fortiswitch lldp with NAC integration
Hi everyone,
I do have Fortigate, Foriswitch, and FortiNAC in my environment. I did a normal LLDP profile on my fortigate to let Fortiswitch handle my cisco phones and data vlans. it was working fine. I have created custom LLDP profiles named "LLDP-Prof2" can see it at below and all are okay till now.
The issue once I do NAC enforcement and add NAC security policy on fortiswitch, nothing works fine till I change the LLDP profile to default !! which is confusing me. I have open ticket with Fortisupport but unfortunately NAC team asking to check with the switch team and switch team do the same and till now no one has advised me about that kindly if anyone can help and explain how LLDP affects and the relation between LLDP and NAC. The reason that I need to understand if there is something wrong in my config, to avoid any issue when I do need to remove NAC enforcement as again I have to change from default to my custom LLDP prof.
my LLDP Config:
config switch-controller lldp-profile
edit "default"
set med-tlvs inventory-management network-policy location-identification
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "voice"
set status disable
next
edit "voice-signaling"
set status disable
next
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
config med-location-service
edit "coordinates"
set status disable
next
edit "address-civic"
set status disable
next
edit "elin-number"
set status disable
next
end
next
edit "default-auto-isl"
unset med-tlvs
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl enable
set auto-isl-hello-timer 3
set auto-isl-receive-timeout 60
set auto-isl-port-group 0
set auto-mclag-icl disable
next
edit "default-auto-mclag-icl"
unset med-tlvs
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl enable
set auto-isl-hello-timer 3
set auto-isl-receive-timeout 60
set auto-isl-port-group 0
set auto-mclag-icl enable
next
edit "fortivoice.fortilink"
set med-tlvs inventory-management network-policy location-identification
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
config med-location-service
edit "coordinates"
set status disable
next
edit "address-civic"
set status disable
next
edit "elin-number"
set status disable
next
end
next
edit "LLDP-Prof2"
set med-tlvs inventory-management network-policy
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "voice"
set status enable
set vlan-intf "voice"
set assign-vlan enable
set priority 0
set dscp 46
next
edit "voice-signaling"
set status disable
next
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
next
end