Fortinac hosts (Laptop) switching external adapter

Forum|Forum|1 year ago
May 12, 2025
3 replies
1720 views

Hi guys,

We are using fortinac as NAC and we use mostly laptops with external network adapter, so the issue is if the laptop is registered and someone takes the external adapter and plugs in to his/her laptop, it is not isolating for the new host (Laptop) it gives full network access. and when we check the port, it shows us the new host is registered with the existing user (registered previous laptop).

Any solution in this situation?

FortiNAC

AEK

SuperUser

Hi Bootaan

This is because you are registering/identifying the laptop only based on adapter MAC address.

One solution is to use persistent agent.

AEK

bootaan26Author

Explorer

Hi AEK,

Every host is installed persistent agent, and we register hosts through captive portal.

so, my question is how we can prevent users swapping external network adapters?

Could you please elaborate more the solution you suggested?

Thanks.

AEK

SuperUser

Hi Bootan

So I guess your main issue is that when a laptop without a PA uses the external adapter it is considered as the registered one, right?

Since all Corp laptops have PA, then you can do many controls via the UHP.

For example you can edit the host properties (in HPU) to force the check of PA communication. So in case PA is not communicating the host is excluded from the profile and it will fall under another profile that the policy will put in isolation.

You can also control user groups in the HPU. The PA will tell FNAC which user is connected and the policy will put it in the right VLAN accordingly.

That could be one possible solution I have in mind.

AEK