Description
This article describes how to configure and troubleshoot Firewall TAGs with FortiGate and FortiNAC.
Related documents:
- FortiNAC Endpoint connector - FortiGate new features.
- Fortinet security fabric FSSO integration guide.
Scope
FortiGate and FortiNAC Legacy.
Solution
- Log in to the FortiNAC GUI and go to System -> Settings -> System Communication Fortinet FSSO Settings.
Ensure that the 'Enable FSSO Communication' box is checked and fill in the 'Password' field (see the below example):
- Create 'Firewall Tags':
- Go to the 'Topology' view, select the FortiGate, select the 'Virtualized Devices' tab, and select the VDOM to enable 'Firewall Tags'. Then, enter the tag that was created in the previous step and select 'Submit Query':
- Add a FortiNAC Fabric Connector on the FortiGate:
- Select 'Refresh' and select 'View':
- If the tag that was created on FortiNAC is visible, use these tags in the firewall policies.
Troubleshooting.
- To verify whether a TAG has been applied to a host and sent to FortiGate, use the following commands on FortiGate:
diag fire auth list | grep -A 7 x.x.x.x <- Replace x.x.x.x with the IP address from the host.
diag debug auth fsso list | grep x.x.x.x <- Replace x.x.x.x with the IP address from the host.
diag debug auth fsso list | grep x.x.x.x <- Replace x.x.x.x with the IP address from the host.
- Force the FSSO Tag to be sent from FortiNAC to FortiGate to work around cases where the VLAN is terminating on a Layer 3 device other than the FortiGate:
device -ip <IPaddress> -setAttr -name ForceSSO -value true
- Enable the following debug options and send the Putty session output to TAC support:
nacdebug -name DeviceInterface true
nacdebug -name SSOManager true
Device -ip <IPaddress> -setAttr -name DEBUG -value "ForwardingInterface TelnetServer"
- Reproduce the issue. Update the ticket with the timestamps and Username.
- After reproducing the issue, run the following command:
grab-log-snapshot
The script will collect and zip a large number of files.
This will take several minutes.
The resulting zip file (log-snapshot-<hostname>-<timestamp>.tar.gz) is located in /tmp directory.
See Technical Tip: How to get a debug log report from FortiNAC.
- Disable debugging:
nacdebug -name DeviceInterface false
nacdebug -name SSOManager false
Device -ip <IPaddress> -delAttr -name DEBUG -value "ForwardingInterface TelnetServer"
Verify which debugs are enabled:
nacdebug -all | grep -i true
