Auto-registration of new devices

Question

Hello everyone,

From what I understand, the recommended method to register company assets is to integrate LDAP and enable the option where endpoints with the Persistent Agent get automatically registered once users authenticate with their AD credentials.

So basically, if a user has the agent installed on their laptop and logs in using AD, the device gets automatically registered, please correct me if I’m wrong here.

However, I came across information suggesting this method should mainly be used during the initial onboarding phase and be disabled after.

My question is:
How are new company users/devices automatically registered after that initial onboarding?
Is there a best practice to handle ongoing automatic registration for new assets?

Thanks in advance.

BR,

ebilcari · Accepted Answer

For the host to be automatically registered, the endpoint must be joined to the domain, and the currently logged‑in user that is identified by the Agent, must be found in the directory configured in FNAC. This configuration can be kept permanently enabled, there is no need to disable it afterward. Having a registered host on the network does not necessarily mean it will be automatically placed in production. Network Access Policies can be used to further control VLAN assignment based on additional conditions.

There are different methods to register hosts in FNAC, but using the Agent is always recommended, as it provides the best visibility. You can refer to this guide: https://docs.fortinet.com/document/fortinac-f/7.6.0/corporate-user-device/66397/configure-fortinac-to-automatically-register-the-endpoint-device

or the registration through Passive Agent (SSO):

AEK · Answer

Hi BHIn my opinion this auto register of PA clients should be enabled in the initial deployment so you auto-register the hundreds of your Corp clients, then “should” be disabled after, so the following registrations of PA clients will be manual by some NAC admin (e.g.: you can grant this right to domain admin or helpdesk, depending on your company policy).This is to have control on the registration process, otherwise I guess someone unauthorized can register a new client without intervention of any NAC admin.But is you still need auto-registration of PA clients and you are confident that no unauthorized registration will happen then just leave the feature enabled.

Sign up

Login with SSO

Login to the community

Login with SSO