- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fortinac Agent Not Active
I'm using Fortinac-F version 7.2. We have the following problem. When I install the agent on a machine in the domain, we can see it as active in the management interface. But when I install it on a machine outside the domain, the agent appears as deactive even though it is properly installed, what could be the reason for this?
- Labels:
-
FortiNAC
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Probably certificate issue.
I guess you signed the FortiNAC's certificate from your domain's CA. So the clients of your domain trust this certificate and can establish SSL connection, but the other can't since they don't have the required certificate CA.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Although all the certificates were the same (I installed it myself), it was still the same.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What you mean exactly by disabled status? Can you share a screenshot?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The certificates on FNAC is the same, but the end host should include the CA that is used to sign the Agent certificate in their trust store.
In this case the agent logs on the end host are very helpful to troubleshoot this further.
If you have found a solution, please like and accept it to make it easily accessible for others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Are you talking about the certificate I got from Windows Ad for Fortinac?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Usually the CA role is a dedicated server separate from AD, but as long as you have the root CA in the trusted store of the end host (part of the domain or not) the PA should start communicating with FNAC.
If you have found a solution, please like and accept it to make it easily accessible for others.
