FortiNAC - Allowed Host
Hello everyone,
I’m working on a FortiNAC 7.2 deployment and I’m trying to enforce a restriction specifically for guest users.
Goal
Allow each guest user to authenticate and access the network from only one device, preventing the same credentials from being used simultaneously on multiple devices.
Current context
We are using:
Guest Registration / Guest Self-Registration
Captive Portal authentication
Standard FortiNAC host registration
In Settings → User/Host Management there is a global parameter called “Allowed Hosts”, which defines how many devices a user can register.
Additionally, the same parameter exists at the individual user level, where it can be manually overridden per user account.
Problem
The global setting applies to all users, which is not ideal in our scenario.
What we would like to achieve instead is:
Allowed Hosts = 1only for users created through Guest or Guest Self-RegistrationInternal or managed users should not be affected by this limitation.
Questions
Is there a way in FortiNAC 7.2 to apply the Allowed Hosts restriction only to specific user types, such as Guest / Guest Self-Registration users?
Can this be enforced through Guest Portal configuration or registration templates?
Alternatively, is it possible to automate this using a custom script, scheduler task, so that every newly created guest account automatically gets
Allowed Hosts = 1?
The objective is to ensure that once a guest registers and authenticates, the credentials can only be used by the first device registered, preventing multiple devices from using the same account.
If anyone has implemented a similar control or has recommendations on the best approach, I would greatly appreciate your suggestions.
Thanks in advance.