Skip to main content
Jamshaid
Jamshaid
Explorer
November 1, 2023
Question

FortiNAC not putting user into isolation if no User Profile match ? Does it ?

  • November 1, 2023
  • 1 reply
  • 2706 views

Hi Guys.

 

I am wondering if a host is registered via device profiling but not maching any user policy than why it is still getting an IP from any other vlan than isolation ?

 

Also if no nap is matched does fortinac should put this user into either remediation or isolation ? 

 

As my user still has production vlan IP instead of going into isolation on a user profile match failure or even any criteria failure

 

example if a user doesnt have persistent agent he should be not getting an ip from production 

 

does my queries sound right or I am not understanding how the product works in such use cases?

 

@FortiKoala @ebilcari 

1 reply

ebilcari
Staff
ebilcari
Staff
November 1, 2023

If a registered host will not match a network policy than it will be put in the default VLAN that is configured on that port. FNAC will not put this host in isolation since it is considered in a normal state.

To block access for these hosts (not hitting any NAP) you can change the default VLAN to some blackhole VLAN of the switch or create a Network Access Policy to catch all these hosts and create a logical network to move these hosts to the same blackhole VLAN or on one of the isolation VLANs.

model config.PNG

 

Emirjon
    Jamshaid
    JamshaidAuthor
    Explorer
    November 1, 2023

    So if you want to perform a strict NAC, you can put your default vlan as your isolation ? it is recommended or a good practice ?

    ebilcari
    Staff
    ebilcari
    Staff
    November 1, 2023

    Yes, based on my experience, depending on your environment you can use the following as default VLAN to spare the initial VLAN change when the host is connected in the network for the first time:

    - Registration, when you have frequent turn over of new devices presented in the network

    - Remediation, when existing hosts change their compliance frequently

    - Dead End or a black hole VLAN if you want full isolation of the hosts

     

    To do this with a single change at device level follow the steps as shown below:

    2023-11-01 14_17_12-Window.png

     

    Also enable "Reset Forced Default" on group membership for all the ports.

    Emirjon
      Terms & ConditionsAccessibility statement