Technical Tip: Agent communication using UDP 4567 no longer supported with later versions

[cmaheu]

Description	This article describes the behavior where FortiNAC no longer supports Persistent Agent communication using UDP 4567.  This is due to security enhancements.    Agent versions 5.2 or lower: If configured for UDP 4567 via the Persistent Agent setting 'securityEnabled = false', the agent will be unable to communicate.
Scope	FortiNAC v9.2.4 and vF7.x.
Solution	For environments with agents communicating over UDP, it is recommended the following be done prior to the upgrade to avoid agent communication disruptions: 1) Ensure valid SSL certificates are installed in the Persistent Agent Certificate Target.  Version8.x: Go to System -> Settings -> Security -> Certificate Management. Version 9.x: Go to Security Configuration -> Certificate Management. 2) Upgrade agents to 5.3 or higher. Agents will communicate over TCP 4568 regardless of the 'securityEnabled' Persistent Agent setting. To determine if UDP 4567 is currently being used: 1)  Confirm whether or not 4567 is listed in the Transport Configuration settings. Version 8.x: Go to Settings -> Persistent Agent -> Transport Configuration. Version 9.x: Got to System -> Settings -> Persistent Agent -> Transport Configuration. 2) If 4567 is listed, run a tcpdump in the appliance CLI to confirm whether or not agents are actually using the port for communication. CentOS:  Login as root and type: tcpdump -nni any port 4567 Type Ctrl-C to stop. Contact Support for assistance.