Skip to main contentSkip to search
Skip to main content

FortiGate - Passpoint Configuration

Configure Passpoint (Hotspot 2.0) on Fortinet FortiGate and FortiAP access points to enable automatic WiFi authentication through IronWiFi's cloud RADIUS service. This eliminates manual network selection and provides WPA2/WPA3-Enterprise security across your wireless infrastructure.

Supported Platforms​

  • FortiGate - Integrated wireless controller
  • FortiAP - Managed access points
  • FortiWLC - Standalone wireless controller

Prerequisites​

In FortiGate:​

  • FortiGate with FortiOS 6.4 or later
  • FortiAP with firmware supporting Hotspot 2.0
  • Valid FortiCare license for wireless features

In IronWiFi Console (complete these first):​

  1. Log in to IronWiFi Management Console
  2. Navigate to Networks > select your network
  3. Enable Passpoint
  4. Note the following:
    • RADIUS Server IPs
    • RADIUS Secret
    • NAI Realm
    • Roaming Consortium OIs

FortiGate Configuration​

GUI Configuration​

Step 1: Configure RADIUS Server​

  1. Log in to FortiGate GUI
  2. Go to User & Authentication > RADIUS Servers
  3. Click Create New
  4. Configure:
    • Name: IronWiFi
    • Primary Server IP/Name: IronWiFi RADIUS IP
    • Primary Server Secret: Your RADIUS secret
    • Authentication Port: Customer Authentication Port
    • Accounting Port: Customer Accounting Port
  5. Click OK

Step 2: Create User Group​

  1. Go to User & Authentication > User Groups
  2. Click Create New
  3. Configure:
    • Name: Passpoint-Users
    • Type: Firewall
    • Remote Groups: Add IronWiFi RADIUS server
  4. Click OK

Step 3: Configure Hotspot 2.0 Profile​

  1. Go to WiFi & Switch Controller > Hotspot 2.0
  2. Click Create New under HS2.0 Profiles
  3. Configure:

General:

  • Name: IronWiFi-Passpoint
  • Internet: Enable
  • Hotspot 2.0: Enable

Venue Information:

  • Venue Group: Business
  • Venue Type: Unspecified

Network Authentication Type:

  • Type: Acceptance of terms and conditions (or as needed)

Step 4: Configure Domain Name​

  1. In HS2.0 profile, find Domain Name
  2. Add: 
    ironwifi.net

Step 5: Configure Roaming Consortium​

  1. Go to Hotspot 2.0 > HS2.0 Roaming Consortium

  2. Click Create New

  3. Add:

    • Name: OpenRoaming-Settlement-Free
    • OI: 
      5A03BA0000

  4. Repeat for:

    • Name: Cisco-OpenRoaming
    • OI: 
      004096

  5. Associate with HS2.0 profile

Step 6: Configure NAI Realm​

  1. Go to Hotspot 2.0 > HS2.0 NAI Realm
  2. Click Create New
  3. Configure:
    • Name: IronWiFi-Realm
    • NAI: 
      ironwifi.com
    • Encoding: UTF-8
    • EAP Method: EAP-TTLS
    • Auth: Credentials
    • Inner EAP: PAP
  4. Associate with HS2.0 profile

Step 7: Create SSID​

  1. Go to WiFi & Switch Controller > SSIDs
  2. Click Create New
  3. Configure:

Interface:

  • Name: Passpoint
  • Type: WiFi SSID

WiFi Settings:

  • SSID: Passpoint
  • Security Mode: WPA2-Enterprise
  • Authentication: RADIUS Server (IronWiFi)

Hotspot 2.0:

  • Hotspot 2.0: Enable
  • HS2.0 Profile: IronWiFi-Passpoint
  1. Click OK

Step 8: Apply to FortiAP​

  1. Go to WiFi & Switch Controller > Managed FortiAPs
  2. Select target APs
  3. Assign SSID profile
  4. Apply configuration

CLI Configuration​

Advanced Configuration​

3GPP Cellular Information​

For carrier integration:

WAN Metrics​

Configure link metrics:

Connection Capability​

Define allowed protocols:

Operator Icons​

Add operator branding:

Firewall Policy​

Create policy for Passpoint users:

Troubleshooting​

Network Not Discovered​

  1. Verify Hotspot 2.0 Status

    diagnose wireless-controller wlac -c vap

  2. Check HS2.0 Profile

    diagnose wireless-controller wlac -c hs20

  3. Verify FortiAP Configuration

    diagnose wireless-controller wlac -c wtp

Authentication Failures​

  1. Test RADIUS Connectivity

  2. Check RADIUS Debug

  3. Review Logs

Debug Commands​

Best Practices​

  1. Firmware: Use FortiOS 7.0+ for best Passpoint support
  2. FortiAP: Ensure APs support Hotspot 2.0 (check datasheet)
  3. Testing: Test with multiple Passpoint clients
  4. Monitoring: Use FortiAnalyzer for detailed logs
  5. Security: Implement proper firewall policies
  6. Redundancy: Configure backup RADIUS servers

Same vendor

Standards & reference

Was this page helpful?