FortiNAC to send the Cisco radius Neat attribute

[BarryGhuman]

Hi Team, 

I am replacing Cisco ISE with FortiNAC. The Cisco ISE is currently configured to profile the Access Points and send a Cisco Neat attribute. This Neat attribute helps the Cisco switch assign a truck role to the port. 

In FortiNAC, Network Access > "Configuration" - It does not provide any option to send radius attribute only and VLAN ID is mandatory. 

https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116681-config-neat-cise-00.html

cisco-avpair = device-traffic-class = Switch

I want to check if FortiNAC has a way to sort this situation. 

Regards, 

Barry Ghuman 

[ebilcari]

Yes, it's possible through custom Attribute Groups. You can also check this article that shows a similar setup.

[BarryGhuman]

Hi Team, 

I think you didn't understand my question. I want to assign only Radius attributes. I don't want to send the mandatory VLAN attribute. 

Regards, 

Barry Ghuman

[ebilcari]

Are you trying to customize the attributes on the RADIUS Access-Accept right?

Are you having trouble creating the custom attribute group or applying it?

[BarryGhuman]

Hi Team, 

There is no problem in creating the radius attribute. 

The problem is assigning the attribute. Under "Model Configuration" - the radius attribute group is assigned with a VLAN. 

I don't want to send VLAN attributes and only "radius attributes". 

Regards, 

Barry Ghuman

[ebilcari]

This is explained on the article I've shared previously: FortiNAC will try to merge the default group attributes with the new attributes it finds in 'Additional RADIUS Attribute Group'. The solution is to set the 'Default RADIUS Attribute Group' to None at the network device level and set the new group attribute at the logical network.

[BarryGhuman]

Hi Emirjon, 

Thank you for your reply!

Here is the mapping of attributes:

--Under Network Access --> "Configuration" is the assigned value

Configuration assigns the "Logical Network"

--The Logical network gets the attributes --> Model Device (Logical Network Configuration). 

Under the mapping radius attributes- it does not permit to add only the radius group. It requires a VLAN as well. 

Here is the question, how does FortiNAC authorize the Cisco AP to permit a trunk port on the switch after profiling to Cisco AP? 

Regards, 

Barry Ghuman

[ebilcari]

Yes the logical network that is chosen on the NAP can be added to the Model configuration of the device. If you select None as Default Attribute Group, you will be able to select only the "Additional RADIUS Attribute Group" that will have only the attribute created previously. If you hover the mouse over, you will see the list of attributes that will be sent with the Access-Accept.

This method is often used for hosts. By default the AP are treated like network devices, not like normal hosts. In case you need to apply NAP to APs you have to also enable this option here:

[BarryGhuman]

Hi Emirjon, 

I think you did not understand my question. I know how to create and map the radius attribute group for the connection reply. 

In your screenshot -- The Logical network is assigned "Access Value" + "Additional Radius Attribute Group". 

"Access Value" is a VLAN and sent as radius attribute " Tunnel-Private-Group-ID". 

When the AP is profiled to Cisco AP, it will be assigned a "Logical Network" as per the Network Access Configuration.

The enforced attribute "Tunnel-Private-Group-ID" will conflict with the neat attribute (to authorize the port as a trunk). 

How can FortiNAC authorize a port as a trunk after successful profiling on Cisco Switch?

Regards, 

Barry Ghuman 

[ebilcari · Accepted solution]

The access value field is just a value that can be used if one of the attributes has the pointer %ACCESS_VALUE% configured. If the default is set to None and only this custom attribute is selected, that will be the only attribute that will end up in the Access-Accept:

You can run a packet capture from FNAC CLI to verify the RADIUS responses: 

tcpdump host x.x.x.x and port 1812 -nnv

or if in FNAC version 7.2/4:

execute tcpdump host x.x.x.x and port 1812 -vX

*replace x.x.x.x with the IP of the switch