Description |
This article describes a scenario where the user is utilizing wireless authentication via radius through FortiNAC while using a loopback interface as source IP under user radius settings:
config system interface |
Scope | FortiNAC. |
Solution |
However, upon connecting to wifi SSID it authenticates to radius successfully through FortiNAC and matches against the proper network access policies but the devices never leave the isolation subnet and get stuck in isolation VLAN.
From packet capture, it is possible to see that FortiNAC is sending Disconnect-Request but Fortigate is not replying with Disconnect-ACK over port 3799 UDP which is typically used for COA requests.
Make sure that port 3799 UDP is allowed on the corresponding policy destined to the loopback interface:
config firewall policy set schedule "always" |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.