Can FortiNAC identify where I connect a FortiAP and dynamically assign a management VLAN?

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

FNAC by default will treat APs as network device (WAP Uplink) and will not push/enforce any policy on the switch port.
This can be changed on the global config shown below:

Using tunneled SSID is preferred since the switch will see only the MAC address of the AP, user traffic will be encapsulated in CAPWAP tunnel.

Hi!     advance config real enterprise solution

I use dynamic port policy on the fortigate,   Create one and based on mac or device family FortiAp  assign a 8021X policy.  Then the 8021X policy has to be port based, then assign the dynamic port policy to all ports, the port will require authentication from FortiAp.  The FortiAp will send  a username and password for validation(because now fortiap support 8021x). The Forti switch will contact the radius server ( i use microsoft nps network policy server role base free addon on windows) or fortinac and they will send all the vlans necessary in a tag or untag form, so in that way you can connect the FortiAp in whatever port it will be configured automatically. Create a second rule inside the dynamic port policy to match any other devices using mac wildcard **:**:**:**.  This second rule will match all other devices , and assigned a policy that is mac based , so you can  authenticate 20 different pc, ip phones, printers etc and based on user/mac or user name, the radius will send the configured vlan on its rules or policy. I did this for everything all ports on the switch are configured equally.  The radius and windows ad do all the job. You need 8021x on each domain pc, you need a username (mac type) for devices that can not send usernames to be create on windows Ad. You need a domain certificate , windows Certicate Ca role. This certificate will be uploaded on a printer that support 8021x, also upload this domain certificate to each FortiAp or ip phone. Radius will use eap/peap for secure authentication. Then add FortiEms to your enterprise and use tags on each  fortigate policy to validate the posture of the pc/server and you are done 90% + security enable cheers.