Skip to content

Commit 8ee4399

Browse files
jthillerjthiller
authored
Fortinet Guide (#2010)
1 parent b335e8e commit 8ee4399

File tree

2 files changed

+188
-0
lines changed

2 files changed

+188
-0
lines changed

‎docs/network-mobile/data-only-guides/data-only-fortinet.mdx‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
---
2+
id: data-only-fortinet
3+
title: Fortinet Conversion Guide
4+
pagination_label: Fortinet Conversion Guide
5+
sidebar_label: Fortinet Conversion Guide
6+
description: Helium Network Conversion Documentation
7+
image: https://docs.helium.com/img/link-image.png
8+
slug: /mobile/data-only-fortinet
9+
---
10+
11+
import useBaseUrl from '@docusaurus/useBaseUrl'
12+
13+
### Prerequisites
14+
15+
**On an Intel-based Machine with Docker Installed:**
16+
17+
- The Intel-based machine has a private IP in your network reachable from your Fortinet FortiGate
18+
box.
19+
- ACLs or Firewalls allow Fortinet FortiGate box and Docker Container to communicate UDP on port
20+
1812 and 1813.
21+
- ACLs or Firewalls allow container/host to reach the internet on TCP ports 2083 and 3802.
22+
23+
#### RadSecProxy Container Deployment
24+
25+
1. Un-zip and untar the [`Helium_RadSec_Docker.tar.gz`](https://github.com/novalabsxyz/radsec-proxy)
26+
file into the directory of your choice on the host machine.
27+
28+
```shell
29+
tar -xvzf Helium_RadSec_Docker.tar.gz
30+
```
31+
32+
This will unpack the following items:
33+
34+
1. Dockerfile - The docker instructions on how to build the container
35+
1. Radsecproxy.conf - The radsecproxy config file is pre-populated to connect to Helium Network AAA servers
36+
1. docker-compose.yml - File to start and stop the container as a daemon.
37+
38+
Into the same directory, copy the 3 certificates obtained from Helium
39+
40+
- ca.pem - the root CA certificate
41+
- cert.pem - the user certificate
42+
- key.pem - the key file matched to the certificate
43+
44+
Start the container using `sudo docker compose up -d`. If/when needed, stop the container using:
45+
`sudo docker compose down`.
46+
47+
### Configure Fortinet FortiGate
48+
49+
On the FortiGate CLI with FortiOS 7.0.2+
50+
51+
1. Add the local RadSecProxy as the RADIUS server by replacing the \<radsecproxy-ip-addr\> to the
52+
current RadSecProxy container IP address. Also, use the NAS ID used during onboarding to Helium
53+
for \<radsecproxy-ip-addr\>
54+
55+
```shell
56+
config user radius
57+
edit "Helium RadSecProxy"
58+
set server "<radsecproxy-ip-addr>"
59+
set secret mysecret
60+
set nas-id-type custom
61+
set nas-id "<custom-nas-id>"
62+
set radius-coa enable
63+
set radius-port 1812
64+
config accounting-server
65+
edit 1
66+
set status enable
67+
set server "<radsecproxy-ip-addr>"
68+
set secret mysecret
69+
set port 1813
70+
next
71+
end
72+
next
73+
end
74+
```
75+
76+
2. Set the type of IP address available to subscribers connecting to your Hotspot 2.0 network.
77+
78+
```shell
79+
config wireless-controller hotspot20 anqp-ip-address-type
80+
edit "ipv4-single-NATed-private"
81+
set ipv4-address-type single-NATed-private
82+
next
83+
end
84+
```
85+
86+
3. Define a Venue Name and configure its duple by replacing \<any-venue-name\> to the desired value.
87+
88+
```shell
89+
config wireless-controller hotspot20 anqp-venue-name
90+
edit "<any-venue-name>"
91+
config value-list
92+
edit 1
93+
set value "<any-venue-name>"
94+
next
95+
end
96+
next
97+
end
98+
```
99+
100+
4. Define “Helium” as the Operator Name.
101+
102+
```shell
103+
config wireless-controller hotspot20 h2qp-operator-name
104+
edit "Helium"
105+
config value-list
106+
edit 1
107+
set value "Helium"
108+
next
109+
end
110+
next
111+
end
112+
```
113+
114+
5. Add Helium Mobile's NAI Realms.
115+
116+
```shell
117+
config wireless-controller hotspot20 anqp-nai-realm
118+
edit "Helium_NAI_Realm"
119+
config nai-list
120+
edit "freedomfi.com"
121+
set nai-realm "freedomfi.com"
122+
config eap-method
123+
edit 1
124+
set method eap-tls
125+
config auth-param
126+
edit 1
127+
set id credential
128+
set val cred-certificate
129+
next
130+
end
131+
next
132+
end
133+
next
134+
edit "hellohelium.com"
135+
set nai-realm "hellohelium.com"
136+
config eap-method
137+
edit 1
138+
set method eap-tls
139+
config auth-param
140+
edit 1
141+
set id credential
142+
set val cred-certificate
143+
next
144+
end
145+
next
146+
end
147+
next
148+
end
149+
next
150+
end
151+
```
152+
153+
6. Configure the Passpoint Profile by linking the previously added NAI Realms, 3GPP Cellular
154+
Networks, and the type of IP address available to subscribers connecting to your Hotspot 2.0,
155+
among other parameters.
156+
157+
```shell
158+
config wireless-controller hotspot20 hs-profile
159+
edit "Helium"
160+
set access-network-type chargeable-public-network
161+
set access-network-internet enable
162+
set venue-group business
163+
set domain-name "freedomfi.com"
164+
set venue-name "<any-venue-name>"
165+
set nai-realm "Helium_NAI_Realm"
166+
set ip-addr-type "ipv4-single-NATed-private"
167+
next
168+
end
169+
```
170+
171+
7. As the final step, set a Virtual Access Point (VAP) by linking the previously added “Helium
172+
RadSecProxy” RADIUS server, and the “Helium” Passpoint Profile, among other parameters.
173+
174+
```shell
175+
config wireless-controller vap
176+
edit "Helium"
177+
set ssid "Helium"
178+
set security wpa2-only-enterprise
179+
set auth radius
180+
set radius-server "Helium RadSecProxy"
181+
set intra-vap-privacy enable
182+
set schedule "always"
183+
set hotspot20-profile "Helium"
184+
next
185+
end
186+
```

‎sidebarsDocs.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ module.exports = {
99
{
1010
type: 'category',
1111
label: 'Convert WiFi Networks',
12+
collapsed: false,
1213
link: { type: 'doc', id: 'network-mobile/data-only-mobile' },
1314
items: [
1415
{
@@ -19,6 +20,7 @@ module.exports = {
1920
'network-mobile/data-only-guides/data-only-onboarding',
2021
'network-mobile/data-only-guides/data-only-radsecproxy',
2122
'network-mobile/data-only-guides/data-only-aruba',
23+
'network-mobile/data-only-guides/data-only-fortinet',
2224
'network-mobile/data-only-guides/data-only-juniper-mist',
2325
'network-mobile/data-only-guides/data-only-meraki',
2426
'network-mobile/data-only-guides/data-only-mikrotik',

0 commit comments

Comments
 (0)