Cisco ISE Fortinet FortiSwitch 802.1X & MAB

[Dim21]

Hello,

We are currently deploying Cisco ISE as Radius server for user 802.1X auth and device (printers,cameras,iphones) with MAB. We have a site which is composed with Fortinet devices (Fortinet Firewall, FortiSwitch & FortiAP). While i am testing mab authentication everything works fine, my main issue is that on Cisco ISE i can't get endpoint ip address.DHCP snooping is enabled on Fortiswitch Interfaces, Fortinet Firewall is on 7.2.8, i've done packet captures and see that fortiswitch is not sending framed-ip-address towards ISE. Any idea why this happens and how can i resolve it ?

[sjoshi]

To ensure that the FortiSwitch sends the Framed-IP-Address attribute to the Cisco ISE for MAB authentication, follow these steps:

1. Manually configure DHCP snooping on the 802.1x-authenticated ports of your VLAN network for both port and MAC modes on the FortiSwitch.
2. Verify that DHCP snooping is correctly configured on the FortiSwitch interfaces where MAB authentication is taking place.
3. Check the FortiGate firewall settings to ensure compatibility with the FortiSwitch and Cisco ISE for passing the Framed-IP-Address attribute.
4. Confirm that the FortiGate firewall is running on version 7.2.8 to align with the FortiSwitch and Cisco ISE configurations.
5. If the issue persists, review the packet captures to identify any discrepancies in the communication between the FortiSwitch and Cisco ISE.
6. Troubleshoot any potential misconfigurations or network issues that may be preventing the Framed-IP-Address attribute from being sent to the Cisco ISE.

[Dim21]

Hello sjosh,

As i said i've done everything you mention from 1-6 steps but the problem remains. On packet capture fortiswtich is not sending framed-ip-address attribute.

[sjoshi]

1. Verify that the FortiSwitch firmware version is compatible with the feature to send the framed-ip-address attribute to the Cisco ISE for MAB authentication.
2. Check if there are any specific configurations on the FortiSwitch related to sending attributes to the RADIUS server that might be affecting the framed-ip-address attribute.
3. Ensure that there are no firewall rules or policies on the FortiGate firewall that could be blocking the transmission of the framed-ip-address attribute.
4. Double-check the configuration on the Cisco ISE side to confirm that it is set up to receive the framed-ip-address attribute correctly from the FortiSwitch.
5. Consider reaching out to Fortinet Customer Service & Support for further assistance in troubleshooting this specific issue with the FortiSwitch not sending the framed-ip-address attribute to the Cisco ISE despite the configurations being in place.

By following these steps and potentially involving Fortinet's support team, you can further investigate and address the issue of the FortiSwitch not sending the framed-ip-address attribute to the Cisco ISE for MAB authentication.

https://docs.fortinet.com/document/fortigate/7.6.0/new-features/98654/change-the-priority-of-mab-and...

[Dim21]

Hello sjoshi,

Fortinet firewall is on 7.2.8 and managed fortiswitches are on 7.0.2, as far i've searched fortinet doc there is no issue with the above firmware.