Dear Team,
We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport.
Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS.
Thank You
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
If not enforced than the Authentication policy details that you shared above should not have any effect.
It seems that the switch fails to report the MAC address as connected, so FNAC has to remove the host information and change the state as offline. Does FNAC has CLI access to the switch, have you recently checked the Validate Credentials?
When the issue happens/or now, you can r-click on the switch and select "Test Device Mapping", it should read the mac address table of this switch (looks like a Cisco switch).
On the results of "MAC Address Table ( L2 Poll )" try to find out the MAC address of the authenticated hosts or the one that is connected/authenticated but showing as Status offline.
Hello
Which FNAC version?
The following checks may be useful:
Dear @AEK ,
My FNAC-F is running on version 7.4 latest built.
i would like to answer your question below:
Thank you
Check your implementation and verify if the "Forced Authentication" in Port Group Membership is actually needed at port level, from FNAC GUI. There is a common misconception about it and usually this is not needed when the end hosts are authenticated via RADIUS. "Role Based Access" through Network Access policies will handle and help prepare the RADIUS responses.
Dear @ebilcari ,
on Port Group Membership, there is only Role Based Access enable. Other option are not enable. Force Authentication also not enable.
If not enforced than the Authentication policy details that you shared above should not have any effect.
It seems that the switch fails to report the MAC address as connected, so FNAC has to remove the host information and change the state as offline. Does FNAC has CLI access to the switch, have you recently checked the Validate Credentials?
When the issue happens/or now, you can r-click on the switch and select "Test Device Mapping", it should read the mac address table of this switch (looks like a Cisco switch).
On the results of "MAC Address Table ( L2 Poll )" try to find out the MAC address of the authenticated hosts or the one that is connected/authenticated but showing as Status offline.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1502 | |
1011 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.