The user is on the GuestSSID network, which is a separate interface on the FortiGate. The FortiAuthenticator (captive portal) and Windows AD servers are on a different network connected to port3. For an unauthenticated user on the GuestSSID to reach the captive portal page hosted on the FortiAuthenticator, there must be a firewall policy that explicitly permits this traffic flow between the GuestSSID interface and the port3 interface. The existing firewall policy only allows traffic from GuestSSID to port1 (the internet) and is intended for users who have already authenticated. Without a policy allowing access to the authentication servers, the user cannot load the login page.

A. Changing the security mode to WPA2-Enterprise is a completely different authentication method and does not resolve the issue with the existing captive portal setup.

B. The captive portal is configured to use HTTPS (https://10.0.3.254:1003/). Disabling HTTPS redirection would not fix the fundamental lack of network connectivity to the server.

C. The exemption list in the SSID settings allows specific destinations to bypass the captive portal mechanism, but it does not replace the need for a firewall policy to permit traffic between interfaces.

1. FortiOS Administration Guide 7.6 > User & Device > Authentication > Guest users > WiFi guest user captive portal: "You must create two security policies: one for unauthenticated traffic and one for authenticated traffic. The unauthenticated policy must be configured to allow the required traffic, such as DNS and DHCP, and it must be placed above the authenticated policy in the policy list." This guide explicitly states the need for a pre-authentication policy to allow access to necessary services like the external portal.

2. FortiOS Administration Guide 7.6 > Firewall & DoS > Firewall policies > Policies: "Firewall policies control all traffic that attempts to pass through the FortiGate unit between network interfaces, zones, and VLAN sub-interfaces." This confirms that any traffic between the GuestSSID virtual interface and the port3 physical interface requires a firewall policy to be permitted. The exhibits show no such policy exists.