Technical Tip: Leveraging Domain Group Membership of Client with EAP-TLS Computer-Based Authentication

[scitlak]

Description	This article describes configuring FortiNAC to leverage Computer Group membership to assign a role to a host with EAP-TLS computer-based authentication.
Scope	FortiNAC-F v7.x.x, FortiNAC v9.x.x.
Solution	Configure the LDAP identity to be 'dnsHostname'.  By using LDAP identity, FortiNAC will try to compare dnsHostname against EAP-TLS-Client Certificate Common Name. If they do not match, FortiNAC can not find the host in LDAP and retrieve the appropriate group membership. Create an AD Security Group and set the host as a Group member. Then create a new Role and add the group in the role. After a successful EAP-TLS computer-based authentication, the host will have the appropriate host role.