Compatibility

Social WiFi has been tested and is proven to work on the following configurations:

FortiWiFi – wireless interfaces

• FortiOS version 5.6.0 and above (tested up to 7.0.1)

FortiGate hardware or virtual machine – wired interfaces

• recommended: FortiOS version 6.2.4 and above (tested up to 7.0.1)
• FortiOS version 5.6.0 and above work if the captive portal is enabled on a physical interface, VLAN interfaces are not supported below FortiOS 6.2.4

1. Access the device’s configuration panel

This guide assumes using the web based UI of the controller, which you can access by entering the IP address of the device in your browser. The screenshots are based on firmware v5.6.2.

Alternatively, if your device is managed from FortiCloud, you can access the management UI from there.

2. RADIUS configuration

Go to User & Device → RADIUS Servers → Create New and use the following settings:

Click OK to save.

Now you need to change the RADIUS port to 31812. Open the CLI Console (top right corner, between “help” and your username).

Copy (ctrl+C) and paste (ctrl+V) or type the following commands:
config user radius
    edit "Social WiFi"
        set radius-port 31812
    next
end


Then close the CLI console by clicking the “x” button in the top right corner.

3. Remote Group configuration

Go to User & Device → User Groups → Create New and use the following settings:

Under Remote Groups, click Add and then select Social WiFi from the Remote Server dropdown list. Click OK to save and then click OK again.

4. Walled Garden configuration

Now we need to add all the services that will be available without logging in. This list includes Social WiFi login page and third-party social login services (like Facebook, Google). The following guide assumes firmware version 5.6.2, which doesn’t support domains with wildcard (e.g. “*.facebook.com”). Using wildcards was added in firmware 6.2.2, so if you have that version or higher, you may adjust the following steps accordingly.

The suggested way to add all required entries, is to use the CLI again to copy (ctrl+C) and paste (ctrl+V) the following scripts. Please note, that the script is split into two parts, because there’s a length limit that cannot be exceeded.

Note: A regional Google domains according to your geogrpahic location has to be added to make Google login work. Please edit the “Social WiFi – Google 1 – regional” value below accordingly, e.g. if you’re based in UK, add “accounts.google.co.uk”.

Part 1:

# Social WiFi main service
config firewall address
edit "Social WiFi - main 1"
set type fqdn
set fqdn "login.socialwifi.com"
next
edit "Social WiFi - main 2"
set type fqdn
set fqdn "sw-login.com"
next
end
config firewall addrgrp
edit "Social WiFI - main"
set member "Social WiFi - main 1" "Social WiFi - main 2"
next
end
 
# Facebook remarketing pixel
config firewall address
edit "Social WiFi - Facebook pixel 1"
set type fqdn
set fqdn "connect.facebook.net"
next
edit "Social WiFi - Facebook pixel 2"
set type fqdn
set fqdn "www.facebook.com"
next
end
config firewall addrgrp
edit "Social WiFI - Facebook pixel"
set member "Social WiFi - Facebook pixel 1" "Social WiFi - Facebook pixel 2"
next
end
 
# Google remarketing tag
config firewall address
edit "Social WiFi - Google tag 1"
set type fqdn
set fqdn "www.googletagmanager.com"
next
edit "Social WiFi - Google tag 2"
set type fqdn
set fqdn "www.googleadservices.com"
next
edit "Social WiFi - Google tag 3"
set type fqdn
set fqdn "googleads.g.doubleclick.net"
next
end
config firewall addrgrp
edit "Social WiFI - Google tag"
set member "Social WiFi - Google tag 1" "Social WiFi - Google tag 2" "Social WiFi - Google tag 3"
next
end
 
# Google login
config firewall address
edit "Social WiFi - Google 1 - regional"
set type fqdn
set fqdn "accounts.google.co.uk"
next
edit "Social WiFi - Google 2"
set type fqdn
set fqdn "accounts.google.com"
next
edit "Social WiFi - Google 3"
set type fqdn
set fqdn "ssl.gstatic.com"
next
edit "Social WiFi - Google 4"
set type fqdn
set fqdn "fonts.gstatic.com"
next
edit "Social WiFi - Google 5"
set type fqdn
set fqdn "accounts.youtube.com"
next
edit "Social WiFi - Google 6"
set type fqdn
set fqdn "content.googleapis.com"
next
edit "Social WiFi - Google 7"
set type fqdn
set fqdn "apis.google.com"
next
end
config firewall addrgrp
edit "Social WiFi - Google"
set member "Social WiFi - Google 1 - regional" "Social WiFi - Google 2" "Social WiFi - Google 3" "Social WiFi - Google 4" "Social WiFi - Google 5" "Social WiFi - Google 6" "Social WiFi - Google 7"
next
end
 
# Facebook login
config firewall address
edit "Social WiFi - Facebook 1"
set type fqdn
set fqdn "www.facebook.com"
next
edit "Social WiFi - Facebook 2"
set type fqdn
set fqdn "facebook.com"
next
edit "Social WiFi - Facebook 3"
set type fqdn
set fqdn "static.xx.fbcdn.net"
next
edit "Social WiFi - Facebook 4"
set type fqdn
set fqdn "external-frt3-2.xx.fbcdn.net"
next
end
config firewall addrgrp
edit "Social WiFi - Facebook"
set member "Social WiFi - Facebook 1" "Social WiFi - Facebook 2" "Social WiFi - Facebook 3" "Social WiFi - Facebook 4"
next
end

Part 2:

# Twitter login
config firewall address
edit "Social WiFi - Twitter 1"
set type fqdn
set fqdn "twitter.com"
next
edit "Social WiFi - Twitter 2"
set type fqdn
set fqdn "api.twitter.com"
next
edit "Social WiFi - Twitter 3"
set type fqdn
set fqdn "pbs.twimg.com"
next
edit "Social WiFi - Twitter 4"
set type fqdn
set fqdn "abs-0.twimg.com"
next
edit "Social WiFi - Twitter 5"
set type fqdn
set fqdn "abs.twimg.com"
next
end
config firewall addrgrp
edit "Social WiFi - Twitter"
set member "Social WiFi - Twitter 1" "Social WiFi - Twitter 2" "Social WiFi - Twitter 3" "Social WiFi - Twitter 4" "Social WiFi - Twitter 5"
next
end
 
# LinkedIn login
config firewall address
edit "Social WiFi - LinkedIn 1"
set type fqdn
set fqdn "www.linkedin.com"
next
edit "Social WiFi - LinkedIn 2"
set type fqdn
set fqdn "static-exp1.licdn.com"
next
edit "Social WiFi - LinkedIn 3"
set type fqdn
set fqdn "media-exp1.licdn.com"
next
edit "Social WiFi - LinkedIn 4"
set type fqdn
set fqdn "static.licdn.com"
next
end
config firewall addrgrp
edit "Social WiFi - LinkedIn"
set member "Social WiFi - LinkedIn 1" "Social WiFi - LinkedIn 2" "Social WiFi - LinkedIn 3" "Social WiFi - LinkedIn 4"
next
end
 
# Group everything in one group
config firewall addrgrp
edit "Social WiFi"
set member "Social WiFI - main" "Social WiFI - Facebook pixel" "Social WiFI - Google tag" "Social WiFi - Google" "Social WiFi - Facebook" "Social WiFi - Twitter" "Social WiFi - LinkedIn"
next
end

5a. WiFi configuration (wireless interface)

Go to WiFi & Switch Controller → SSID → Create New → SSID and use the following settings.
If you already have an exisiting WiFi network, edit it accordingly instead (you can skip to the “WiFi Settings” part).

Interface configuration:

WiFi Settings:

Click OK to save.

5b. Interface configuration (wired interface)

You can also run Social WiFi on a wired, physical interface and plug access points there. In this scenario those access points don’t have to be managed by the FortiGate unit.

Go to Network → Interfaces and double-click on the interface that you want to install Social WiFi on.
If the interface hasn’t been configured before, follow the basic interface configuration from the previous step, to configure IP address and DHCP server.

Scroll down to Admission Control section from the Security Mode dropdown, pick Captive Portal. Then use the following settings:

Click OK to save.

6. Firewall configuration

You need to allow for traffic from guests using the WiFi, because the default policy is to deny all traffic.

Go to Policy & Objects → IPv4 Policy → Create New and use the following settings:

Click OK to save.

7. Add the device to Social WiFi Panel

The setup of the controller is now finished. The last step is to add the MAC address(es) to the Social WiFi platform.
Usually the MAC address will be printed on a label on the device itself. It should be visible in the GUI as well on the edit interface screen. If you don’t know the MAC address, please contact Social WiFi Support.

Now, switch to Social WiFi Panel, go to Access Points tab, click the Add button and paste the MAC address(es). Click Create.

8. Test the solution

Connect with the WiFi network. You should see a login page. Go through the login process and, once finished, you should have internet access. You should see first connections and authorizations in the Social WiFi Panel’s statistics section.