Fortinac delay to switch to VLAN isolation

[rzanella]

Hi,

I'm configuring my first Fortinac.

I have a problem whit switching vlan. When I plug on switch an pc  Fortinac receive snpm trap but the switch to isolation vlan is done after 40/50 seconds about.
So pc get IP of production and after switching VLAN it don't get a IP of isolation subnet until I do ipconfig /renew.

here what I see on switch:
Aug 28 15:06:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 28 15:06:59: %SYS-5-CONFIG_I: Configured from console by admin on vty1...

Could you help me?

Thanks in advance

[ebilcari · Accepted solution]

This looks like an integration with a Cisco switch, is it properly modeled in FNAC, are the credentials validated for both SNMP and CLI?

It is preferred to use SNMP MAC traps instead of link status traps. In case of link status traps a L2 polling is triggered and it will add some delay.

Is the end host connected directly or through an IP Phone?

[ebilcari · Accepted solution]

This looks like an integration with a Cisco switch, is it properly modeled in FNAC, are the credentials validated for both SNMP and CLI?

It is preferred to use SNMP MAC traps instead of link status traps. In case of link status traps a L2 polling is triggered and it will add some delay.

Is the end host connected directly or through an IP Phone?

[rzanella]

Hi Emirjon,

I set on switch SNMP MAC traps but without success.

Switch delay to isolation VLAN continues to exist.

Update:

I plug cable on PC powered off. I turn on PC and bellow you found what I see on switch and FortiNAC CLI (root)

Switch
Aug 29 14:32:06: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:07: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:23: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 29 14:32:24: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 29 14:32:27: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:28: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 29 14:33:06: %SYS-5-CONFIG_I: Configured from console by rzanella on vty1 (...)

FortinaNAC
> tcpdump -i eth0 | grep snmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:32:56.811821 IP 10.5.10.13.57186 > fortinac.mydomain.com.snmptrap: C="c***y" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 886074 E:cisco.9.215.1.1.8.1.2.1=01_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=886074
14:32:56.828498 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="c***y" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
14:32:56.830053 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="c***y" GetResponse(32) noAccess@1 interfaces.ifTable.ifEntry.ifAdminStatus.10101=2

[rzanella]

Thanks Emirjon,

Credentials are validate and host is directly connected.

I will set SNMP MAC trap on switch like you suggested.
I will update when I do it.

[AEK]

Hi

I know similar case when the port is not put down and up again.

FortiNAC sends SNMP request to do so, not via CLI.

To check if FNAC can do so, right click on any switch port, properties (or change), then click disable the port (or something like that) and see if the port is really disabled.

[rzanella]

Hi,

I try to disable the port and I can't:

 I check snmp configuration on switch and there aren't snmp RW comunity.

I will set it.

[AEK · Accepted solution]

The community must be RW, otherwise it doesn't accept up/down requests from NAC.

[rzanella]

I do it but don't work

[AEK]

Please share your SNMP config on the switch.

Also please try sniff SNMP traffic on FortiNAC and reproduce the issue.

[rzanella]

SNMP configuration on switch:
interface GigabitEthernet0/1
snmp trap mac-notification change added
snmp trap mac-notification change removed

snmp-server community p***p RO 50
snmp-server community pr***rap RO 50
snmp-server community ForNacTrap RW 50
snmp-server trap-source Vlan10
snmp-server location Ufficio Network
snmp-server contact network@mydomain.com
snmp-server enable traps snmp warmstart
snmp-server enable traps entity
snmp-server enable traps cpu threshold
snmp-server enable traps flash insertion removal
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps mac-notification change move threshold
snmp-server host 10.77.123.18 ForNacTrap
snmp-server host 10.7.3.2 pr***p
snmp-server host 10.7.1.104 p***p

-->10.77.123.18 is eth0 FNAC interface.

on switch:

sw-test-NAC#terminal monitor
sw-test-NAC#
Aug 30 09:24:30: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:31: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 30 09:24:50: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 30 09:24:53: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 30 09:25:36: %SYS-5-CONFIG_I: Configured from 10.77.123.18 by snmp
Aug 30 09:25:38: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down
Aug 30 09:25:39: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 30 09:25:45: %SYS-5-CONFIG_I: Configured from console by rzanella on vty1 (10.77.123.18)
Aug 30 09:25:45: %SYS-5-CONFIG_I: Configured from 10.77.123.18 by snmp
Aug 30 09:25:47: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 30 09:25:50: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:25:51: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Capture on FNAC:
> tcpdump -i eth0 port 161 or 162
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
09:25:23.848743 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7680543 E:cisco.9.215.1.1.8.1.2.1=01_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7680543
09:25:35.039082 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="ForNacTrap" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
09:25:35.208673 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="ForNacTrap" GetResponse(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
09:25:35.864131 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7681744 E:cisco.9.215.1.1.8.1.2.1=02_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7681744
09:25:44.352888 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="ForNacTrap" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=1
09:25:44.364962 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="ForNacTrap" GetResponse(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=1
09:26:19.926626 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7686150 E:cisco.9.215.1.1.8.1.2.1=01_01_31_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7686150