Technical Tip: Troubleshooting wireless clients moved to the wrong VLAN

[cmaheu]

Description

This article describes basic steps to troubleshoot registered wireless clients moving to the wrong VLAN.

Scope

FortiNAC.

Solution

1. Verify the VLAN value assigned to the client within the Controller/AP.
2. Compare the VLAN value to the value logged in NAC.  In the NAC Administration UI, navigate to Hosts -> Host View.
3. Search for the wireless MAC address of the affected host.
4. Verify the Host state (At-Risk, Registered, etc).
5. Verify wireless adapter shows online.  
6. Review the Network Access Value for the wireless adapter.   

The adapter’s Network Access Value matches the value in Controller/AP:  Suggests NAC assigned the VLAN.

Next steps:

• Verify the SSID Configuration has the correct Network Access values (VLANs) assigned for the various host states. (SSID may be using inherited configuration from Controller/AP).
• If using Network Access Policies to assign VLANs, refer to the related KB article below.

The adapter’s Network Access Value does not match the value in Controller/AP: Suggests NAC did not assign the VLAN. 

The next steps are: 

• Verify the Shared Secret exactly matches between all the following components:
• Controller/AP.
• SSID.
• Controller/AP Model Configuration in NAC.
• SSID Configuration in NAC.
• (802.1x) RADIUS Server Model (System -> Settings -> RADIUS).
• (802.1x) RADIUS Server.
• Verify the RADIUS response from NAC reached the Controller/AP via packet capture or Controller/AP debug.

If the behavior persists, further debugging may be required.  Contact Support for assistance. 

Related articles:

Technical Tip: Troubleshooting policies

Troubleshooting Tip: RADIUS wired and wireless clients not connecting