Technical Tip: Configure FortiGate v7.4.5+ / v7.6.1+ to allow access_token in URL Parameters from FortiNAC v7.4.3+

This article describes how to enable the 'access_token' parameter in the URL for a FortiGate API request as a work-around to avoid API key being removed from FortiNAC.

Starting from FortiGate FortiOS v7.4.5 and 7.6.1, API requests no longer allow the access_token as a URL parameter by default. Consequently, FortiNAC will fail to update ports/switch VLANs on a FortiSwitch in FortiLink mode. When this occurs, the API key is removed from the FortiGate device model in FortiNAC.

Affects non-RADIUS-enabled FortiSwitch ports where FortiNAC relies on APIs to make changes.

Example of behavior:

1. Navigate to Network -> Inventory and add the FortiGate.
2. Right-click the FortiGate device model and select Model Configuration.
3. Enter API key generated by FortiGate in the Fortigate API Token field.
4. Navigate back to Inventory.
5. Right-click the FortiGate device model and select Resync Interface a couple times.
6. Once the FortiSwitch ports are displayed in the Ports view, double click on a port to display the Port Properties window.
7. Change the VLAN id in the Current VLAN to the desired VLAN id and select OK.
8. Display the Model Configuration page again and the FortiGate API Token field is now empty.

The following messages are also seen in the output.master file:

Fortigate.switchPortVlanMS_API VLAN API failed for port 366

Fortigate.switchPortVlanMS_API port state API failed

Fortigate.switchPortVlan returning false