Technical Tip: Methods used to learn host name and operating system information

[FortiKoala]

Description

This article describes the methods on how to update Host Name and Operating System (OS) information to provide enhanced endpoint visibility.  Host record information can be viewed by navigating to User & Hosts -> Host View in the Administration UI. 

Scope

FortiNAC.

Solution

Following methods can update host attributes with OS and Host Name information.

1. DHCP Fingerprints.

When a DHCP packet (discover, request or inform) is heard on the network, OS and host name information is updated for the existing rogue record.  If the host record does not already exist, it is created (regardless of online status). 

• In order to listen for DHCP Fingerprints, IP Address Helpers for production networks must be configured to point at the eth0/Port1 interface of FortiNAC.
• Not all DHCP fingerprints provide host name.
• OS is not always able to be determined for all DHCP packets.  The device’s DHCP fingerprint may be unknown or too similar to other devices to name an OS.
• Learned fingerprint information can be viewed in the Administration UI under User & Hosts -> Endpoint Fingerprints.
• Following article describes how to track Rogue hosts through endpoint fingeprints.
• It is possible to enable/disable the Rogue entry creation based on Learned DHCP fingerprints in System -> Settings -> User/host management -> Device profiler as shown in Figure 1. This might not be neccessary since in some network environments it can add a large number of rogues hosts from unmanaged areas of the network.

Figure 1. Enable the option to create Rogue entries from received DHCP packets.

 

2. FortiGate firewall session polling.

   When a firewall session is read from a modeled FortiGate, OS and host name information is updated for the existing rogue record.  If the host record does not already exist, it is created (regardless of online status).  

   • FortiGate must be modeled in Topology and Firewall session polling enabled.
   • Learned session information can be viewed in the Administration UI under Hosts > FortiGate Sessions.
   • For more information, see section Firewall session polling in the Administration Guide.
   • Article describing Firewall session polling configuration.
   • It is possible to enable/disable the option of creating Rogue records based on the Polled sessions as shown in Figure 2.
   
   Figure 2. Enable Rogue host creation from polled session data.
3. Agent.
   Dissolvable or Persistent Agent needs to be installed on the end station in order to update information. Registered host records will not be updated from information obtained from DHCP Fingerprints or firewall sessions.
   Persistent Agent deployment guide.

4. MDM Integrations.

Example with Gsuite integration.

FortiNAC collects the following host data from GSuite:

• Operating System.
• Model (Hardware Type).
• Host Name.
• Serial Number.
• Owner (User).

Related documentation:

FortiClient EMS integration