Hi FortiNAC admins
Usually my Cisco switch-ports are pre-configured by network admin to accept voice VLAN, like this:
switchport voice vlan 20
Now assume that my ports are not configured so, I mean they are access ports with only DATA VLAN.
In that case, is there a possibility to tell FortiNAC to auto-configure switch-ports with voice VLAN when I plug the IP-Phone? (if possible without CLI in device modeling).
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @AEK ,
FortiNAC can automatically configure switch ports to include the voice VLAN when an IP phone is connected, without needing to manually configure each port via CLI. Ensure you have the necessary permissions and configurations on your network devices for FortiNAC to apply these changes.
You can configure the Voice VLAN using Radius and FlexCLI. I think you can find all details which you need on the below links:
https://docs.fortinet.com/document/fortinac-f/7.2.0/ip-phone-integration/519915/steps
https://docs.fortinet.com/document/fortinac-f/7.2.0/ip-phone-integration/065140/appendix#_RADIUS
BR.
If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.
Hi Atakan
Thanks for your feedback.
I hoped there was a way to do it without CLI Config (FlexCLI), since I prefer leave it as last resort.
But does the integration guide mean we can configure it using "RADIUS and FlexCLI" or using "RADIUS or FlexCLI"?
Hi @AEK ,
The integration guide indicates that you can configure automated Voice VLAN provisioning using either RADIUS or FlexCLI. The key point to pay attention to is as follows:
Using FlexCLI
Configure FortiNAC to assign Voice VLAN via RADIUS as IP Phones connect.
Using RADIUS
This configuration is required when the device model is set for Proxy RADIUS mode. It is not required for Local RADIUS mode.
BR.
Thanks Atakan, I'll try this.
By default FNAC will not treat the IP Phones as normal hosts. As shown also in the guide "IP phone MAC address is ignored when determining the appropriate untagged VLAN for a port: The untagged VLAN on a given port (data VLAN) will not be switched based upon the presence of a device with the IP Phone device type. The untagged VLAN will only switch based upon a device connecting behind the phone". This 'special treatment' is tied to this device type and the icon. By default it's expected that the switch and the phone will relay on CDP/LLDP to communicate the voice VLAN.
If a different icon is used when the device is classified than custom VSA (Cisco-AVPair = device-traffic-class=voice) can be sent via RADIUS or a tagged VLAN like this example here.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.