Hello, I have a strange issue on FortiNAC-F. The switch is Aruba 6100 AOS-CX. The credentials are correct and the RADIUS configuration has been set up for example on two ports. It's working properly but the problem is that for ports that are not connected, it assigns the default VLAN 116 and its updating the config as "vlan access 116". However for ports that have performed "port-access-security" with MAC authentication or dot1x auth, it doesn't assign the "vlan access x" value. It stays as "vlan access 1" but the authentication has been successfully performed, meaning there isn't an issue here. However, unlike the default VLAN, it does not update the VLAN access ID on the port as 'vlan access x'. Then although the host connected to the port is listed in the MAC table, I cannot see it on FortiNAC. As you can see in the first screenshot the port is indeed active. When I disable and re-enable the port, for a while (even though 'vlan access 1' is still shown on the switch), I can see the correct VLAN in FortiNAC. However after some tim, it reverts to an empty. Of course the host continues to function properly. After host authenticated with Radius, for some reason port updates itself as Adapter Disconnected.
What could the issue be?
interface 1/1/8
no shutdown
vlan access 1
port-access onboarding-method concurrent enable
aaa authentication port-access dot1x authenticator
cached-reauth
cached-reauth-period 86400
quiet-period 10
enable
aaa authentication port-access mac-auth
cached-reauth
cached-reauth-period 86400
quiet-period 10
enable
interface 1/1/13
no shutdown
vlan access 116
port-access onboarding-method concurrent enable
aaa authentication port-access dot1x authenticator
cached-reauth
cached-reauth-period 86400
quiet-period 10
enable
aaa authentication port-access mac-auth
cached-reauth
cached-reauth-period 86400
quiet-period 10
enable
08:a1:89:xx:xx:xx 111 port-access-security 1/1/8
I will try to explain some aspects of FNAC behavior based on the configuration you've shared:
I believe the root cause may be related to the third condition. Please check the behavior of both the switch and the end host, particularly if the host enters a sleep mode, which could lead the switch to remove its MAC address from the MAC table.
Created on 08-15-2025 05:02 AM Edited on 08-15-2025 05:06 AM
This host always on and its still in the MAC table but shows as I mentioned. This entry from MAC table;
08:a1:89:xx:xx:xx 111 port-access-security 1/1/8
User | Count |
---|---|
2588 | |
1380 | |
796 | |
658 | |
455 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.