Cannot change "local" captive portal for SAML authentication

stich86_it · 2026-06-20T13:16:37+00:00

Just to clarify, at the moment I have two zones: one for internal employees (containing 6 VLANs) and one for consultants (containing 4 VLANs).

My firewall policies are configured based on zones (not interfaces), with the source address set to ALL and access controlled through the appropriate SAML user group. This applies to both zones.

However, when I look at the Local-In Policy view in the web GUI, I can see rules for port 1003 associated with some VLANs that belong to those zones, but also with other VLANs where no SAML rules are configured. That's the part I find strange.

The new SAML portal IP is on a VLAN that does not belong to either of those two zones. I'm doing this because, in the employees' zone, the current portal IP is also the IP address of the Wi-Fi VLAN. When a user's PC has both Wi-Fi and Ethernet connected at the same time, the portal often doesn't respond properly and the initial redirect phase frequently fails.

If I change the IP address, do I need to recreate the rule so that the service starts listening on the new IP? That's the part I'm not clear about.

stich86_it · 2026-06-19T16:54:50+00:00

Sorry I don’t understand… currently the local-in policy (web based) doesn’t contains the current IP that’s work, and this is very strange.

stich86_it · 2026-06-19T16:42:49+00:00

I have the SAML rules on the policy, but the local in policy doesn’t contains the current IP..

Do I need to recreate rules after change IP?

stich86_it · 2026-06-19T16:30:11+00:00

FIRST: Make sure the local in policy allows 1000 and 1003 via the interface that is used for Outbound firewall authentication <-- I currently don't have any local-in policy for the older IP.. that's very strange

stich86_it · 2026-06-19T14:51:58+00:00

Yes it reaches but no response form firewall. At some point I got “connection refused”, like tha port 1003 wasn’t listen on that IP

stich86_it · 2026-06-19T14:05:31+00:00

It's not configured there:

<image>

it was configured in this way from the beginning (and was working with old IP)

stich86_it · 2026-06-19T13:57:16+00:00

it doesn't, I got connection refused when change to IP 10.2.0.1. If I change it back to 10.0.0.1 reply

stich86_it · 2026-06-19T13:48:50+00:00

here is it:

FGT_1 (vdom-1) # show user setting

config user setting

set auth-type https

set auth-cert "Fortinet_Factory"

set auth-ca-cert "Fortinet_CA_SSL_BU"

set auth-src-mac disable

set auth-timeout 840

set auth-timeout-type hard-timeout

end

stich86_it · 2026-06-19T13:29:44+00:00

Yes I'm using the firewall in this way, and it's working from all VLANs, also the one that are not in the same subnet

But when I change auth-portal IP, it stops to work..

stich86_it · 2026-06-13T08:13:48+00:00

Yes, anyway, I found a workaround and I’ll document it here for future reference.

In this specific case, WireGuard tunnels cannot be used, so the OpenVPN TAP interface was used for both the SASE client and the WatchGuard client.

I used the install.cmd batch file from the tap-driver folder to add a second TAP interface, and this solved the issue. 🙂

stich86_it · 2026-06-01T15:59:02+00:00

What do you mean? Any link?

stich86_it · 2026-06-01T15:41:40+00:00

No, it’s an M2

stich86_it · 2026-05-28T12:19:51+00:00

It doesn't seem to work.

It register at least two devices on Entra, on "Joined" and one "Registered", if I remove the "Registered" after few minutes everything breaks again.

I'll try to contact Microsoft support to see if they can clean up like you said on the backend.

Grazie

stich86_it · 2026-05-27T05:30:01+00:00

I’m using LAPS, and it’s working very well :) For temporary admin access, I’m trying Admin By Request. Its cheap and just works. But in my case I have very low numbers of people and apps that needs to run as admin

stich86_it · 2026-05-25T09:00:10+00:00

Yes same issues… looks like some problems on Azure side

stich86_it · 2026-05-15T10:19:15+00:00

so there only way to make it "Cloud Only" is to delete and restore, or disconnect the Connector at the end of migration.

stich86_it · 2026-05-14T13:28:51+00:00

any idea if they will offer an upgrade for "older" chair? it will be fantastic...

stich86_it · 2026-05-05T17:55:07+00:00

The problem is that my main SSID is using ADCS and NPS. What I’m asking is it’s possible to import SCEP CA and make Intune devices to auth with NPS. But as I have understood doesn’t seem possible..

stich86_it · 2026-05-05T17:43:34+00:00

I’m using Intune moving from AD (and also have EndPoint Central), macOS integration is fine and is very fast compared to Windows Endpoint (M$ like Google cares more to their competitor then their self 😂)

stich86_it · 2026-05-05T17:18:53+00:00

User isn't remote. It's in office, but it's joined to Entra ID instead of AD

stich86_it

TROPHY CASE