Fortinac some hosts not communicating to the fnac server

Forum|Forum|1 year ago
April 13, 2025
6 replies
2709 views

hello,

i am facing an issue with some of the hosts installed persistent agent, these hosts are not communicating with fortinac server.

i have checked everything and also disabled the antivirus running the hosts and uninstalled and installed the persistent agent and nothing is working.

Any ideas will be helpful.

FortiNAC

Severo

New Member

There are several things you can check. First, ensure the SSL certificate installed on the FortiNAC server is valid and includes the full certificate chain. If intermediate certificates are missing, the agent may not establish a secure connection.

Also, confirm that the network allows traffic on TCP port 4568 and UDP port 4567, which are used by the Persistent Agent. Make sure no firewall or security software is blocking these ports. DNS resolution is another common issue verify that the hosts can properly resolve the FortiNAC server's hostname. On the host side, check the Windows registry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Bradford Networks\Persistent Agent to ensure the homeServer value is correctly set to the server's IP or FQDN. It's also important to make sure the Persistent Agent version installed on the hosts matches the version supported by your FortiNAC deployment.

Reviewing the Persistent Agent logs found in %ProgramData%\Bradford Networks\ can reveal more details about why communication is failing.

bootaan26Author

Explorer

Hi @Severo,

I have checked tcp port 4568 and is working fine and also confirmed no firewall or AV is blocking the traffic. i have also checked homeServer under regedit and could not find homeServer.

I will paste here the logs found under Bradford Networks/general, please check it.

Authorized application %ProgramFiles%\Bradford Networks\Persistent Agent\bndaemon.exe is enabled in the firewall.
2025-04-13 12:59:43 UTC :: ClientState = 1
2025-04-13 12:59:43 UTC :: ClientStateEnabled = 1
2025-04-13 12:59:43 UTC :: ServerIP = ns8200
2025-04-13 12:59:43 UTC :: Uninstall = /qn /x {A2BB123A-E9B8-4011-A976-C159A940C6DE}
2025-04-13 12:59:43 UTC :: Version = 9.4.0.93
2025-04-13 12:59:43 UTC :: allowedCiphers = TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,ECDHE-RSA-AES128-GCM-SHA256
2025-04-13 12:59:43 UTC :: allowedServers =
2025-04-13 12:59:43 UTC :: caTrustDepth = 4
2025-04-13 12:59:43 UTC :: disconnectedMsg = Your network access may be restricted. Persistent Agent is disconnected from Network Sentry.
2025-04-13 12:59:43 UTC :: discoveryEnabled = 1
2025-04-13 12:59:43 UTC :: expirationTime =
2025-04-13 12:59:43 UTC :: homeServer =
2025-04-13 12:59:43 UTC :: lastConnectedServer =
2025-04-13 12:59:43 UTC :: maxConnectInterval = 960
2025-04-13 12:59:43 UTC :: restrictRoaming = 0
2025-04-13 12:59:43 UTC :: securityEnabled = 1
2025-04-13 12:59:43 UTC :: selfSignedAllowed = 1
2025-04-13 12:59:43 UTC :: showDisconnectedIcon = 0
2025-04-13 12:59:43 UTC :: showDisconnectedMsg = 0
2025-04-13 12:59:44 UTC :: Starting to load random numbers
2025-04-13 12:59:44 UTC :: Finished loading random numbers
2025-04-13 12:59:44 UTC :: output of socket() call = 1100, errno = 2
2025-04-13 12:59:44 UTC :: attempted to setup IPC socket
2025-04-13 12:59:44 UTC :: confMaxInterval = 960 maxConnectInterval = 960
2025-04-13 12:59:44 UTC :: Calling getServerList
2025-04-13 12:59:44 UTC :: expiration time not a date time
2025-04-13 12:59:44 UTC :: getServerList()
2025-04-13 12:59:44 UTC :: 00:50:56:C0:00:01
2025-04-13 12:59:44 UTC :: 00:50:56:C0:00:08
2025-04-13 12:59:44 UTC :: 3C:52:82:67:F8:AE
2025-04-13 12:59:44 UTC :: Server List:
2025-04-13 12:59:44 UTC :: About to delete transport
2025-04-13 12:59:59 UTC :: IP Addresses: '169.254.120.132' , 'fe80::393c:7a51:5481:7884%16', '169.254.73.80', 'fe80::5817:e7f0:c530:4950%8',
2025-04-13 12:59:59 UTC :: Skipping wait for new IPs; already different.
2025-04-13 12:59:59 UTC :: Calling getServerList
2025-04-13 12:59:59 UTC :: getServerList()
2025-04-13 12:59:59 UTC :: 00:50:56:C0:00:01
2025-04-13 12:59:59 UTC :: 00:50:56:C0:00:08
2025-04-13 12:59:59 UTC :: 3C:52:82:67:F8:AE isolation.xx.yz.co
2025-04-13 12:59:59 UTC :: Looking up _bradfordagent._tcp.isolation.xx.yz.co
2025-04-13 12:59:59 UTC :: Server List: fnac01.xx.yz.co,
2025-04-13 12:59:59 UTC :: About to delete transport
2025-04-13 12:59:59 UTC :: Deleted Transport
2025-04-13 12:59:59 UTC :: Using SecureAgentTransportV1
adding KeyExpiredListener
adding KeyExpiredListener
2025-04-13 12:59:59 UTC :: SecureAgentTransportV1 constructor finished
adding KeyExpiredListener
2025-04-13 12:59:59 UTC :: Server: fnac01.xx.yz.co, tcp: 4568
2025-04-13 12:59:59 UTC :: Host = fnac01.xx.yz.co
2025-04-13 13:00:00 UTC :: SSL_get_verify_result = 18

Thanks.

ebilcari

Staff

Based on 'SSL_get_verify_result = 18' it seems that FNAC is configured to use a self-signed certificate for Agent communication. As mentioned in this section of the Admin guide, this is not supported. The easiest way would be to use a private CA to generate this certificate for FNAC and import the root CA in the end host.

Emirjon

rajalarc5

New Member

I'm not familiar with WMI. You're saying that FortiNAC can connect to a device using this protocol to learn the user account & authenticate it? Would this also work for a non-windows device (i.e. a Mac, Chromebook)

Sign up

Login with SSO

Login to the community

Login with SSO