Skip to main content
jprocha
jprocha
Explorer II
July 22, 2024
Solved

FNAC - Dot1x auto registration role

  • July 22, 2024
  • 2 replies
  • 2631 views

Hello everyone!

 

I am looking to leverage the Dot1x auto registration option on FortiNAC to register devices that log in to my network using WiFi. Yet, I need some way to identify that these guys became registered using this method, so I can apply scans, Net Access Policies and so on. The issue is they get assigned the NAC-Default role and I don't see any option to apply a role as we do on the portal for example, where I can give a BYOD or Guest role for example.

 

Does anyone have any suggestions on how can I apply roles or can think of other ways to leverage this option but still have control of the way the device connected and became registered to the network?

 

Appreciate the help!

 

FortiNAC 

Best answer by scitlak

You can not differentiate users if they used Radius, Persistent Agent, or 802.1x but you may differentiate the hosts that were registered with one of them.
1. 802.1X registered host.
You will have a Radius Fingerprint for this kind of hosts and you will have an "Auth Type" attribute under Adaptors. By using the Radius fingerprint or Auth Type field as criteria in UHP, you may differentiate these hosts.

2. Portal Registered: You may add "Security & Access Value" for Portal registered hosts and by using this attribute you may differentiate these hosts. 

2 replies

ebilcari
Staff
ebilcari
Staff
July 23, 2024

You can use Roles matching with an LDAP group. When a host is registered by a user that exist in one of the LDAP groups, that host will be moved to that group and a role can be applied. The role can be used later on the Network access policy like you mentioned above.

In case of machine authentication the LDAP configuration need to be change a bit, like shown here.

Emirjon
    jprocha
    jprochaAuthor
    Explorer II
    July 23, 2024

    Perfect!

     

    Thank you very much for the reply, will proceed this way.

    Just confirming, there is no way to differentiate users registered via this method from other means like portal/persistent agent correct?

    scitlak
    Staff
    scitlakAnswer
    Staff
    July 24, 2024

    You can not differentiate users if they used Radius, Persistent Agent, or 802.1x but you may differentiate the hosts that were registered with one of them.
    1. 802.1X registered host.
    You will have a Radius Fingerprint for this kind of hosts and you will have an "Auth Type" attribute under Adaptors. By using the Radius fingerprint or Auth Type field as criteria in UHP, you may differentiate these hosts.

    2. Portal Registered: You may add "Security & Access Value" for Portal registered hosts and by using this attribute you may differentiate these hosts. 

      Terms & ConditionsAccessibility statement