Technical Tip: How to configure FortiNAC to set host role by using MSCHAPv2 Machine Authentication

1. Set the host as a member of one LDAP security group.
   
   

2. Select the LDAP security group in FortiNAC under System -> Settings -> Authentication -> LDAP.
   
   

   

3. The FortiNAC -F 7.6 creates two groups for the LDAP group under Settings -> Groups. One of them will have a type host and the other one user.
   
   

4. Create a Role under Policy & Objects -> Roles and add the LDAP retrieved group in Groups.
   
   

5. Whenever the host performs an MSCHAPv2 machine-based authentication, FortiNAC will retrieve the LDAP group membership of the host and set the appropriate role.
   
   

6. When a User Host Profile is created with the correct host Role criteria, the host matches the Network Access Policy and FortiNAC assigns the correct VLAN ID.

Related articles:
Technical Tip: Groups imported in FortiNAC does not show any Members listed
Technical Tip: Leveraging Domain Group Membership of Client with EAP-TLS Computer-Based Authentication