Fortinac hosts (Laptop) switching external adapter

[bootaan26]

Hi guys,

We are using fortinac as NAC and we use mostly laptops with external network adapter, so the issue is if the laptop is registered and someone takes the external adapter and plugs in to his/her laptop, it is not isolating for the new host (Laptop) it gives full network access. and when we check the port, it shows us the new host is registered with the existing user (registered previous laptop).

Any solution in this situation?

[AEK]

Hi Bootaan

This is because you are registering/identifying the laptop only based on adapter MAC address.

One solution is to use persistent agent.

[bootaan26]

Hi AEK,

Every host is installed persistent agent, and we register hosts through captive portal.

so, my question is how we can prevent users swapping external network adapters?

Could you please elaborate more the solution you suggested?

Thanks.

[AEK]

Hi Bootan

So I guess your main issue is that when a laptop without a PA uses the external adapter it is considered as the registered one, right?

Since all Corp laptops have PA, then you can do many controls via the UHP.

For example you can edit the host properties (in HPU) to force the check of PA communication. So in case PA is not communicating the host is excluded from the profile and it will fall under another profile that the policy will put in isolation.

You can also control user groups in the HPU. The PA will tell FNAC which user is connected and the policy will put it in the right VLAN accordingly.

That could be one possible solution I have in mind.

[bootaan26]

Hi AEK,

I am using 7.4.0 version, and I don't see any option of UHP or HPU when I edit host properties.

@ebilcari This is a just a guideline and is not giving sample configuration and when I try to access this KB 193199. am getting Access Denied error.

[AEK]

Hi Bootan

UHP is User-Host Profile.

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/15797/user-host-profiles

[bootaan26]

Hi AEK,

Could you post sample UHP profile for PA.

This is some of the UHP we have.

Thanks.

[ebilcari]

This behavior is explained in details in this section of the Administration Guide or in this dedicated guide: Tracking Moving Dongles.

[AEK]

Hi Bootaan

Emirjon shared a good example here:

https://docs.fortinet.com/document/fortinac-f/7.2.0/tracking-moving-dongles/40885/example-use-case

As you can see in the network access policy, the clients with "non-communicating agents" are put in the Dead End network.