Cisco ISE Fortinet FortiSwitch 802.1X & MAB

[Dim21]

Hello,

We are currently deploying Cisco ISE as Radius server for user 802.1X auth and device (printers,cameras,iphones) with MAB. We have a site which is composed with Fortinet devices (Fortinet Firewall, FortiSwitch & FortiAP). While i am testing mab authentication everything works fine, my main issue is that on Cisco ISE i can't get endpoint ip address.DHCP snooping is enabled on Fortiswitch Interfaces, Fortinet Firewall is on 7.2.8, i've done packet captures and see that fortiswitch is not sending framed-ip-address towards ISE. Any idea why this happens and how can i resolve it ?

[sjoshi]

To ensure that the FortiSwitch sends the Framed-IP-Address attribute to the Cisco ISE for MAB authentication, follow these steps:

1. Manually configure DHCP snooping on the 802.1x-authenticated ports of your VLAN network for both port and MAC modes on the FortiSwitch.
2. Verify that DHCP snooping is correctly configured on the FortiSwitch interfaces where MAB authentication is taking place.
3. Check the FortiGate firewall settings to ensure compatibility with the FortiSwitch and Cisco ISE for passing the Framed-IP-Address attribute.
4. Confirm that the FortiGate firewall is running on version 7.2.8 to align with the FortiSwitch and Cisco ISE configurations.
5. If the issue persists, review the packet captures to identify any discrepancies in the communication between the FortiSwitch and Cisco ISE.
6. Troubleshoot any potential misconfigurations or network issues that may be preventing the Framed-IP-Address attribute from being sent to the Cisco ISE.

[Dim21]

Hello sjosh,

As i said i've done everything you mention from 1-6 steps but the problem remains. On packet capture fortiswtich is not sending framed-ip-address attribute.

[sjoshi]

1. Verify that the FortiSwitch firmware version is compatible with the feature to send the framed-ip-address attribute to the Cisco ISE for MAB authentication.
2. Check if there are any specific configurations on the FortiSwitch related to sending attributes to the RADIUS server that might be affecting the framed-ip-address attribute.
3. Ensure that there are no firewall rules or policies on the FortiGate firewall that could be blocking the transmission of the framed-ip-address attribute.
4. Double-check the configuration on the Cisco ISE side to confirm that it is set up to receive the framed-ip-address attribute correctly from the FortiSwitch.
5. Consider reaching out to Fortinet Customer Service & Support for further assistance in troubleshooting this specific issue with the FortiSwitch not sending the framed-ip-address attribute to the Cisco ISE despite the configurations being in place.

By following these steps and potentially involving Fortinet's support team, you can further investigate and address the issue of the FortiSwitch not sending the framed-ip-address attribute to the Cisco ISE for MAB authentication.

https://docs.fortinet.com/document/fortigate/7.6.0/new-features/98654/change-the-priority-of-mab-and...

[Dim21]

Hello sjoshi,

Fortinet firewall is on 7.2.8 and managed fortiswitches are on 7.0.2, as far i've searched fortinet doc there is no issue with the above firmware.

[FranFisc1]

Hi,

well..
801.X or MAC authentication both happen before the client is assigned an address  through DHCP.
DHCP can ot start before the port ist authenticated by MAB or DotX.
This is why even Cisco-Switches cannot send AVP Framed-IP-Address with the RADIUS access-requests.

IP Address and other information like i.e. LLDP about the connected device are collected by the cisco switch integrated "device sensor" from subsystems like DHCP snooping, CDP, LLDP...)

Cisco Switches send the information about client IP adresses
some time after authentication to the ISE
The Switches use RADIUS accounting packets.

You can find more information here:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/37e/consolidated_gu...

[locusmiller]

This issue happens because FortiSwitch doesn’t send the Framed-IP-Address attribute to Cisco ISE. Even with DHCP snooping enabled, the switch might not be relaying IP details. Try these steps:

1. Enable RADIUS Accounting – Ensure FortiSwitch is fully sending accounting data to ISE.
2. Check DHCP Snooping & IP Tracking – Some switches require extra config to relay learned IPs.
3. Confirm Framed-IP-Address Support – Not all switches send this by default; check FortiSwitch settings.
4. Debug & Packet Capture – Use diagnose debug application radius -1 to see if the attribute is missing.
5. Workarounds – Use DHCP relay or check if ISE can pull IPs via posture assessment or DHCP server integration. 

   Thanks: worldavatrpro.com