Fortinac some hosts not communicating to the fnac server

[bootaan26]

hello,

i am facing an issue with some of the hosts installed persistent agent, these hosts are not communicating with fortinac server. 

i have checked everything and also disabled the antivirus running the hosts and uninstalled and installed the persistent agent and nothing is working. 

Any ideas will be helpful.

[Severo]

There are several things you can check. First, ensure the SSL certificate installed on the FortiNAC server is valid and includes the full certificate chain. If intermediate certificates are missing, the agent may not establish a secure connection.

Also, confirm that the network allows traffic on TCP port 4568 and UDP port 4567, which are used by the Persistent Agent. Make sure no firewall or security software is blocking these ports. DNS resolution is another common issue verify that the hosts can properly resolve the FortiNAC server's hostname. On the host side, check the Windows registry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Bradford Networks\Persistent Agent to ensure the homeServer value is correctly set to the server's IP or FQDN. It's also important to make sure the Persistent Agent version installed on the hosts matches the version supported by your FortiNAC deployment.

Reviewing the Persistent Agent logs found in %ProgramData%\Bradford Networks\ can reveal more details about why communication is failing.

[bootaan26]

Hi Severo,

I have checked tcp port 4568 and is working fine and also confirmed no firewall or AV is blocking the traffic. i have also checked homeServer under regedit and could not find homeServer.

I will paste here the logs found under Bradford Networks/general, please check it.

Authorized application %ProgramFiles%\Bradford Networks\Persistent Agent\bndaemon.exe is enabled in the firewall.
2025-04-13 12:59:43 UTC :: ClientState = 1
2025-04-13 12:59:43 UTC :: ClientStateEnabled = 1
2025-04-13 12:59:43 UTC :: ServerIP = ns8200
2025-04-13 12:59:43 UTC :: Uninstall = /qn /x {A2BB123A-E9B8-4011-A976-C159A940C6DE}
2025-04-13 12:59:43 UTC :: Version = 9.4.0.93
2025-04-13 12:59:43 UTC :: allowedCiphers = TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,ECDHE-RSA-AES128-GCM-SHA256
2025-04-13 12:59:43 UTC :: allowedServers =
2025-04-13 12:59:43 UTC :: caTrustDepth = 4
2025-04-13 12:59:43 UTC :: disconnectedMsg = Your network access may be restricted. Persistent Agent is disconnected from Network Sentry.
2025-04-13 12:59:43 UTC :: discoveryEnabled = 1
2025-04-13 12:59:43 UTC :: expirationTime =
2025-04-13 12:59:43 UTC :: homeServer =
2025-04-13 12:59:43 UTC :: lastConnectedServer =
2025-04-13 12:59:43 UTC :: maxConnectInterval = 960
2025-04-13 12:59:43 UTC :: restrictRoaming = 0
2025-04-13 12:59:43 UTC :: securityEnabled = 1
2025-04-13 12:59:43 UTC :: selfSignedAllowed = 1
2025-04-13 12:59:43 UTC :: showDisconnectedIcon = 0
2025-04-13 12:59:43 UTC :: showDisconnectedMsg = 0
2025-04-13 12:59:44 UTC :: Starting to load random numbers
2025-04-13 12:59:44 UTC :: Finished loading random numbers
2025-04-13 12:59:44 UTC :: output of socket() call = 1100, errno = 2
2025-04-13 12:59:44 UTC :: attempted to setup IPC socket
2025-04-13 12:59:44 UTC :: confMaxInterval = 960 maxConnectInterval = 960
2025-04-13 12:59:44 UTC :: Calling getServerList
2025-04-13 12:59:44 UTC :: expiration time not a date time
2025-04-13 12:59:44 UTC :: getServerList()
2025-04-13 12:59:44 UTC :: 00:50:56:C0:00:01
2025-04-13 12:59:44 UTC :: 00:50:56:C0:00:08
2025-04-13 12:59:44 UTC :: 3C:52:82:67:F8:AE
2025-04-13 12:59:44 UTC :: Server List:
2025-04-13 12:59:44 UTC :: About to delete transport
2025-04-13 12:59:59 UTC :: IP Addresses: '169.254.120.132' , 'fe80::393c:7a51:5481:7884%16', '169.254.73.80', 'fe80::5817:e7f0:c530:4950%8',
2025-04-13 12:59:59 UTC :: Skipping wait for new IPs; already different.
2025-04-13 12:59:59 UTC :: Calling getServerList
2025-04-13 12:59:59 UTC :: getServerList()
2025-04-13 12:59:59 UTC :: 00:50:56:C0:00:01
2025-04-13 12:59:59 UTC :: 00:50:56:C0:00:08
2025-04-13 12:59:59 UTC :: 3C:52:82:67:F8:AE isolation.xx.yz.co
2025-04-13 12:59:59 UTC :: Looking up _bradfordagent._tcp.isolation.xx.yz.co
2025-04-13 12:59:59 UTC :: Server List: fnac01.xx.yz.co,
2025-04-13 12:59:59 UTC :: About to delete transport
2025-04-13 12:59:59 UTC :: Deleted Transport
2025-04-13 12:59:59 UTC :: Using SecureAgentTransportV1
adding KeyExpiredListener
adding KeyExpiredListener
2025-04-13 12:59:59 UTC :: SecureAgentTransportV1 constructor finished
adding KeyExpiredListener
2025-04-13 12:59:59 UTC :: Server: fnac01.xx.yz.co, tcp: 4568
2025-04-13 12:59:59 UTC :: Host = fnac01.xx.yz.co
2025-04-13 13:00:00 UTC :: SSL_get_verify_result = 18

