Technical Tip: How to change Default VLAN Enforcement on an SSID by using CLI
| Description | This article describes how to change Default VLAN Enforcement on an SSID by using the CLI. |
| Scope | FortiNAC, FortiNAC-F. |
| Solution | FortiNAC does not allow changing Default Wireless VLAN Enforcement to 'deny' or 'bypass' by using the GUI. However, it can be changed by using the CLI. Note: On FortiNAC-F, the commands need to be preceded with 'execute enter-shell'. After learning the DBID of the SSID, Default Enforcement can be changed by using the command below. The following command, which will assign a value of '0', will change the enforcement to 'Deny'. The value '1' represents 'Bypass' and '2' represents 'Enforce'. device -dbid <SSID_DBID> -setAttr -name DefaultAction - value 0
Note: The above change will not reflect on the GUI, and the GUI will still display Default Enforcement's value as 'Enforce'. However, when a host tries to authenticate by using the SSID and if it does not match any Network Access Policy, FortiNAC rejects the authentication request since Default Enforcement is denied. In this case, in the RADIUS service logs, entries like the one below should be displayed. Tue Dec 16 17:18:16 2025 : Auth: (1078) Rejected in post-auth: [DE-AD-BE-EF-CA-FE] (from client 192.168.0.254 port 0 cli DE-AD-BE-EF-CA-FE) |
