FortiGate Integration

In Captivo: Settings → RADIUS → add the FortiGate's source IP and the same shared secret as a NAS client. RADIUS ports 1812/1813 (UDP) must be reachable from the FortiGate.

User & Authentication → RADIUS Servers → Create New. Primary Server = your Captivo RADIUS address, Secret = your shared secret, Authentication method = PAP. Then create a User Group (User & Authentication → User Groups, type Firewall) and add this RADIUS server to it.

config user radius
  edit "captivo"
    set server "<captivo-radius-ip>"
    set secret <shared-secret>
    set auth-type pap
  next
end
config user group
  edit "captivo-guests"
    set member "captivo"
  next
end

WiFi & Switch Controller → SSIDs → Create New → SSID. Security mode = Captive Portal (not WPA-Enterprise). Enable Captive Portal, Portal type = Authentication, Authentication portal = Local (FortiGate-hosted), and set User Groups to the captivo-guests group from step 1.

config wireless-controller vap
  edit "guest-wifi"
    set ssid "Guest WiFi"
    set security captive-portal
    set portal-type auth
    set selected-usergroups "captivo-guests"
  next
end

System → Replacement Messages → category Authentication → 'Login Page'. Paste the FortiGate HTML downloaded from Settings → Portal → Templates. (For a per-SSID page, set portal-message-override-group on the vap.) The page POSTs to FortiGate's %%post_action%% with magic + username + password — exactly what the Captivo template produces, so no edits are needed.

# per-SSID override (optional)
config wireless-controller vap
  edit "guest-wifi"
    set portal-message-override-group "captivo-login"
  next
end

Before signing in, the guest must be able to reach Captivo; otherwise the portal can't load or request the SMS code. Exempt that destination from the captive portal with a firewall policy (or the interface security-exempt-list).

# exempt destination from captive portal
# create an FQDN address object for app.captivo.io first
config firewall policy
  edit 0
    set name "captivo-exempt"
    set srcintf "guest-wifi"
    set dstintf "wan1"
    set dstaddr "app.captivo.io"
    set action accept
    set schedule "always"
    set service "ALL"
    set captive-portal-exempt enable
  next
end