Thanks.

[ebilcari]

Based on 'SSL_get_verify_result = 18' it seems that FNAC is configured to use a self-signed certificate for Agent communication. As mentioned in this section of the Admin guide, this is not supported. The easiest way would be to use a private CA to generate this certificate for FNAC and import the root CA in the end host.

[bootaan26]

Hi ebilcari, 

Thanks for your reply.

don't have an idea to generate a private certificate. will appreciate if you share a guidance to generate a private certificate.

Please check the log it says "trust_UNKNOWN".

2025-04-13 13:00:00 UTC :: peer CommonName = fnac01.xx.yz.co.so
2025-04-13 13:00:00 UTC :: Checking Peer name fnac01.xx.yz.co.so against Common or Subject-alternative-name entry fnac01.xx.yz.co.so
2025-04-13 13:00:00 UTC :: Peer name "fnac01.xx.yz.co.so" matches "fnac01.xx.yz.co.so"
2025-04-13 13:00:00 UTC :: Setting fnac01.xx.yz.co.so|fnac01.xx.yz.co.so|da:05:9e:ab:1b:99:5b:58:d6:55:e5:fa:ec:c6:19:de:93:55:53:d2 to trust_UNKNOWN
2025-04-13 13:00:00 UTC :: Connection failed! 1
2025-04-13 13:00:00 UTC :: SslStreamTransport::disconnect()
2025-04-13 13:00:00 UTC :: SslStreamTransport::disconnect() NOT joining rxBoostThread because this IS the receive thread
2025-04-13 13:00:00 UTC :: SslStreamTransport::disconnect() joined threads, free-ing the SSL state
2025-04-13 13:00:15 UTC :: sslTransDisconnected=true
2025-04-13 13:00:15 UTC :: dgramTrans->isKeyGood()=false

[ebilcari]

You will need a private root CA outside of FNAC to generate this certificate. If there isn't any PKI deployed in this network, you can use an open source tool like OpenSSL or XCA. You can also check the 4th section of this article. This old FGT Cookbook section seems to have more details on how to use the XCA tool.

[rajalarc5]

I'm not familiar with WMI. You're saying that FortiNAC can connect to a device using this protocol to learn the user account & authenticate it? Would this also work for a non-windows device (i.e. a Mac, Chromebook)