Description
This article describes an issue when Aerohive wireless clients move between APs using different networks, Network Sentry does not consistently assign the correct network access policy and causing the wrong VLAN to be assigned. Network Access Policy Host/User Profile is configured to match certain APs in the adapter location of the 'Who/What by Attribute' setting.
Scope
FortiNAC.
Solution
Network Sentry processes the adapter location after the assignment of the network access policy. Therefore, the adapter information will not be accurate at the time the system is trying to match a Network Access policy.
The solution would be to assign the network access policies based on the port group instead of adapter location.
- Create (port) groups that include the appropriate SSID for all the APs that are members of that particular location.
- Add this group to the 'Where (Location)' section of the User/Host Profile.
- Remove the Host location attribute of the User/Host profile.
