Fortinac - Enforced Ethernet Port With PC + Phone Looping

[Partisan44]

I am currently experiencing this issue-

I have connected a phone &behind it a pc to a cisco switch on an ethernet port enforced by fortinac.

when i shut & unshut the ethernet port with both the pc & phone connected it stays in a loop.

On the switch cli i see fortinac putting the port into admin state down-> applies a dacl -> port moves into correct vlan-> then shuts its down and this happens over & over ,

However if i let the phone come up register & thereafter i connect the pc ,its not a problem

Anyone experience this?

[AEK]

In normal condition, if a port has a voice VLAN defined and a phone connected to it, FortiNAC doesn't shut it down when changing VLAN. So check the below:

• Is the phone registered on FNAC?
• Is the voice VLAN ID defined in the "Voice VLAN" field in the switch model configuration?
• Is the voice VLAN defined on the affected switch-port? I mean something like this:

    switchport access vlan X
    switchport mode access
    switchport voice vlan Y

[Partisan44]

@AEK 

• Is the phone registered on FNAC - Yes
• Is the voice VLAN ID defined in the "Voice VLAN" field in the switch model configuration? - Yes
• Is the voice VLAN defined on the affected switch-port? I mean something like this:

    switchport access vlan X
    switchport mode access
    switchport voice vlan Y
Yes and an additional configuration - 
spanning-tree portfast 

[ebilcari]

Is this behavior happening only when one of the host is showing as Rogue or even when they are both registered (PC&IP Phone)?

Is the IP Phone registered as a standard IP Phone (black icon) or as a different host? Normally the port status should not appear as multihost like in this example but it should show a host behind a phone:

If this is the case than there will be a racing condition of which host policy will get applied.

[Partisan44]

Hi

@ebilcari 

Both hosts are registered 

Is the IP Phone registered as a standard IP Phone (black icon) - Yes,its not a rogue host

[ebilcari]

The idea is to not have the port showing as multi host but as a daisy chain icon (now I have the right screenshot):

Is the IP Phone having a network access policy and does it also get CLI commands applied or only the host behind it? Usually the Voice VLAN is negotiated between the IP Phone and the switch via CDP/LLDP and FNAC should not apply any configuration for the IP Phone.

The 'Port Changes' tab may give a better overview of the applied actions and the timing of the actions.
Check also the 'Ignore MAC Notification Traps for IP Phones' (by default enabled) in System> Settings> Network Device