FortiNAC-F Not Sending 3799 CoA Requests on Wired Switches

[barisben]

Despite VLAN switching being active for some reason FortiNAC is not sending 3799 CoA requests on any of my wired switches (I have no issues with access points, 3799 requests are being sent there). If I connect the same device wirelessly, it will do this. For example, when a host connects to switch X, it assigns to the registered VLAN and 5-10 seconds later recognizes by the DPR. However unless I manually disable and enable the port, the host doesn't switch to the appropriate VLAN. Even when I manually change the role of host X, it doesn't detect this as a new activity and doesn't send a 3799 request. As I mentioned, this issue only occurs with the switches, specifically Aruba switches (both old and new generation). When I check the logs, I can see that FortiNAC isn’t even sending the 3799 CoA request. What could be the issue?

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[barisben]

Still looking for a solution.

[Hawada1]

Hello barisben,

What is your current FortiNAC version?

Can you please do the following:
1) Please  make sure the host is disconnected from the switch
2) clear the host entry in Hosts view
3) Access FortiNAC CLI and run the following tcpdump command:

# execute tcpdump -i any host <Aruba-switch-ip> and port 3799 or 1700
4) Connect the host and check if FortiNAC sends and disconnect-request packet to reauthenticate the host after authentication.

best regards,
hawada

[barisben]

Normally as you can see in the screenshots, RFC5176 Mode was System Defined. I changed it to the Custom and "RFC5176 Attribute Group" was blank. When I change it to the for example RFC_VLAN now CoA messages are sending to the switch. But now problem is switch responses CoA-NAK because I think I need to send the right attributes like bounce. I can't find bounce attributes for Aruba anywhere.

[Hawada1]

Great that FortiNAC is now sending the CoA, For Disconnect-Request (40), the HP/Aruba Procurve/provision switch needs to have the following attributes 1,4,5,31:

• 
  User-Name Attribute (1)
  NAS-IP-Address Attribute (4)
  NAS-Port Attribute (5)
  Calling-Station-Id Attribute (31)

AFAIK Aruba switches supports "Aruba-Port-Bounce" VSA-40, but you need to send it with additional radius attributes to be accepted by the switch.

Best regards,
hawada

[barisben]

How can I get for example User-Name attribute response from the Radius message for sending CoA to the switch? Thats all options I have; 

[Hawada1]

Check the following doc under "RADIUS Attribute Group Response Value" should help you in achieving what you want.
https://docs.fortinet.com/document/fortinac-f/7.6.0/rfc5176-coa-disconnect-message/600014/how-it-wor...

br,
Hawada

[barisben]

As I understand that I need to use %AUTH% for all attributes and I did. But still getting CoA-NAK from switch.