FortiNAC-F is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks. For legacy FortiNAC articles prior to FortiNAC-F 7.2, see FortiNAC.
In some scenarios there are users who tend to keep two online network adapters in use. This article describes the Best Practices that should be followed when a Windows host with the Persistent Agent has both Wired and Wi-Fi Adapters connected simultaneously.
Scope
FortiNAC, FortiNAC-F.
Solution
When a Windows host with the Persistent Agent has both Wired and Wi-Fi adapters connected simultaneously:
Potential Issues:
Communication Conflicts: If both adapters are active, the agent may experience intermittent communication issues if network paths conflict (e.g., firewalls blocking ports 4568/80 on one interface, or DNS misconfiguration).
Policy Mismatch: Network Access policies might apply inconsistently if the adapters are on different subnets or VLANs, leading to unexpected VLAN changes or temporary disconnections (as noted).
Recommendations:
Single Active Adapter: FortiNAC documentation implicitly recommends ensuring only one adapter is actively used at a time to avoid policy reevaluation conflicts. For example, the FortiNAC USB/Thunderbolt Adapters section states that dual-homed hosts may trigger race conditions in policy enforcement, causing disconnections.
Agent Communication: The Persistent Agent must communicate via the connected adapter. If both are active, ensure both interfaces have unfettered access to FortiNAC (ports 4568/80) and DNS is correctly configured to resolve the FortiNAC server.
Documentation Reference:
TheFortiNAC USB/Thunderbolt Adapters section explains that FortiNAC associates all adapters reported by the Persistent Agent with the host record. However, simultaneous use of multiple adapters is not explicitly recommended and may lead to instability.
Conclusion: While FortiNAC can manage multiple adapters, it is advisable to use a single active network interface (Wired or Wi-Fi) to prevent communication or policy conflicts. If both must be connected, ensure network configurations (firewalls, DNS, VLANs) are consistent across both interfaces.
