FortiNAC persistent agent vlan change cli flapping between the change and the undo

[Jucker]

Hello,

Hope you are doing well.

I'm trying to change to vlan from authentication vlan which is the default with id 150 to Vlan 25 for the production access when the scan is successful without using dot1x on the switch port on Cisco switch.
So far only for testing the Operating system windows 10 pass and the right network access policy is granted, but when it comes to cli change it keeps adding vlan 25 and undo it to 150 back and fourth.
The port is a member of "Forced Registration" "Reset Forced Registration" and "Role Based Access"

My enforcement Access:

Cli template :
config t
interface %port%
description Network Security
switchport access vlan %vlan% 
do wr
Undo :
config t
interface %port%
description Authentication
switchport access vlan 105
do wr

FortiNAC version 9.2

Cisco Switch 3750 IOS 12.2

Thank you!

Best Regards!

[ebilcari · Accepted solution]

Firstly you don't have to use specific CLI command for simple VLAN change. By default FNAC will do the changes via CLI just by setting the VLAN under Access Value. CLI commands are usually used to add extra configuration like voice VLAN, ACL etc.

To gain more information you can check from "Ports", bottom window "Port Changes", it will give you a history of policy evaluations done.:

Since you are trying to do registration (register rouge devices) you have to change the Registration to Enforce and the value to 150.
You need to create also a method for host registration. If the host status is stuck as Rogue no policy will be evaluated. Easiest way can be Device Profiling rules.

[Jucker]

Thank you @ebilcari that was the issue i did as you told and things got to work!