|
This article assumes the configuration of EMS connector has been done.A dditionally, ZTNA tags must have been configured as per Adding a Zero Trust tagging rule set.
There are 3 different categories that can be used for 'Device Patterns': Device, User, and EMS Tag.
EMS Tag (ZTNA Tag) category requires Telemetry connectivity from the onboarding VLAN to the EMS server which the endpoint is connected to.
This is needed for the endpoint to synchronize its tags with EMS.
Configuration steps:
- Configure onboard VLAN settings. By default, 'Security Mode' is enable. For this example, it is disabled since this onboarding VLAN has no access to networks other than EMS Telemetry over TCP 8013.
- Configure VLAN interface settings of new VLAN that will be assigned to the endpoint.
-
Create a firewall policy to allow traffic from onboarding VLAN to the EMS server for TCP 8013.
Note: If the EMS server is configured to be reachable via a FQDN (on FortiClient), ensure that DNS traffic to the DNS server as defined on the DHCP settings is permitted by Firewall policies - for the onboarding VLAN. Further, if the IP that the EMS FQDN resolves to is a public IP address (and DNATted by a VIP), ensure the policies are configured to allow traffic from the Onboarding VLAN to the EMS public IP address.
-
Create a Firewall policy as desired to control traffic for the new VLAN assigned.
The example below is using ZTNA tag from EMS, and Dynamic Address created by NAC Policy for source address:
- Configure onboarding VLAN under 'WiFi & Switch Controller/NAC Policies/FortiSwitchOnboarding VLANs'.
- Configure NAC Policy under 'WiFi & Switch Controller/NAC Policies/Create New'.
Note:
The option 'Bounce port' is required to be enabled to renew the DHCP lease for the IP of the VLAN. Otherwise, it will only happen when the DHCP lease configured on the onboarding VLAN expires (minimum 300 seconds).
- Optionally, 'Assign device to dynamic address' can be used to add the MAC Address of units that match this NAC policy to this Dynamic Address, which can then be used in a firewall policy for example.
- Configure the switch port mode to 'NAC' so the NAC policy is triggered.
Verification Steps:
With the above in place, the following should happen:
- Once the unit is plugged into port5 of this FortiSwitch, it will receive an IP address of the onboard VLAN as per the DHCP settings (172.16.89.20 in this example).
The unit is then added to the onboarding mac address table:
This can be verified with command '# diagnose switch-controller mac-device nac onboarding'.
- The only traffic allowed from that source is to EMS Telemetry.
- Once EMS tags are synchronized from the scheduled API call, the device will match the NAC policy and be moved from the 'onboarding' table to the 'known' table.
- Since the Dynamic Address option is enabled, it will add this device MAC Address to the address 'Compliant'.
- At the same time, the switchport port5 receives a bounce command and administrative status changes to down and up so new DHCP request is triggered.
This can also be verified from 'Log & Report -> Events -> FortiSwitch Events'.
Dynamic Address from NAC Policy.
Resolved Mac Address from ZTNA Tag.
Matched Endpoint from the ZTNA Tag.
Troubleshooting commands:
diagnose switch-controller mac-cache show
diagnose switch-controller mac-device cache
diagnose switch-controller switch-info lldp neighbors-summary
diagnose switch-controller mac-device dynamic
diagnose switch-controller mac-device nac known
diagnose switch-controller mac-device nac onboarding
diagnose user device list
diagnose firewall dynamic list
diagnose user-device-store device memory list
diagnose user-device-store device memory query 2 mac <MAC Address of the Test PC>
diagnose endpoint ec-shm list
diagnose user-device-store unified device-query filters-and 1 0 0 2;0;<MAC Address of the Test PC>
Debug:
diagnose debug reset
diagnose debug disable
diagnose debug console timestamp enable
diagnose debug application flpold 3
diagnose debug application flcfg 7
diagnose debug cli 8
diagnose debug enable
Stop debugging after collecting the output:
diagnose debug reset
diagnose debug disable
|
