Possible causes include FortiOS not recognizing/identifying devices connected to FortiSwitch ports configured in embedded NAC mode, or devices remain stuck in the onboarding VLAN and never get matched to their target NAC policy.
This involves the 'fortilinkd' daemon (FortiLink backend), the 'cid' scanner (device identification), and the 'iotd'Â daemon (FortiGuard query service).
Check any crashes on FortiGate to validate any issue on any of these daemons:
diagnose debug crashlog read
If there no detection at all, traffic from the device is not reaching the FortiGate. The CID scanner is passive, so it can only scan traffic that arrives at the FortiGate. If the device only sends ARP or no traffic routes through the FortiGate, no identification occurs.
Enable cid + iotd debugging to see the identification process:
diagnose debug console timestamp enable
diagnose cid debug start
diagnose debug appl cid -1
diagnose debug appl iotd -1
diagnose debug enable
When the device is recognized, check if the device is kept on the onboarding VLAN.
diagnose switch-controller mac-device nac onboarding
Check if the device matches any FortiNAC policy:
diagnose switch-controller mac-device nac known
diagnose switch-controller nac-tag get
Check dynamic firewall addresses (FortiNAC populates these):
diagnose firewall dynamic list
diagnose firewall dynamic address
Check configuration synchronization and connection info on FortiGate:
execute switch-controller get-conn-status
execute switch-controller get-sync-status all
Note:
The FortiNAC feature was designed for untagged traffic only. This is for security purposes to avoid any devices getting access to the network. It was enforced in the v7.4.x release.
| 
