Technical Tip: Bulk delete rogue devices from the FortiNAC database via the CLI

[ltusen]

Description	This article describes how to perform a bulk delete of rogue devices from the FortiNAC's Database via CLI. The command client -rog -op delete in FortiNAC is used to delete all rogue devices from the system. This command allows administrators to explicitly delete rogue records that are no longer relevant, ensuring the database reflects only active/valid devices. Action: Deletes rogue device entries from FortiNAC’s database. This command is critical for maintaining accurate network visibility and preventing stale rogue entries from cluttering the system.
Scope	FortiNAC, FortiNAC-F
Solution	Log into the FortiNAC Admin UI, then navigate to Users & Hosts -> Hosts and modify the 'Custom Filter' -> Go to Host -> and select Type: Rogue and press Ok to check the rogue devices count: Note: All the rogue devices [Online and Offline] should be listed in the Host view search results and the rogue devices count can be checked at the bottom of the page on the right corner. In the example output below, only 2 rogue devices are being shown: Log into the FortiNAC CLI and execute the command below based on the running version of the NAC appliance: On FortiNAC CentOS: client -rog -op delete On FortiNAC-F (NAC-OS): > execute enter-shell # client -rog -op delete After successfully running the previous command, the delete operation for the found client matches will be shown: After successfully delete all the rogue devices found, the Host view search results will show not rogue devices. However, the rogue devices still connected to the network and online are going to be re-created in the FortiNAC database and will appear again in the Host view section. It is therefore recommended to identify them and disconnect them from the network. Related documents: Evaluating Rogue Hosts  Re-Profiling Rogues and Assisted Rule Creation