FortiNAC and WiFi remediation

[AEK]

Hi again FNAC admins

• FortiNAC-F 7.2.9.
• Ruckus ZD1200 10.x WLC

I have one single isolation VLAN for quarantine, dead-end and registration.

VLAN switching works now fine via RADIUS DM. Tested it by disabling adapter or disabling host, and it moves it instantly to isolation.

The issue now is with quarantine: For wired connection it works well, i.e.: host is quarantined instantly when it fails scan. But for WiFi it doesn't move it to quarantine.

With tcpdump we can see RADIUS DM is sent to the WLC, but the host never moves to isolation. DM are still sent periodically by FNAC, like if it is still trying.

Disconnecting the host from WiFi and reconnecting again still put it in prod VLAN.

Force remediation (group) enabled on the SSID, and quarantine VLAN configured for the SSID as well.

Did I miss something?

[Anthony_E]

Hi Adbelkrim,

I hope you are doing well.

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Anthony

[AEK]

Thanks Anthony, I appreciate.

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

@ebilcari, Hello,

Sorry to tag you, but maybe you can help Abdlekrim as FortiNAC expert?

Thanks a lot in advance.

Regards,

Anthony

[ebilcari]

Based on the description it seems like 'Forced Remediation' is not being applied in the SSID or the WLC/AP is not accepting dynamic VLAN assignment. Have you enforced Remediation directly at the SSID configurations or in the device Model configuration?

Have you performed a packet capture of the RADIUS traffic, is FNAC sending the quarantine VLAN when the host is at risk?

[Anthony_E]

Thanks a lot as always!

[AEK]

Thanks Anthony & Emirjon

Based on the description it seems like 'Forced Remediation' is not being applied in the SSID

-> Actually I enabled it in the SSID Port Group Membership, and set in model config the right VLAN

or the WLC/AP is not accepting dynamic VLAN assignment.

-> I confirm the WLC/AP accepts dyn VLAN assignment, since it works very well when I disable the host, it goes instantly to the isolation VLAN (same as remediation VLAN)

Have you enforced Remediation directly at the SSID configurations or in the device Model configuration?

-> I did in SSID config, and then I did it in both SSID and dev model config at the same time, but still the same result

Have you performed a packet capture of the RADIUS traffic, is FNAC sending the quarantine VLAN when the host is at risk?

-> Yes I did with tcpdump we can see RADIUS DM is sent to the WLC, but the At-Risk host never moves to isolation. The thing I noticed is that multiple DM are still sent periodically by FNAC, like if it is still trying.

Also as mentioned, on my L2 switches the At-Risk hosts are properly moved to remediation without any issue.

[ebilcari]

What is happening after this DM messages are sent to the WLC?

The host should be disconnected from the SSID and connected again, but this time FNAC should respond with the Quarantine VLAN. I tried to emulate the same using a FAP/FGT, this are the output of the radius logs:

88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: [Post-Auth] Process Started - NAS IP=10.0.10.1 / Source IP=10.0.10.1 (DefaultConfig)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using device: ManagedElem: GW (10.0.10.1) [ID=55]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using edge device: ManagedElem: FP421xxxxx (10.5.32.54 / 70:4C:A5xxxxx) [ID=105]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using port: None
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:246 :: #139583 :: Processing post-auth using vdom: ManagedElem: GW:VDOM root (10.0.10.1:0) [ID=56]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: Processing post-auth using ssid: ManagedElem: GW:SSID root:A-Por (null:0) [ID=107]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: Processing post-auth using client: 88:46:04:xxxxxx (MAB)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: OkToProcess: Checking SSID - Use Custom Config=true
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:247 :: #139583 :: OkToProcess: true / SSID Mode = Local
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:257 :: #139583 :: Enforcement Action - Host At Risk on Quarantine Enforced SSID
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: Get Enforcement Action returned: EnforcementStateAction [accessValue=VLAN_511, action=2, logicalNetworkName=Remediation]
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: Enforcement Action = Enforce (AccessValue=VLAN_511)
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:258 :: #139583 :: ConvertAccessValue [VLAN_511]: redirectSource = IfName, redirectDest = PortID
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:259 :: #139583 :: ConvertAccessValue: New policy is: 511
88:46:04:52:4C:59 FINE :: 2025-09-09 14:19:22:260 :: #139583 :: Using response attrs for ssid [107] / Logical Network [Remediation]

Kindly check the RADIUS logs of your setup and focus in the [Post-Auth] part. Keeping a packet capture running can also help:

# execute tcpdump port 1812 or port 3799 and host 10.x.x.x -v

[AEK]

Thanks Emirjon

What is happening after this DM messages are sent to the WLC?

The host should be disconnected from the SSID and connected again

-> Yes during all the period in which NAC sends repeatedly the DM messages we feel the client connection flapping up/down, until we clear the At-Risk status then it backs to normal connection. But it never goes to isolation.

I'll run the suggested plan and share the result.