Skip to main content
barisben
barisben
New Member
June 17, 2025
Question

FortiNAC-F Dot1x Validate User's Certificate

  • June 17, 2025
  • 1 reply
  • 1630 views

Hello,

 

I will generate CSR, create CA certificate and import it to the FortiNAC-F. After that, I will distribute it to clients. The clients connecting with dot1x and I want to check if the client joined to the domain then it can connect to the network. I added "User-Name=DomainName\*" attribute but I want to add certificate attribute for checking if its joined. How can I do that?

 

 

Screenshot_2.png

 

1 reply

ebilcari
Staff
ebilcari
Staff
June 18, 2025

To easy find the available attributes that can be used in the UHP, you can refer to the 'Endpoint Fingerprints' that are created with the source 'RADIUS Auth Request' as shown below:

 

endpoint fingerprints -RADIUS attributes.PNG

 

A better approach is to allow all the user to authenticate and than use the Persistent Agent to isolate the hosts that are not compliant. This offers more granularity and can be configured to check different conditions in the end hosts. The domain check can be added as a built in custom scan:

 

Custom Scan.PNG

 

Some details can be found in these articles:

Technical Tip: A simple network example of deploying Persistent Agent in FortiNAC

Technical Tip: Monitor Custom scans to ensure a quicker response to host compliance

Emirjon
    barisben
    barisbenAuthor
    New Member
    June 18, 2025

    I forgot to mention. The company doesn't want to use agent, so I have to do this verification this way. Normally, when a user tries to connect to the network in this way, it asks whether they want to trust the certificate once on the first attempt, and then the connection can be established. However, since the agent will not be used and we don't want anyone who hasn't imported this certificate to be able to connect to the network, we want to ensure that if someone without the certificate tries to connect, they are not asked whether they want to trust the certificate, and therefore cannot connect. For these reasons, I want to check this using an attribute here.

    ebilcari
    Staff
    ebilcari
    Staff
    June 18, 2025

    Based on your description, I think you are referring to EAP-PEAP, in this case only the server certificate is verified by the client/supplicant and it's up to the supplicant if it chooses to communicate with the RADIUS server. In this case there isn't any RADIUS attribute that includes any details related to the certificate.

    This will work only if EAP-TLS is used, that has mutual certificate verifications and each client will send its own certificate and it can be uses as a RADIUS attribute.

    Emirjon
      Terms & ConditionsAccessibility statement