Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
unknown1020
New Contributor III

FortiNAC deployment

Friends, what is the difference between a FORTINAC device in layer 2 and layer 3? and which one is the most recommended

5 REPLIES 5
sahmed_FTNT
Staff
Staff

Hello, you can view the below link for deployment modes:

 

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/5da5fa90-9c1a-11ed-8e6d-fa163e...

Security all we want
ndumaj
Staff
Staff

Hi,

L3 network: Eth1 is connected to a single VLAN on an untagged port. Network traffic is routed to
the clients for each isolation network.
The following components are configured:
* FortiNAC Service Interface(s): The interface(s) which FortiNAC uses to
communicate with endpoints in the “isolation” networks.
* DHCP scope(s): Used by FortiNAC to deliver IP addressing to isolated
endpoints. In some cases, FortiNAC also delivers IP addressing for
known/trusted hosts.


L2 Network:
Traffic in the “isolation” VLANs are switched to the FortiNAC eth1 interface. 802.1Q
tags are configured for the corresponding “isolation” VLANs, and eth1 IP addresses
are within those networks.
The following components are configured:
* FortiNAC Service Interface(s): The interface(s) which FortiNAC uses to
communicate with endpoints in the “isolation” networks.
* DHCP scope(s): Used by FortiNAC to deliver IP addressing to isolated
endpoints. In some cases, FortiNAC also delivers IP addressing for
known/trusted hosts.
Guide:
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/4459f8be-65c4-11ed-96f0-fa163e...

The most used and recommended is L3

BR

- Happy to help, hit like and accept the solution -
AEK
Honored Contributor

It is about isolation.

Typically you use L2 deployment when you have single site, and L3 deployment when you have multiple sites interconnected with routers.

  • In L2 deployment the isolated devices are in the same vlan as FNAC isolation interface
  • In L3 deployment the isolated device can't be on the same VLAN as the isolation interface since it is on remote site and there must be a router between them, and isolation IP is assigned to device via DHCP helper

There is no recommendation, it depends on your case, single site or multiple sites.

However if you have single site it is certainly more simple to go with L2 deployment.

AEK
AEK
ebilcari

To add to this response, the L2 deployment can be useful when physical FNAC appliance is used in a local site and is part of the access perimeter security. In case of having FNAC as VM, the network/security team most probably will not allow to span the isolation VLANs from the access layer to the DataCenter so a L2 deployment will not be possible. The L3 deployments may require more changes on the network devices when it's configured for the first time but it will scale well in the future.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
salemneaz
Staff
Staff

 

  • Layer 2 (L2) polling - FortiNAC reads the network device's MAC address table.
  • Layer 3 (L3) polling - FortiNAC reads the network device's ARP table.

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Comprehensive-guide-for-a-simple-FortiNAC/t...

 

Labels
Top Kudoed Authors