Skip to main content
Jucker
Jucker
Explorer III
May 19, 2024
Solved

FortiNAC Port configured for dot1x and portal guest access issue

  • May 19, 2024
  • 1 reply
  • 2563 views

Hello,

 

I have  a use case where i have Cisco switch port configured with dot1x and mab and i need to 

seq 1 if the user is AD then vlan 25

seq 2 if Printer then vlan 26

seq 3  Guest access portal registration logged successfully then vlan 27

 

The issue i have is if i connect a laptop without dot1x supplicant i always get mac authentication success with the same default vlan on the port, i can access the guest portal and self register/login without any issue but the vlan change never occurs, only after shut no shut the port then on the new authentication procces FNAC detect and change the port vlan to 27 since the host already registered on the last portal authentication.

 

Do you have any thought ?
Thank you!
Regards!

 

@ebilcari

 

Best answer by ebilcari

Based on your description it seems that the RADIUS CoA is missing or is getting ignored by the switch. Guest hosts will be handled with MAB authentication, normally they should get the registration VLAN first and after successful registration a CoA will be sent. The next authentication that will happen instantly after the CoA, will send the guest VLAN. You can run a packet capture in FNAC to see if CoA is sent or not:

> tcpdump port 1812 or port 3799 or port 1700 and host x.x.x.x

 

replace x.x.x.x with the IP of the switch, Cisco may use port 3799 (standard) or 1700 and sometimes need to be specified manually on the switch configuration.

1 reply

AEK
SuperUser
AEK
SuperUser
May 19, 2024

Hi Jucker

When FortiNAC changes a VLAN on a port it shuts down the port and brings it up again, so that the client refreshes its DHCP address. As far as I remember this operation is done via SNMP query.

If I am not misunderstanding your concern, your FNAC is not doing so. If this is the case then your FNAC may not have RW SNMP right on the switch. In order to confirm this, on FNAC try right click on a port and shut it down, then see if it is done successfully. If it is not then check FNAC's RW SNMP permission.

AEK
    Jucker
    JuckerAuthor
    Explorer III
    May 19, 2024

    Hello @AEK ,

     

    The port is configured with dot1x the Radius CoA would take care of the vlan change.


    If i remove the dot1x configuration, then the snmp shut no shut the port.

    Im not sure if this is not supported with a port used for 802.1x and guest portal at the same time.

     

    Regards!

     

     

    ebilcari
    Staff
    ebilcariAnswer
    Staff
    May 20, 2024

    Based on your description it seems that the RADIUS CoA is missing or is getting ignored by the switch. Guest hosts will be handled with MAB authentication, normally they should get the registration VLAN first and after successful registration a CoA will be sent. The next authentication that will happen instantly after the CoA, will send the guest VLAN. You can run a packet capture in FNAC to see if CoA is sent or not:

    > tcpdump port 1812 or port 3799 or port 1700 and host x.x.x.x

     

    replace x.x.x.x with the IP of the switch, Cisco may use port 3799 (standard) or 1700 and sometimes need to be specified manually on the switch configuration.

    Emirjon
      Terms & ConditionsAccessibility statement