Technical Tip: Authenticate MDM hosts that use random MAC addresses
Description
This article describes the use of 'Certificate-Based Device Identification' in the RADIUS server configuration to authenticate MDM-managed hosts successfully even when they use random MAC addresses to access the network.
Scope
FortiNAC.
Solution
FortiNAC usually relies on a host's MAC address to identify and authenticate the device. This can create challenges when the host uses a randomized MAC address to access the network.
In environments where devices authenticate using EAP-TLS and certificates are provisioned through an MDM solution, certificate attributes can be used for device identification. This allows FortiNAC to recognize and authenticate the host based on its certificate information, even when the MAC address changes due to randomization.
This feature can be enabled in RADIUS -> Virtual Servers:
Supported attributes are (DeviceIdPrefixAttribute):
TLS-Client-Cert-Subject-Alt-Name-Uri (default).
TLS-Client-Cert-Subject-Alt-Name-Email.
TLS-Client-Cert-Subject-Alt-Name-Dns.
TLS-Client-Cert-Common-Name.
The default prefix (DeviceIdPrefix) is set to 'deviceid' or 'intunedeviceid'.
In cases where the certificates have already been enrolled with different attributes, this behavior can be modified using the globaloption tool.
Example 1: Change to support Email and DNS in the preferred order:
execute enter-shell
globaloptiontool -name "localRadiusServer.tlsCertDeviceIdPrefixAttribute" -set "TLS-Client-Cert-Subject-Alt-Name-Email,TLS-Client-Cert-Subject-Alt-Name-Dns"
Example 2: Change the prefix to 'EBdeviceID':
execute enter-shell
globaloptiontool -name "localRadiusServer.tlsCertDeviceIdPrefix" -set "EBdeviceID:"
For troubleshooting, the following debug commands can be enabled:
diagnose debug plugin enable RadiusAccess
diagnose tail -f output.master | grep RadiusAccess
.
2026-08-04 14:22:10.124 01:01:01:01:01:01 - Checking if TLS certificate contains an MDM Device Identifier
2026-08-04 14:22:10.124 01:01:01:01:01:01 - TLS certificate attribute lookup by prefix
2026-08-04 14:22:10.124 01:01:01:01:01:01 - Testing certificate attribute by prefix: TLS-Client-Cert-Subject-Alt-Name-Email
2026-08-04 14:22:10.125 01:01:01:01:01:01 - Found MDM Device Identifier: MdmDeviceIdentifier [vendor=MSINTUNE, id=ab7e24ec-a7c3-48f7-7096-127451891fd14]
2026-08-04 14:22:10.128 01:01:01:01:01:01 - GetClient: Client found for MAC [01:01:01:01:01:01]
2026-08-04 14:22:10.130 01:01:01:01:01:01 - Update Client: PC223.domain.eu [01:01:01:01:01:01]
Related documents:
