SuperUser

Question

FortiNAC and WiFi remediation

Forum|Forum|11 months ago
August 28, 2025
10 replies
1650 views

Hi again FNAC admins

FortiNAC-F 7.2.9.
Ruckus ZD1200 10.x WLC

I have one single isolation VLAN for quarantine, dead-end and registration.

VLAN switching works now fine via RADIUS DM. Tested it by disabling adapter or disabling host, and it moves it instantly to isolation.

The issue now is with quarantine: For wired connection it works well, i.e.: host is quarantined instantly when it fails scan. But for WiFi it doesn't move it to quarantine.

With tcpdump we can see RADIUS DM is sent to the WLC, but the host never moves to isolation. DM are still sent periodically by FNAC, like if it is still trying.

Disconnecting the host from WiFi and reconnecting again still put it in prod VLAN.

Force remediation (group) enabled on the SSID, and quarantine VLAN configured for the SSID as well.

Did I miss something?

FortiNAC

Anthony_E

Staff

Hi Adbelkrim,

I hope you are doing well.

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Anthony

Best Regards

AEKAuthor

SuperUser

Thanks Anthony, I appreciate.

AEK

Anthony_E

Staff

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

Best Regards

Anthony_E

Staff

@ebilcari, Hello,

Sorry to tag you, but maybe you can help Abdlekrim as FortiNAC expert?

Thanks a lot in advance.

Regards,

Anthony

Best Regards

ebilcari

Staff

Based on the description it seems like 'Forced Remediation' is not being applied in the SSID or the WLC/AP is not accepting dynamic VLAN assignment. Have you enforced Remediation directly at the SSID configurations or in the device Model configuration?

Have you performed a packet capture of the RADIUS traffic, is FNAC sending the quarantine VLAN when the host is at risk?

Emirjon

Anthony_E

Staff

Thanks a lot as always!

Best Regards

AEKAuthor

SuperUser

Thanks Anthony & Emirjon

Based on the description it seems like 'Forced Remediation' is not being applied in the SSID

-> Actually I enabled it in the SSID Port Group Membership, and set in model config the right VLAN

or the WLC/AP is not accepting dynamic VLAN assignment.

-> I confirm the WLC/AP accepts dyn VLAN assignment, since it works very well when I disable the host, it goes instantly to the isolation VLAN (same as remediation VLAN)

Have you enforced Remediation directly at the SSID configurations or in the device Model configuration?

-> I did in SSID config, and then I did it in both SSID and dev model config at the same time, but still the same result

Have you performed a packet capture of the RADIUS traffic, is FNAC sending the quarantine VLAN when the host is at risk?

-> Yes I did with tcpdump we can see RADIUS DM is sent to the WLC, but the At-Risk host never moves to isolation. The thing I noticed is that multiple DM are still sent periodically by FNAC, like if it is still trying.

Also as mentioned, on my L2 switches the At-Risk hosts are properly moved to remediation without any issue.

AEK

ebilcari

Staff

What is happening after this DM messages are sent to the WLC?

The host should be disconnected from the SSID and connected again, but this time FNAC should respond with the Quarantine VLAN. I tried to emulate the same using a FAP/FGT, this are the output of the radius logs:

88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: [Post-Auth] Process Started - NAS IP=10.0.10.1 / Source IP=10.0.10.1 (DefaultConfig)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using device: ManagedElem: GW (10.0.10.1) [ID=55]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using edge device: ManagedElem: FP421xxxxx (10.5.32.54 / 70:4C:A5xxxxx) [ID=105]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using port: None
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using vdom: ManagedElem: GW:VDOM root (10.0.10.1:0) [ID=56]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: Processing post-auth using ssid: ManagedElem: GW:SSID root:A-Por (null:0) [ID=107]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: Processing post-auth using client: 88:46:04:xxxxxx (MAB)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: OkToProcess: Checking SSID - Use Custom Config=true
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: OkToProcess: true / SSID Mode = Local
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:257 :: #139583 :: Enforcement Action - Host At Risk on Quarantine Enforced SSID
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: Get Enforcement Action returned: EnforcementStateAction [accessValue=VLAN_511, action=2, logicalNetworkName=Remediation]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: Enforcement Action = Enforce (AccessValue=VLAN_511)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: ConvertAccessValue [VLAN_511]: redirectSource = IfName, redirectDest = PortID
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:259 :: #139583 :: ConvertAccessValue: New policy is: 511
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:260 :: #139583 :: Using response attrs for ssid [107] / Logical Network [Remediation]

Kindly check the RADIUS logs of your setup and focus in the [Post-Auth] part. Keeping a packet capture running can also help:

# execute tcpdump port 1812 or port 3799 and host 10.x.x.x -v

Emirjon

AEKAuthor

SuperUser

Thanks Emirjon

What is happening after this DM messages are sent to the WLC?

The host should be disconnected from the SSID and connected again

-> Yes during all the period in which NAC sends repeatedly the DM messages we feel the client connection flapping up/down, until we clear the At-Risk status then it backs to normal connection. But it never goes to isolation.

I'll run the suggested plan and share the result.

AEK

AEKAuthor

SuperUser

Hi Emirjon

There is some positive update. We just redo the model config of the WLC (and for my FG as well), and it worked successfully. Probably there was a misconfiguration that I didn't notice.

Thanks again for the tips, certainly it will be useful for future similar issues.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO