Description
This article describes why the user should redirect the admin UI port 8080 HTTP to port 8443 HTTPS or disable 8080 entirely.
This issue is addressed in version 8.2.0.
Scope
FortiNAC versions prior to 8.2.0.
Solution
Workaround: To redirect Admin UI port 8080 to secure port 8443, access the Network Sentry Server or Network Sentry Control Server and modify the /bsc/campusMgr/ui/ROOT/WEB-INF/web.xml file.
Change the 'NONE' value at the very bottom of the transport-guarantee section of the file to 'CONFIDENTIAL'.
Before:
<security-constraint>
<web-resource-collection>
<web-resource-name>ALL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>
NONE
</transport-guarantee>
</user-data-constraint>
</security-constraint>
After:
<security-constraint>
<web-resource-collection>
<web-resource-name>ALL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>
CONFIDENTIAL
</transport-guarantee>
</user-data-constraint>
</security-constraint>
Save the changes to the web.xml file.
Restart the tomcat-admin service:
service tomcat-admin restart
Note: This change must be done after every upgrade. Document the change in a file called README in the /bsc/campusMgrUpdates/ directory. If no file is currently present with that name, create a new file.
To disable the admin UI port 8080 entirely, access the Network Sentry Server or Network Sentry Control Server and modify the /bsc/services/tomcat-admin/conf/server.xml file.
Comment out the below section as follows:
Before:
<Connector port="8080" redirectPort="8443"
server="Apache"
address="nac" />
After:
<!-- <Connector port="8080" redirectPort="8443"
server="Apache"
address="nac" />
-->
Save the changes to the server.xml file.
Restart the tomcat-admin service:
service tomcat-admin restart
Note: This change must be done after every upgrade. Document the change in a file called README in the /bsc/campusMgrUpdates/ directory. If no file is currently present with that name, create a new file.
This issue has been addressed in version 8.2.0.
Since the tomcat service has been merged with the NAC service with FortiNAC 9.4.X and FortiNAC -F, to disable the admin UI port 8080 entirely with FortiNAC 9.4.X and FortiNAC -F, follow the steps below:
- Execute the 'adminguitool show' command and check current configuration.
- Disable insecure connection for AdminUI entirely by executing the 'adminguitool config 1 -insecure false' command.
- Execute 'restartNAC' for the change to be implemented.
Note: Since the 'restartNAC' command will restart all NAC processes, perform it during a maintenance window.
