Skip to main content
BKP09
BKP09
Explorer
August 22, 2025
Question

FortiNAC - Port Bounce

  • August 22, 2025
  • 2 replies
  • 1293 views

Hello Guys,
I need your insights in a challenge i face with our FortiNAC Deployment.


Just a brief explanation of the topology and the case at first. We have a NAC VM Cluster, in which we have enrolled our inventory switches. we want dynamic vlan assignment for the users, based on an the Role attribute that each user has ( attribute 60 = vlan 60). Switches (Cisco) has the respective AAA config and i can see on the NAC that the radius accept is sent when the user is connected to the port. Users have the supplicant configuration for the Radius authentication as well.

Issue:

In scenarios where a laptop is connected through an IP phone, we’ve noticed that when the laptop is disconnected and reconnected, the IP phone restarts due to a port shut/no shut. Is there a recommended way to prevent the IP phone from restarting during this process? We managed to change some port settings, and the restart is not constant, but if the laptop is not connected to the IP Phone for more than 10 minutes, when we reconnect the IP Phone restarts.
version 7.4.1
BR

2 replies

ebilcari
Staff
ebilcari
Staff
August 22, 2025

Please specify also the switch model. Does the IP phone get recognized correctly, and is the switch port displayed properly similar to the following example?

 

IP Phone daisy right.PNG

 

By default, FNAC should not bounce ports that have IP Phones connected.

 

From the switch logs, can you verify if the port bounces from RADIUS packets (CoA/DM) or the command to bounce the port is received from CLI or SNMP?

Emirjon
BKP09
BKP09Author
Explorer
August 22, 2025

Unfortunately, the port does not be shown correctly, even though the vlan change and the authentication works properly, the port shows as not connected (FortiNAC) and switch wise shows correct. Note that the port shows as not connected only when we enforce. 
regarding the SNMP, i switched the community to RO from RW and the bounce still happens.

ebilcari
Staff
ebilcari
Staff
August 22, 2025

As a first step, FNAC will need full visibility for the connected hosts before proceeding with the enforcement. If hosts are not visible, unexpected behavior may occur (unnecessary VLAN changes triggered or reset to default). Can you confirm whether the hosts appear after manually triggering an L2 poll on the switch?
Does the switch have the option 'Manage as a Generic SNMP device' enabled? This option should be disabled to ensure a better integration.
If the polling fails or the connected hosts are not shown, than the integration with this switch model need to be investigated through a ticket with TAC support. 

Emirjon
alimushala_btec
alimushala_btec
New Member
November 20, 2025

We are also having same issue,
We have integration of Fortiswitch, FortiGate and FortiEMS.
Scenario is the EMS Tags get synced but the PC behind the phone doesnt get bounce

If i do ip renew will work.

AEK
SuperUser
AEK
SuperUser
November 20, 2025

PC behind IP phone doesn't bounce. If it does so then it will make a long delay because the IP phone will reboot.

If I remember well, the agent (PA or DA) is a good option since it initiates IP renew when VLAN is changed without bounce (with PA optimization enabled).

AEK
    Terms & ConditionsAccessibility statement