In this scenario, FortiNAC responds to security incidents based on syslog messages received by FortiAnalyzer.
Flow:
The host in a production VLAN attempts to download a virus file or is blocked access to a web page based on a web filter profile. FortiGate detects the activity through Firewall policies and sends a Syslog message to FortiAnalyzer. FortiAnalyzer filters for UTM syslog events and sends the message to FortiNAC. FortiNAC parses the Syslog message, generates a security event and triggers an alarm based on the Security rules. The alarm action is configured to disable the host. FortiNAC applies (Technical Tip: 'State based Control' concept and VLAN changes) by changing the VLAN to 'Dead End'. The host is isolated on the Layer 2 and can only communicate with FortiNAC acting as DHCP and DNS server in 'Dead End' state.
See Configure Security Incidents for detailed configuration steps.
See the following article to configure 'Dead End' enforcement:Â Technical Tip: Configuring Dead End as Enforcement.
See the following article to troubleshoot parsing issues:Â Troubleshooting Tip: FortiNAC Unable to Parse Syslog sent from FortiAnalyzer and generate a Security Event.
Initially, the host will be blocked to download the infected file. The following shows the web page the end user is presented by FortiGate:
Â
FortiNAC will receive the syslog message from FortiAnalyzer. Executing a tcpdump in FortiNAC CLI will capture the incoming message:
naclab1 # execute tcpdump -i any port 514 -v
tcpdump: data link type LINUX_SLL2
dropped privs to admin
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
16:01:44.475864 port1 In IP (tos 0x0, ttl 62, id 7818, offset 0, flags [DF], proto UDP (17), length 1276)
10.67.4.175.36941 > naclab1.forti.lab.syslog: SYSLOG, length: 1248
Facility local7 (23), Severity warning (4)
Msg: logver=702131762 timestamp=1783958500 devname="FortiHyperV" devid="FGVMXXXXXXXXXXX" vd="root" date=2026-07-13 time=16:01:40 eventtime=1783951300413432898 tz="+0200" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" policyid=4 poluuid="db0d33d4-eac5-51ee-e96b-760a33bbf8db" policytype="policy" msg="File is infected." action="blocked" service="HTTPS" sessionid=145701 srcip=172.16.70.2 dstip=89.238.73.97 srcport=50149 dstport=443 srccountry="Reserved" dstcountry="Germany" srcintf="User_VLAN" srcintfrole="lan" dstintf="port1" dstintfrole="lan" srcuuid="a35d81fc-e898-51ee-e8ac-7bd42adcf5ba" dstuuid="a35d81fc-e898-51ee-e8ac-7bd42adcf5ba" proto=6 direction="incoming" filename="eicar.com.txt" quarskip="Quarantine-disabled" virus="EICAR_TEST_FILE" viruscat="Virus" dtype="av-engine" ref="http://www.fortinet.com/ve?vn=EICAR_TEST_FILE" virusid=2172 url="https://secure.eicar.org/eicar.com.txt" profile="default" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0" httpmethod="GET" analyticscksum="275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"^J
FortiNAC output.master logs will provide information regarding the parsing process and security event generation:
2026-07-13 16:01:44.482 +0200 [com.bsc.plugin.rtr.SecurityEventManager$ProcessSyslogRunnable-0] DEBUG yams.SecurityEventManager - processAsSecurityEvent() starting
2026-07-13 16:01:44.483 +0200 [com.bsc.plugin.rtr.SecurityEventManager$ProcessSyslogRunnable-0] INFO yams - com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - start
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - sourceIP: 172.16.70.2
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - destinationIP: 89.238.73.97
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - type: utm
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - subtype: virus
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - threatID: 0211008192
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - description: File is infected.
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - severity: warning
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - normalized severity: 5
com.bsc.api.selection.rtr.SecurityEventParser.processIntoSecurityEvent() - end
FortiNAC collects the Source IP address of the host and performs a L3 poll in order to identify the Host MAC address where enforcement will be applied:
2026-07-13 16:01:44.485 +0200 [com.bsc.plugin.rtr.SecurityEventManager$ProcessSyslogRunnable-0] DEBUG yams.IPAddressToMac - getByProbeObject() probeName = ProbeTelnet mac = null ip = 172.16.70.2 leaseFileLast = false
2026-07-13 16:01:44.485 +0200 [com.bsc.plugin.rtr.SecurityEventManager$ProcessSyslogRunnable-0] DEBUG yams.IPAddressToMac - getByProbeObject() returning wait = false queue = true retval = Probe
IP Address = 172.16.70.2
MAC Address = C8:A3:62:XX:XX:XX
Device Id = -1
Interface Id = -1
User Name = null
Session Id = -1
Time Captured = Mon Jul 13 15:56:44 CEST 2026
InetAddress = /172.16.70.2
FortiNAC generates a security alarm based on the matching rule:
2026-07-13 16:01:55.171 +0200 [security-alarm-manager-check-pending-task-1] DEBUG yams.SecurityAlarmManager - Added LightweightEvent ID 1478689449426948
2026-07-13 16:01:55.172 +0200 [security-alarm-manager-check-pending-task-1] DEBUG yams.SecurityAlarmManager - com.bsc.plugin.rtr.SecurityAlarmManager.checkForMatches(1478689449467909): Using Source MAC C8:A3:62:XX:XX:XX for Trigger Activity 1478689277988866
2026-07-13 16:01:55.172 +0200 [security-alarm-manager-check-pending-task-1] DEBUG yams.SecurityAlarmManager - com.bsc.plugin.rtr.SecurityAlarmManager.TriggerEvents.add: Tracking event 1478689449467909 for Trigger>Activity Trigger_utm>1478689277988866
The alarm action is set to disable the host. The following shows the host marked as 'Disabled' and FortiNAC changes the VLAN on the connected port:
See Security Incidents for more details.
| 
