Captive Portal on FortiGate: Purpose and Configuration
Which of the following best describes the purpose of a captive portal on a FortiGate?
Quick Answer
The answer is to authenticate users before granting network access. This is correct because a captive portal on a FortiGate intercepts all HTTP or HTTPS traffic from unauthenticated clients and redirects them to a login page, effectively blocking network resources until the user provides valid credentials or accepts a terms-of-service policy. On the Fortinet NSE 4 Network Security Professional exam, this concept tests your understanding of how FortiGate enforces identity-based access control at the network edge, often appearing in questions about firewall policies, authentication methods, or portal types. A common trap is confusing the captive portal’s purpose with content filtering or bandwidth control—remember, its core job is authentication, not inspection. For the exam, keep this memory tip: “Captive portal catches, authenticates, then releases.”
⚠ Common exam trap
Many exam-takers confuse captive portal with SSL VPN or IPsec VPN, thinking it provides remote access or encryption, when in fact it only performs local network access authentication and does not create a secure tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To authenticate users before granting network access
A captive portal on a FortiGate intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a web-based login page. Once the user provides valid credentials (e.g., via local database, LDAP, or RADIUS), the FortiGate creates an authenticated session, allowing network access. This is a core mechanism for guest Wi-Fi or BYOD onboarding, not for remote access or encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To provide secure remote access to internal resources
Why it's wrong here
That describes VPN.
- ✓
To authenticate users before granting network access
Why this is correct
Captive portal intercepts HTTP traffic and redirects to a login page.
- ✗
To encrypt traffic between sites
Why it's wrong here
That describes IPsec VPN.
- ✗
To block malware from entering the network
Why it's wrong here
That is a security profile function.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What is the primary purpose of the captive portal feature on a FortiGate?
easy- A.To monitor bandwidth usage per user
- B.To block all traffic from unknown IP addresses
- C.To enable SSL VPN connections
- ✓ D.To provide a web-based authentication interface for users connecting through a firewall policy
Why D: The captive portal feature on a FortiGate provides a web-based authentication interface that intercepts HTTP/HTTPS traffic from unauthenticated users and redirects them to a login page. Once the user successfully authenticates (e.g., via local database, LDAP, or RADIUS), the FortiGate dynamically creates a firewall authentication entry, allowing the user's traffic to pass according to the configured firewall policy. This is the primary purpose: to enforce user-based access control through a browser-based authentication mechanism.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.