Technical Tip: How to add or modify CLI credentials in bulk on several network devices added to the FortiNAC inventory

[Sheikh]

Description	This article describes the need to update the CLI credentials on several devices simultaneously in the FortiNAC inventory.
Scope	FortiNAC, FortiNAC-F.
Solution	Regularly updating CLI credentials across all devices within the FortiNAC inventory is an essential security and operational practice. These credentials are used by FortiNAC to authenticate, manage, and communicate securely with network devices such as switches, routers, and wireless controllers. Alternatively, it might be required to update the network devices' CLI credentials. In this case, FortiNAC needs to be updated with the latest credentials for the devices in the inventory to continue performing its tasks. Reasons for the update: Potential Compromise of Credentials: In cases where there is a suspicion or confirmation that the CLI credentials have been compromised, immediate updates are essential to restore the security and integrity of network device communication. Prompt action prevents unauthorized access and mitigates the risk of malicious activity within the managed network. Enhancement of Security Posture: Periodic credentials updates minimize the risk of unauthorized access resulting from compromised or outdated authentication data. Over time, credentials may be exposed through configuration backups, personnel changes, or external security breaches. Updating them ensures that only authorized entities retain access to network devices. Compliance with Security Policies and Standards: Many organizations are required to adhere to internal IT governance frameworks or external compliance standards (such as ISO 27001, PCI-DSS, or NIST). These frameworks mandate the regular rotation of administrative credentials and encryption keys to maintain a secure operational environment. Preservation of Secure Communication: CLI credentials are used to securely communicate with the network devices. Updating these credentials ensures continued integrity and confidentiality of authentication data, preventing potential interception or replay attacks. Operational Consistency and Automation: Performing simultaneous updates across the device inventory ensures configuration consistency, reduces administrative errors, and streamlines future maintenance tasks. It allows FortiNAC to continue managing all devices without authentication failures or connectivity interruptions. Procedure for Updating CLI Credentials in FortiNAC via GUI: To update the CLI credentials for multiple network devices in bulk: Access the FortiNAC web console and navigate to Network → Inventory → Container. From the list on the right-hand side, select all devices or multiple devices by using CTRL and the left button of the mouse for which the CLI credentials need to be modified. Right-click on the selected devices and choose 'Modify Device Properties'. In the CLI Settings section, enter the new CLI credentials. Once saved, the updated credentials will be applied to all selected devices simultaneously. Procedure for Updating CLI Credentials in FortiNAC via CLI (NAC-OS only): The same bulk modification of CLI credentials on network devices added to the FortiNAC-F inventory can also be performed from the CLI. Notes: Be cautious when changing passwords on multiple devices, as one wrong syntax or step will result in the disconnection of all the selected devices from FortiNAC. Moreover, this process is only applicable to FortiNAC-OS and will not work on the CentOS version of FortiNAC. Log in to the FortiNAC CLI. diagnose network device set cli-credential-attribute <user-name> <password> <enable-password> <session-type> (ip <ip> | mac <mac> | dbid <dbid> | device-name <device-name> | group <group> | container-name <container-name> |class-id <class-id> | attribute-name <attribute-name> | all) Sets the CLI credential attribute onto the selected device.   <user-name>               user name to be set   <password>                password to be set   <enable-password>         password to be set   <session-type>            session type to be set telnet, ssh, ssh2   all                       select all devices   attribute-name <attribute-name>                             select by device attribute   class-id <class-id>       select device(s) by class in the range 0-56   container-name <container-name>                             select device by container name   dbid <dbid>               select device by database Id   device-name <device-name> select device by name   group <group>             select device(s) by group name   ip <ip>                   select device by IP Address   mac <mac>                 select device by MAC Address For details, see the CLI Reference Manual guide of FortiNAC v7.4.0+.