Troubleshooting Tip: Host Operating System incorrectly identified

Description

Scope

FortiNAC.

Solution

FortiNAC uses different sources to collect information about the hosts in the network. The details are shared in Endpoint Fingerprints. Due to the limited visibility, different detection methods may provide partial or outdated information about the host's operating system. In the following example, the same adapter/host appears with different operating systems.

Even though there are multiple sources of information, FortiNAC selects a single source to update the host information. This behavior can be customized using the 'Set Source Rank' option, where priorities can be reordered or sources can be enabled/disabled. By default, the DHCP source is disabled. In some cases, other methods such as the Passive method also need to be disabled. As shown in the previous example, a Windows 11 host was classified as Windows XP/2000. If the Agent was not used in this case, the operating system for this host may be wrongly set as Windows XP/2000.

Related article:

Technical Tip: Track rogue/host profiling data through Endpoint Fingerprints