Skip to main content
Lyyiheang
Lyyiheang
Visitor III
July 28, 2024
Solved

Persistent Agent endpoint shown OFFLINE

  • July 28, 2024
  • 2 replies
  • 2105 views

Dear Team,

 

We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport.

2024-07-27_09-19-39.png2024-07-28_12-39-16.png2024-07-28_12-38-58.png

 

Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS. 

 

Thank You

 

FortiNAC

Best answer by ebilcari

If not enforced than the Authentication policy details that you shared above should not have any effect.

It seems that the switch fails to report the MAC address as connected, so FNAC has to remove the host information and change the state as offline. Does FNAC has CLI access to the switch, have you recently checked the Validate Credentials?

When the issue happens/or now, you can r-click on the switch and select "Test Device Mapping", it should read the mac address table of this switch (looks like a Cisco switch).

On the results of "MAC Address Table ( L2 Poll )" try to find out the MAC address of the authenticated hosts or the one that is connected/authenticated but showing as Status offline.

2 replies

AEK
SuperUser
AEK
SuperUser
July 28, 2024

Hello

Which FNAC version?

The following checks may be useful:

  • Have you checked if the switch OS version is supported by your FNAC's version?
  • On FNAC, is the client host shown offline or its PA agent shown offline?
  • Check if PA certificate is still valid
  • Check if the communication on the PA agent port TCP 4568 is open between FNAC and clients
  • Does it happen when you disable RADIUS auth? Can you test it for one client?
  • As it happens, try force L2 polling for the switch and see if it solves the issue
AEK
Lyyiheang
LyyiheangAuthor
Visitor III
July 28, 2024

Dear @AEK ,

 

My FNAC-F is running on version 7.4 latest built.

 

i would like to answer your question below:

 

  • On FNAC, is the client host shown offline or its PA agent shown offline?: Sorry, PA shown Green but endpoint host marked as Offline.
  • Check if PA certificate is still valid: Surely Valid
  • Check if the communication on the PA agent port TCP 4568 is open between FNAC and clients: I do Pcap on endpoint. I could see endpoint & FNAC still have communication exchange.
  • Does it happen when you disable RADIUS auth? Can you test it for one client?: It has the same issue
  • As it happens, try force L2 polling for the switch and see if it solves the issue: No Luck, it works only when i try to restart the port (Trigger authentication again)

Thank you

ebilcari
Staff
ebilcari
Staff
July 29, 2024

Check your implementation and verify if the "Forced Authentication" in Port Group Membership is actually needed at port level, from FNAC GUI. There is a common misconception about it and usually this is not needed when the end hosts are authenticated via RADIUS. "Role Based Access" through Network Access policies will handle and help prepare the RADIUS responses.

Emirjon
Lyyiheang
LyyiheangAuthor
Visitor III
July 29, 2024

Dear @ebilcari ,

 

on Port Group Membership, there is only Role Based Access enable. Other option are not enable. Force Authentication also not enable.

ebilcari
Staff
ebilcariAnswer
Staff
July 29, 2024

If not enforced than the Authentication policy details that you shared above should not have any effect.

It seems that the switch fails to report the MAC address as connected, so FNAC has to remove the host information and change the state as offline. Does FNAC has CLI access to the switch, have you recently checked the Validate Credentials?

When the issue happens/or now, you can r-click on the switch and select "Test Device Mapping", it should read the mac address table of this switch (looks like a Cisco switch).

On the results of "MAC Address Table ( L2 Poll )" try to find out the MAC address of the authenticated hosts or the one that is connected/authenticated but showing as Status offline.

Emirjon
Terms & ConditionsAccessibility statement