Fortinac allow internet access (Guest Network) for Rogue devices

[muels7]

We are getting ready to implement our FortiNAC in production but there is one thing our managers would like set up.  They want all Rogue devices to still be allowed internet access, but just to be blocked from all internal network access.  We have VLANs in place with ACLs to do this, but users don't get any type of notification about this.

Is there a way that we implement some type of portal page notification that says something to the effect of "Your network access has been restricted to internet access only with no access to company resources"?  So far we have only been able to get a portal popup to work for the isolation VLAN, but the isolation VLAN does not allow internet access.

[Sheikh]

Hello @muels7 

Please follow these technical documents.

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Comprehensive-guide-for-a-simple-FortiNAC/t...

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-FortiNAC-Guest-Captive-Portal-configuration...

https://community.fortinet.com/t5/FortiNAC/Technical-Tip-An-example-of-a-simple-network-deployment-o...

regards,

Sheikh

[muels7]

This would work if we were having these rogue devices register as guests.  However many of the rogue devices are devices without a web browser, such as streaming media devices and smart TVs that would be unable to register.  At this time we don't plan on having guests register their devices.

[AEK]

I guess your rogue hosts are WiFi connected, right? In this case create a SSID "Guest" and don't control it with FortiNAC. As per my experience all companies I know don't manage guest WiFi with FortiNAC in order to save license for Corporate hosts.

Regarding the notification/welcome message, usually this can be configured at WiFi controller level.

[muels7]

The majority of our rogues are wireless yes, but in this case I want to do this with wired devices.  We already have an isolated vlan for our guest wireless that all personal devices can connect to.

What I want to do is setup a "guest" access for the wired network without forcing clients to register.  I am in the education sector so we constantly have staff bringing devices in from home and plugging them in to the network (no matter what our policy says about it).  My director and assistant director are under the mentality that they don't care as long as they can't access internal network resources.  I could setup the NAC to put these devices straight through to a guest vlan, which we already have configured, but I haven't found a way to show them a message in this case.  It seems they are only notified that they have been isolated if they are in the default isolation vlan.

[ebilcari]

There is a feature in FortiNAC for this Allowed domains, but its main scope is the opposite of your requirements. It will work by whitelisting some of the domains and block others. As I know is not possible to inverse this function (block some domains and allow the rest) since the main scope of it is for handling isolated devices not giving network access.
Rouge devices should not be considered as guest hosts until they are registered. During the registration phase a disclaimer can be put on the web page explaining the limitations for this guest network.

[muels7]

Yes, I found this feature as well.  It could be an option, but we would prefer to allow them open web access.  There would be too many sites to whitelist with this option.  It is my understanding that this feature is mostly designed to allow hosts to access their update sites if they were isolated for being out of date so they could still update and remediate.

If this isn't possible so be it, we have a working solution in place.  It unfortunately doesn't force open a web page though informing the user that they are isolated from the main network.  They wouldn't know until trying to access internal network resources, which is just going to create more helpdesk tickets which we are trying to avoid.

[ebilcari]

Yes correct. Basically all captive portal solutions can only achieve this at the beginning of the connection, offering a disclaimer to the users prior to give network access.

[AEK]

I don't think this can be done with FortiNAC. I think as you said the FNAC's banner is only doable when you are really in isolation network, not in other VLAN, and on the other hand the wildcard is not supported in "allowed domains".

For this special requirement you need another solution, much simpler than FortiNAC, and it should be based on DNS proxy server.