Troubleshooting Tip: Delayed or no MAC notification syslog received from FortiSwitch in Link mode

cmaheu · ‎01-08-2023

Description

This article describes troubleshooting steps to use when FortiNAC is either receiving delayed Syslog messaging (or none at all) when hosts are connecting to a FortiSwitch in Link mode.

For integration details, see the FortiSwitch Integration reference manual in the Document Library.

Scope

FortiNAC version: 6.x, 7.x, 8.x, 9.x,

Solution

1) Confirm UDP 514 is not being blocked in the network.

2) Review FortiGate and FortiSwitch configurations to verify Syslog messages are configured properly.

3) Confirm the FortiGate's data-sync-interval value. 'MAC add' and 'MAC delete' events occur in the FortiGate when the MAC address of the host is first seen and when it is no longer seen on the managing FortiSwitch.

FortiGate updates the MAC cache table with this information.

The mac-cache table on the firewall refresh its entries every x seconds, where x= data-sync-interval value.

Enter the following commands in the FortiGate CLI to view this interval value (default value is 60):

# config switch-controller system
# show

Example:

data-sync-interval : 60

4) In FortiNAC CLI, start tcpdump to verify receipt of the syslog messaging. Type:

tcpdump -nni eth0 host <IP of FGT listed in Topology> and port 514 -vvv | grep Switch-Controller -B3 | tee /bsc/logs/tcpdumpFGTSyslog.txt

5) In the FortiGate GUI, confirm whether or not events are generating. Navigate to Log & Report -> Events.
Note: In 6.4 FortiOS, check for system events or switch events.

6) Connect the host to the FortiSwitch.

7) Wait the number of seconds as defined by the data-sync-interval.

8 ) In FortiGate CLI, view the cache to verify if the MAC entry was added appropriately. Type:

# diag switch-controller mac-cache show

9) Confirm whether or not the FortiGate logs show 'MAC add' events for the host.

10) In the appliance CLI, verify if tcpdump shows the syslog message received.

11) Disconnect the host from the FortiSwitch.

12) Wait the number of seconds as defined by the data-sync-interval.

13) View the cache to verify if the MAC entry was removed appropriately:

# diag switch-controller mac-cache show

14) Confirm whether or not the FortiGate logs show 'MAC delete' events for the host.

15) In the appliance CLI, verify if tcpdump shows the syslog message received.

16) Ctrl-C to stop tcpdump.

Open a FortiGate support ticket and attach the following:

- Description of the issue.

- Troubleshooting steps taken.

- FortiOS version.

- FortiGate configuration.

If syslog is being sent by the FortiGate, confirm FortiNAC is receiving the messaging.