NAC

[williasthomas192004]

FortiNAC self-registration Guest Management with wireless dynamic Vlan management .

During the registration process without doing nothing . I got a native vlan ip.

In NAC's Network>Inventory>Device>Virtualized Devices>root I haven't add native Vlan id .

What is the fault ?

[ebilcari]

When an unregistered host (Rogue) connects, FNAC will try to isolate it in the registration network which in this case should be VLAN 201. If the SSID in FGT doesn't have this VLAN configured it may leave the host in the default subnet after the Access-Accept. You can also check this article for more information related to this scenario: Technical Tip: A simple deployment including FortiGate/FortiAP (self-registered guest)

[williasthomas192004]

Isolation with FortiNAC

FortiNAC uses isolation VLANs to restrict network access for unregistered or unknown devices, placing them in an isolation VLAN until they are registered or authenticated

Is that right? How figure out for isolation.
In your setup u create a vlan under wirelss interface with virtual lan with a tunnel mode.
My setup is create a vlan under fortilink swith and run bridge mode.

For Isolation Do I need to create a policy , and how  .Could you pls guide to me? Thanks!

[ebilcari · Accepted solution]

Using a bridged SSID will be similar as long as the VLAN is allowed in the switchport where the AP is connected. The IP configurations shown in the example for the VLANs under the SSID, need to be configured in a similar way to normal VLANs in the FSW.

There is no need to create policies for isolation, based on the host state FNAC will push the configured VLANs as long as the Enforcement is enabled in the SSID.