configure NAI Realm​

  1. Go to Hotspot 2.0 > HS2.0 NAI Realm
  2. Click Create New
  3. Configure:
    • Name: IronWifi-Realm
    • NAI: ironwifi.com
    • Encoding: UTF-8
    • EAP Method: EAP-TTLS
    • Auth: Credentials
    • Inner EAP: PAP
  4. Associate with HS2.0 profile

Step 7: Create SSID​

  1. Go to WiFi & Switch Controller > SSIDs
  2. Click Create New
  3. Configure:

Interface:

  • Name: Passpoint
  • Type: WiFi SSID

WiFi Settings:

  • SSID: Passpoint
  • Security Mode: WPA2-Enterprise
  • Authentication: RADIUS Server (IronWifi)

Hotspot 2.0:

  • Hotspot 2.0: Enable
  • HS2.0 Profile: IronWifi-Passpoint
  1. Click OK

Step 8: Apply to FortiAP​

  1. Go to WiFi & Switch Controller > Managed FortiAPs
  2. Select target APs
  3. Assign SSID profile
  4. Apply configuration

CLI Configuration​

# RADIUS Server
config user radius
    edit "IronWifi"
        set server "1.2.3.4"
        set secret your-secret
        set auth-type auto
    next
end

# User Group
config user group
    edit "Passpoint-Users"
        set member "IronWifi"
    next
end

# Hotspot 2.0 Roaming Consortium
config wireless-controller hotspot20 hs-profile
    edit "IronWifi-Passpoint"
        set internet enable
        set venue-group business
        set venue-type unspecified
        set domain-name "ironwifi.net"
    next
end

# NAI Realm
config wireless-controller hotspot20 nai-realm
    edit "IronWifi-Realm"
        set realm "ironwifi.com"
        set encoding utf8
        config eap-method
            edit 1
                set method eap-ttls
                set auth credentials
            next
        end
    next
end

# Roaming Consortium
config wireless-controller hotspot20 roaming-consortium
    edit "OpenRoaming-Settled"
        set oi "5A03BA0000"
    next
    edit "OpenRoaming-Free"
        set oi "004096"
    next
end

# SSID with Hotspot 2.0
config wireless-controller vap
    edit "Passpoint"
        set ssid "Passpoint"
        set security wpa2-only-enterprise
        set auth usergroup
        set usergroup "Passpoint-Users"
        set radius-server "IronWifi"
        set hotspot20-profile "IronWifi-Passpoint"
    next
end

# Apply to FortiAP Profile
config wireless-controller wtp-profile
    edit "FAP-Profile"
        config radio-1
            set vaps "Passpoint"
        end
    next
end

Advanced Configuration​

3GPP Cellular Information​

For carrier integration:

config wireless-controller hotspot20 hs-profile
    edit "IronWifi-Passpoint"
        config 3gpp-plmn
            edit 1
                set mcc "310"
                set mnc "410"
            next
        end
    next
end

WAN Metrics​

Configure link metrics:

config wireless-controller hotspot20 hs-profile
    edit "IronWifi-Passpoint"
        set wan-metrics-link-status up
        set wan-metrics-symmetric-link enable
        set wan-metrics-downlink-speed 100000
        set wan-metrics-uplink-speed 50000
    next
end

Connection Capability​

Define allowed protocols:

config wireless-controller hotspot20 hs-profile
    edit "IronWifi-Passpoint"
        config conn-cap
            edit 1
                set protocol tcp
                set port 80
                set status open
            next
            edit 2
                set protocol tcp
                set port 443
                set status open
            next
        end
    next
end

Operator Icons​

Add operator branding:

config wireless-controller hotspot20 icon
    edit "IronWifi-Icon"
        set lang "eng"
        set width 64
        set height 64
        set type png
        set file "icon.png"
    next
end

Firewall Policy​

Create policy for Passpoint users:

config firewall policy
    edit 0
        set name "Passpoint-Internet"
        set srcintf "Passpoint"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set groups "Passpoint-Users"
    next
end

Troubleshooting​

Network Not Discovered​

  1. Verify Hotspot 2.0 Status

    diagnose wireless-controller wlac -c vap

  2. Check HS2.0 Profile

    diagnose wireless-controller wlac -c hs20

  3. Verify FortiAP Configuration

    diagnose wireless-controller wlac -c wtp

Authentication Failures​

  1. Test RADIUS Connectivity

    diagnose test authserver radius IronWifi mschap2 username password

  2. Check RADIUS Debug

    diagnose debug application radiusd -1
    diagnose debug enable

  3. Review Logs

    execute log filter device disk
    execute log filter category event
    execute log display

Debug Commands​

# Show Hotspot 2.0 status
diagnose wireless-controller wlac -c hs20-profile

# Show client associations
diagnose wireless-controller wlac -c sta

# Show RADIUS statistics
diagnose wireless-controller wlac -c radius

# Debug wireless
diagnose debug application wpad -1
diagnose debug enable

Best Practices​

  1. Firmware: Use FortiOS 7.0+ for best Passpoint support
  2. FortiAP: Ensure APs support Hotspot 2.0 (check datasheet)
  3. Testing: Test with multiple Passpoint clients
  4. Monitoring: Use FortiAnalyzer for detailed logs
  5. Security: Implement proper firewall policies
  6. Redundancy: Configure backup RADIUS servers