Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rcpdkc
Contributor II

Fortinac Change L3 Devices

Hello, I am using fortinac-f version 7.2.5. I added my existing firewall as l3 device. I have access point devices under it. yesterday I replaced my existing firewall with a different model. since yesterday, when I add my username and password to the cli line from the credentials section in the interface, I get an error. the access point devices I saw before are no longer visible. although I press the clear known host button, nothing changes.nac_error1.PNGnac_error2.PNG

20 REPLIES 20
rcpdkc

fortinac6.PNG

 the error persists.

ebilcari

As I know, what is shown in that article is for older versions of FNAC that didn't have the option of custom ports configurations from GUI, now that is available so the CLI command is not needed anymore.

I searched internally and there is no reported issue related to using custom SSH ports. Is there any port forwarding configured in between FGT-FNAC or any SSH inspection rule in any firewall in between?

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
AEK

@rcpdkc, what do you get now when you click "Validate Credentials"?

AEK
AEK
ebilcari

I did a test with FNAC 7.2.5 and FGT 7.2.6 (VM) and it can successfully validate credentials on port 2222, so we can assume that there is no problem with FNAC. It may be something in your network that cause this failure.

testi.PNG

CLI output:

fnacf # execute ssh-known-hosts show nac
[10.1.2.1]:2222 ssh-ed25519 AAAAC3Nzxxxxxxxxxxxx

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
rcpdkc

the error persists in the same way. i think the problem here is that there is still information from the old device

 

nac_error1.PNG

AEK

  • Do you have pre- and post-login banners on your FortiGate? If so, please disable them and retry
  • On FortiGate use diag snif to check if FortiNAC-F is trying to connect to FortiGate on the right port
AEK
AEK
rcpdkc
Contributor II

I solved the problem by changing the port. thanks for your help.

ebilcari

Thank you for the feedback. You changed it back to default (22), can you tell was this a FGT limitation or a FNAC issue?

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
rcpdkc

I gave a different port number, I think it's a bug in fortinac. When I give the default port (22) or any other port, there is no problem. However, the problem occurs when I use port 2222, which I used on the device I replaced.

arocchi
Staff
Staff

I had exaclty the same behaviour, but changing ssh port to 22 didn't solved.  On my fortinac, the problem was on the HTTPS disabled and the API connector ( model configuration ) can't connect the Fortigate. 

Andrea Rocchi
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors