FortiNac with switches managed by forticloud.

[tarngmyna]

We are having a weird issue with FortiNac. We have gotten the Fortinac setup and adopted all of the switches into it Mostly 124’s and 148’s. We have setup RADIUS as a local service. The NAC is able to see the switches and validate the credentials and SNMP strings. What we can’t get working is getting the policy on the switch. When we try to enable RADIUS auth on the switch from within the Fortinac device we don't see any change. We are able to manually setup the RADIUS settings on the switch to point to the NAC and are able to test authentication there and it’s passes.

Could forticloud be interfering somehow?

[ebilcari]

From your description we can assume that the integration and RADIUS configuration is done correctly. When you enable RADIUS checkbox the attribute groups should be shown in line with Logical Networks. Make sure that RFC_Vlan is selected or some custom set of attributes.

 

What is the state of the end host that you are trying to authenticate (rogue/registered)? For the policy to match the host should be in a "normal" (not isolated) state and the Port Group Membership on the switch port need to have at least Role Based Access checked.

[ndumaj]

In additional of Emirjon explanation and questions the radius debug log should also provide more information.
Please review the following articles:
https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Local-RADIUS-log-message-examples/ta-...
https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-FortiNAC-Local-Radius-Debug-amp/ta-p/...

-BR-
Nervil