Valued Contributor

Question

FortiNac Send CoA Command

4 replies
136 views

I try to send CoA to the endpoint but we can see from below picture the CoA is failed, and from tcpdump there is no traffic to port 1700. Also in the cisco switch i already enable CoA debug but not receive any message. This mean the fortinac not send the CoA message?

ebilcari

Staff

FNAC may use port 3799 to send CoA/DM requests, try capturing traffic on port 3799.

You can also enable the following debug in FNAC:

# diagnose debug plugin enable RadiusManager
# diagnose tail -f output.master | grep RadiusManager


2026-07-30 09:58:15.962 +0200 [p: default-threadpool; w: 5] DEBUG yams.RadiusManager - RadiusServer sendDisconnect to device 10.7.255.2 for client 02:09:0F:00:07:02
..
2026-07-30 09:58:15.989 +0200 [p: default-threadpool; w: 5] INFO  yams.RadiusManager - ElementInfoFactory.checkDeviceProperty returning null for CoAPort
2026-07-30 09:58:15.989 +0200 [p: default-threadpool; w: 5] DEBUG yams.RadiusManager - RadiusServer.legacyRadiusCoA unable to resolve CoAPort, defaulting to 3799
2026-07-30 09:58:15.989 +0200 [p: default-threadpool; w: 5] DEBUG yams.RadiusManager - RadiusServer.legacyRadiusCoA using port 3799

Emirjon

HS08Author

Valued Contributor

hi @ebilcari add the radius attrinbute then the coa is working, but if i debug then when the vlan changed or manually test by executing send coa command then i can’t see any message in the log.

But if the endpoint located behind the ip phone why the CoA is failed?

H

Hawada1

Staff & Editor

Hello @HS08 ,

What do you mean exactly by failing? Is the disconnect-request/CoA-request sent by FNAC and the switch responded by disconnect-NAK or FortiNAC is not sending completely the disconnect-request? Have you checked the following doc for RADIUS CoA
https://docs.fortinet.com/document/fortinac-f/7.6.0/rfc5176-coa-disconnect-message/937964/scenario-1-default-rfc5176-settings

You can also run tcpdump to see the attributes sent in the disconnect-request packet by FNAC:

# execute tcpdump -v -N -i port1 port 3799

Try using the -F (Read the file as it's updated and follow file replacements)

# diagnose debug plugin enable RadiusManager

# diagnose tail -f output.master | grep RadiusManager

HS08Author

Valued Contributor

There are no any message when i change the host role or execute SendCoA command if the endpoint located behind ipphone, but can see the log message if ipphone connected directly to the port switch.

Sign up

Login with SSO

Login to the community

Login with SSO