FortiNAC persisting agent connection

[osaleem2_10]

Hi everyone,

recently I did fortinac enforcement to my environment, first I integrated the NAC with my fortigate, and then I checked that all machines are okay getting the right policy and right VLAN.

After I did the enforcement it starts shows some agent connection errors, and machines getting the wrong vlan policy because of that connection error. how can I do troubleshooting, as before enforcement machine was able to communicate with NAC, after enforcement it was assigned to Reg-VLAN because no connection!

Im sure there is a policy to all all traffic with all services and ports.

Im sure the machine has Agent installed and 802.1X configuration.

other machines in the same branch working fine as you can see on the below screenshot. only some getting that weird error. any advice?

[AEK]

Hi Osaleem

Most probable reasons: certificate issue, or client can't reach FNAC server.

From the client try to ping the FNAC server. If it works then try sniffer from NAC side (TCP 4568) to see if the PA traffic is reaching FNAC. If it works then probably a certificate issue.

[osaleem2_10]

Hi AEK,

thanks for your reply.

do u mean reaching the NAC while the machine is in registration or remediation vlan?

and regarding to sniffing packet from NAC side, is this command enough to show the connection:

# exec enter-shell
# sudo tcpdump -nnvi port1 '(port  4568) and host <machine-IP>'

[AEK]

Hi Osaleem

It should reach NAC while in any VLAN: registration, remediation, prod, and so

The tcpdump command seems correct.

[ebilcari]

If the Agent was communicating normally before, most probably these hosts fail the compliance check and while they are in insolation/quarantine network they can't reach FNAC through the isolation port.

On the packet capture command it's better to include both FNAC interfaces and use the new syntax (without entering shell):

# execute tcpdump -i any port 4568 and host 10.x.x.x -v

The Agent logs from the end hosts should have more details.