Hi,
I'm configuring my first Fortinac.
I have a problem whit switching vlan. When I plug on switch an pc Fortinac receive snpm trap but the switch to isolation vlan is done after 40/50 seconds about.
So pc get IP of production and after switching VLAN it don't get a IP of isolation subnet until I do ipconfig /renew.
here what I see on switch:
Aug 28 15:06:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 28 15:06:59: %SYS-5-CONFIG_I: Configured from console by admin on vty1...
Could you help me?
Thanks in advance
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
This looks like an integration with a Cisco switch, is it properly modeled in FNAC, are the credentials validated for both SNMP and CLI?
It is preferred to use SNMP MAC traps instead of link status traps. In case of link status traps a L2 polling is triggered and it will add some delay.
Is the end host connected directly or through an IP Phone?
The community must be RW, otherwise it doesn't accept up/down requests from NAC.
This looks like an integration with a Cisco switch, is it properly modeled in FNAC, are the credentials validated for both SNMP and CLI?
It is preferred to use SNMP MAC traps instead of link status traps. In case of link status traps a L2 polling is triggered and it will add some delay.
Is the end host connected directly or through an IP Phone?
Created on 08-29-2024 03:33 AM Edited on 08-29-2024 05:44 AM
Hi Emirjon,
I set on switch SNMP MAC traps but without success.
Switch delay to isolation VLAN continues to exist.
Update:
I plug cable on PC powered off. I turn on PC and bellow you found what I see on switch and FortiNAC CLI (root)
Switch
Aug 29 14:32:06: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:07: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:23: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 29 14:32:24: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 29 14:32:27: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 29 14:32:28: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 29 14:33:06: %SYS-5-CONFIG_I: Configured from console by rzanella on vty1 (...)
FortinaNAC
> tcpdump -i eth0 | grep snmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
14:32:56.811821 IP 10.5.10.13.57186 > fortinac.mydomain.com.snmptrap: C="c***y" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 886074 E:cisco.9.215.1.1.8.1.2.1=01_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=886074
14:32:56.828498 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="c***y" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
14:32:56.830053 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="c***y" GetResponse(32) noAccess@1 interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
Thanks Emirjon,
Credentials are validate and host is directly connected.
I will set SNMP MAC trap on switch like you suggested.
I will update when I do it.
Created on 08-29-2024 05:44 AM Edited on 08-29-2024 05:45 AM
Hi
I know similar case when the port is not put down and up again.
FortiNAC sends SNMP request to do so, not via CLI.
To check if FNAC can do so, right click on any switch port, properties (or change), then click disable the port (or something like that) and see if the port is really disabled.
Created on 08-29-2024 06:09 AM Edited on 08-29-2024 06:30 AM
Hi,
I try to disable the port and I can't:
I check snmp configuration on switch and there aren't snmp RW comunity.
I will set it.
The community must be RW, otherwise it doesn't accept up/down requests from NAC.
I do it but don't work
Please share your SNMP config on the switch.
Also please try sniff SNMP traffic on FortiNAC and reproduce the issue.
Created on 08-30-2024 12:34 AM Edited on 08-30-2024 12:56 AM
SNMP configuration on switch:
interface GigabitEthernet0/1
snmp trap mac-notification change added
snmp trap mac-notification change removed
snmp-server community p***p RO 50
snmp-server community pr***rap RO 50
snmp-server community ForNacTrap RW 50
snmp-server trap-source Vlan10
snmp-server location Ufficio Network
snmp-server contact network@mydomain.com
snmp-server enable traps snmp warmstart
snmp-server enable traps entity
snmp-server enable traps cpu threshold
snmp-server enable traps flash insertion removal
snmp-server enable traps envmon fan shutdown supply temperature status
snmp-server enable traps mac-notification change move threshold
snmp-server host 10.77.123.18 ForNacTrap
snmp-server host 10.7.3.2 pr***p
snmp-server host 10.7.1.104 p***p
-->10.77.123.18 is eth0 FNAC interface.
on switch:
sw-test-NAC#terminal monitor
sw-test-NAC#
Aug 30 09:24:30: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:31: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 30 09:24:50: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 30 09:24:53: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:24:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Aug 30 09:25:36: %SYS-5-CONFIG_I: Configured from 10.77.123.18 by snmp
Aug 30 09:25:38: %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to administratively down
Aug 30 09:25:39: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
Aug 30 09:25:45: %SYS-5-CONFIG_I: Configured from console by rzanella on vty1 (10.77.123.18)
Aug 30 09:25:45: %SYS-5-CONFIG_I: Configured from 10.77.123.18 by snmp
Aug 30 09:25:47: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Aug 30 09:25:50: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
Aug 30 09:25:51: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up
Capture on FNAC:
> tcpdump -i eth0 port 161 or 162
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
09:25:23.848743 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7680543 E:cisco.9.215.1.1.8.1.2.1=01_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7680543
09:25:35.039082 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="ForNacTrap" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
09:25:35.208673 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="ForNacTrap" GetResponse(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=2
09:25:35.864131 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7681744 E:cisco.9.215.1.1.8.1.2.1=02_00_01_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7681744
09:25:44.352888 IP fortinac.mydomain.com.58748 > 10.5.10.13.snmp: C="ForNacTrap" SetRequest(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=1
09:25:44.364962 IP 10.5.10.13.snmp > fortinac.mydomain.com.58748: C="ForNacTrap" GetResponse(32) interfaces.ifTable.ifEntry.ifAdminStatus.10101=1
09:26:19.926626 IP 10.5.10.13.62512 > fortinac.mydomain.com.snmptrap: C="ForNacTrap" Trap(88) E:cisco.9.215.2 10.5.10.13 enterpriseSpecific s=1 7686150 E:cisco.9.215.1.1.8.1.2.1=01_01_31_b0_0c_d1_60_db_d2_00_01_00 E:cisco.9.215.1.1.8.1.3.1=7686150
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1570 | |
1034 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.