Rosa FPortal — FortiGate Internet Access Portal

• Registration form: full name, national ID (checksum-validated), department, mobile, corporate email, device type, note
• The user's IP is detected automatically; MAC is found from the FortiGate device inventory and DHCP leases
• Per-network verification mode: form + OTP, quick SMS login, or form without OTP (goes straight to IT approval)
• 6-digit one-time code sent by SMS or email; valid for 5 minutes by default, max 5 attempts

+8 more

• Separate lists: Pending, Approved, Hotspot Devices, Temporary Devices, In OTP, Rejected, Expired, All
• One-click approval: 4 hours, 8 hours, 1 day, 1 week, 30 days or permanent
• Access duration can be changed after approval; expired permissions close automatically
• Per-network auto-approval: access opens as soon as verification succeeds

+6 more

• Person card: contact details, registered devices, inventory devices and Active Directory match
• Map a person to an AD user and update their department from the AD OU list
• Merge two records of the same person; detach a device from a person and mark it ownerless
• Send a person back to re-apply: records are archived and the form is refilled; restore from archive

+10 more

• Block a device by MAC or IP with a label and reason; the person who blocked it is recorded
• Unblocking: a previously approved device returns to the allow group in the same step
• Temporary user accounts: create, enable/disable, change password, delete

• Live discovery of interfaces/VLANs and static-route (MPLS) networks from FortiGate; one-click registration
• L2 (VLAN, MAC visible) and L3 (routed, IP only) network types
• 4-step network wizard: network definition, DHCP server, portal behavior, rule set and summary
• Per-network allow/block groups and ordered rules: block DENY, portal access, allow ACCEPT, catch-all DENY

+8 more

• Policy list with filters by action, status and group, plus a portal-rules-only view
• New policy: source/destination interface and address, service, ACCEPT/DENY, NAT and logging
• Reorder (up/down), enable/disable and delete policies
• Access profiles: separate allow groups tied to FortiGate web filter and application control profiles

+2 more

• Unapproved clients' queries resolve to the portal IP, so any HTTP address opens the registration form
• Windows, Android and Apple connectivity checks are captured, showing the 'sign in to network' prompt
• Split-horizon: internal domains and private reverse lookups go to the DCs, everything else to public DNS
• Exempted domains resolve normally even for unapproved clients

+4 more

• Mandatory two-step login for admins (TOTP, Google/Microsoft Authenticator compatible)
• An IP is locked for 15 minutes after 8 failed logins; failures are audited
• Passwords stored with PBKDF2-SHA256 (200,000 rounds); admin session lasts 8 hours
• Audit log: every action chained with SHA-256, with actor and time; verified, and resealable by the main admin

+5 more

• Dashboard: request and permission counts, recent actions, CPU/RAM/disk/network (refreshed every 3 s)
• Endpoint hardening summary: domain-joined vs non-domain PCs and agent status
• Multiple admins: add, enable/disable, change password, reset MFA, delete; last login time
• FortiGate connection: management IP, API token, VDOM, allow/block groups; connection test

+6 more

• Runs on an on-premises Linux server with Docker Compose: application, database and reverse proxy containers
• HTTPS 443 (TLS 1.2/1.3, HTTP/2) and HTTP 80; port 8088 for local maintenance; ports configurable
• No FortiGate captive portal setup needed; users go directly to the portal address
• In-server scheduled job: expiries, hotspot sessions, reservations, backup, AD sync, agent scan

+1 more