Skip to main content
AntonioMartins
AntonioMartins
Explorer
April 23, 2024
Question

FortiNAC - Profiling Static IP Devices

  • April 23, 2024
  • 3 replies
  • 2764 views

Trying to profile device with static IP and assigning VLAN ID based on the device profiling.

With the exception of Vendor OUI, I don't see any method that we can use in this scenario - as the equipment's IP address does not belong to the IP network initially assigned to the port, FortiNAC has no way of probing with the remaining methods, which require IP communication to/from profiled devices.

Are there any alternatives?

3 replies

AEK
SuperUser
AEK
SuperUser
April 23, 2024

Hi Antonio

You are right, the client will lose any communication if it is in the wrong VLAN, furthermore one of the profiling information is DHCP requests.. your FortiNAC will collect some useful profiling info from these requests (OS, hostname and others), or your FortiGate can do it as well and send these info to FNAC.

When you deploy FortiNAC your clients must use DHCP otherwise it will not work as expected. The exception is for servers, which are usually in data center (physical security), so usually there is no need to NAC them.

For your case I think the good thing to do for any other rogue device that connects to your network with static IP should remain systematically in isolation, unless it is set to DHCP and properly profiled, otherwise it should remain in isolation.

AEK
    AntonioMartins
    AntonioMartinsAuthor
    Explorer
    April 24, 2024

    If end customer wants to maintain static IP in this devices, will it be safe to perform manual profiling before connecting device to role base access ports (staging) and then rely on FortiNAC profiling to keep the network safe from mac-spoofing?

    AEK
    SuperUser
    AEK
    SuperUser
    April 24, 2024

    I think this is not so secure. While the new device is in the prod network for profiling even for few seconds it will have enough time to do many things.

    That said some customers give priority to productivity (most of them) and others give priority to security.

    AEK
      ebilcari
      Staff
      ebilcari
      Staff
      April 25, 2024

      Having hosts using DHCP is the normal way on FNAC configurations for many reasons already mentioned.

      But in your conditions you can relay a bit to the firewall (FGT is preferred). In the DPR configuration guide, page 8,9 it's mentioned how to use firewall sessions or traffic flows in order to profile devices.

       

      For the second part, access control without changing host IP address, you can refer to the Firewall tags integration also possible with FGT. Based on the host status, network access can be limited while the host keeps the same IP and VLAN/Subnet.

      Emirjon
        AntonioMartins
        AntonioMartinsAuthor
        Explorer
        April 25, 2024

        In this setup, the switch ports are configured in registration VLAN by default. I guess it will not work because FGT IP is not in the same IP network of device.

        ebilcari
        Staff
        ebilcari
        Staff
        April 25, 2024

        As mentioned this is a limited scenario, for this to work you need to dedicate a switch to connect these hosts that have static IPs and use a single VLAN for Registration and production (the switch will work more like a hub, no VLAN switching). The network segmentation can be done through firewall tags while the hosts will share the same VLAN/Subnet.

        Emirjon
        Terms & ConditionsAccessibility statement