Captive Portal No Internet After Authentication: Missing Firewall Policy
An administrator configures a captive portal on the FortiGate to authenticate guest users via a local user database. Users can connect to the SSID, but after entering credentials on the captive portal, they are not redirected to the internet. What is the most likely missing configuration?
Quick Answer
The answer is a missing firewall policy that allows traffic from the captive portal interface to the internet with the appropriate user group. This is correct because the captive portal authentication process only validates the user’s identity; once authenticated, the FortiGate still needs an explicit firewall policy to permit the traffic from that interface to its destination, with the user group specified in the policy’s source. Without this policy, the authentication succeeds but the traffic is blocked, leaving users with no internet after authentication. On the Fortinet NSE 4 exam, this scenario tests your understanding of how captive portal integrates with firewall policies—a common trap is assuming authentication alone grants access. Remember the memory tip: “Auth opens the door, but the policy is the key.”
⚠ Common exam trap
Many candidates assume captive portal authentication alone grants internet access, but FortiGate requires a separate firewall policy with the authenticated user group to allow traffic, and the exam tests this distinction between authentication and authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A firewall policy allowing traffic from the captive portal interface to the internet with the user group
A captive portal authenticates users but does not automatically grant network access. A firewall policy must explicitly allow traffic from the captive portal interface to the internet and include the authenticated user group as a source. Without this policy, even after successful authentication, traffic is dropped and users are not redirected to the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A firewall policy allowing traffic from the captive portal interface to the internet with the user group
Why this is correct
After authentication, traffic must match a policy. If missing, traffic is dropped.
- ✗
The DNS server is not configured on the FortiGate
Why it's wrong here
DNS is needed for name resolution but not for forwarding authenticated traffic.
- ✗
The captive portal timeout is set too low
Why it's wrong here
Timeout affects session duration, not initial connectivity.
- ✗
The SSID is not configured with the captive portal security mode
Why it's wrong here
If SSID is not configured correctly, users wouldn't even connect.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator configures a captive portal on a VDOM to authenticate users connecting to a guest SSID. The authentication method is set to LDAP. Users can reach the captive portal login page, but after entering valid credentials, they receive an authentication failure. The LDAP server is reachable from the FortiGate. What is the MOST likely cause?
medium- ✓ A.The user is not a member of the configured user group
- B.The captive portal is using HTTP instead of HTTPS
- C.The captive portal interface is not in the same VDOM as the LDAP server
- D.The LDAP server requires TLS and FortiGate is using plain LDAP
Why A: The most likely cause is that the user is not a member of the configured user group. In FortiGate, when LDAP authentication is used for a captive portal, the FortiGate first verifies the user's credentials against the LDAP server. Even if the credentials are valid, the FortiGate then checks whether the authenticated user belongs to a specific user group that is permitted to access the captive portal. If the user is not a member of that group, the authentication fails, even though the LDAP server itself accepts the credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.