Persistent agent don't comunicate to FortiNAC

[rzanella]

Hi, I'm configuring my first FortiNAC.
I manually installed the Persistent agent on a test PC (OS Windows 11), according to the instructions found in https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Manually-install-and-configure-Persistent-A...
It seems that the agent does not communicate with the Fortinac.
From the PC, telnet to eth1 fortinac on port 4568 is ok.
In the %ProgramData%\Bradford Networks folder I do not find any log files. As suggested I reinstalled the client but without success.

Icon of Persistent agent say: Network access normal. PC is viewed as rogue.

Could you help me?

Thanks in advance.

[AEK · Accepted solution]

On the client, regedit, go the the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Bradford Networks\Persistent Agent

Does the value homeServer is the same as FortiNAC server FQDN or IP?

And is the certificate that you installed in FortiNAC server for agent communication has CN the same as the value defined in the above homeServer key?

[ebilcari]

Which agent version are you installing and does the user have admin rights in windows? Having an empty log folder seems like the service is not running with the appropriate permissions, is the Service in running state?

[rzanella]

Hi,

agent version is 9.4.0.93. It was installed used local user with administrative rights.  And the service is in running state.  

[ebilcari]

There have been no similar issues reported for this agent version. You can try to install one of the recent version of PA to see if there is a difference.

• agent-9.4.1.98.jar 2023-03-23
• agent-9.4.2.99.jar 2023-08-23
• agent-9.4.3.100.jar 2023-09-29
• agent-9.4.4.105.jar 2024-04-08

Also check if there is any installed antivirus that may prevent the service from running.

[rzanella]

HI,

To download an updated version I went to System > Settings > Update > Agent Packages. by pressing the download button. No new packages are displayed.
From the settings under System > settings > update >system I saw that the Fortinac connects to fnac-updates.fortinet.net. With the browser I connected to the url and was able to download the agent-9.4.4.105.jar.
Should the file I downloaded be used on the PC? Or put in a Fortinac folder?
Thanks a lot.

[ebilcari]

In order to download the latest agents in FNAC you have to first fill the 'Agent Distribution Directory' as shown here:

You can also unzip the downloaded jar file, it should contain the .exe file that you can directly install in the PC.

[rzanella]

Thanks to your instructions I was able to update the Persistent agent packages.
I installed version 9.4.4.105 but nothing changed. There are no log files in the %ProgramData%\Bradford Networks folder.
To exclude a write/read permission problem I gave everyone full permissions to this folder. But even in this case there are no log files.

[ebilcari]

Have you tried to disable/uninstall any antivirus in the PC before doing the agent installation? Is this a computer domain, does it have any hardening in place?

[rzanella]

PC is in domain. I will ask to my colegues that manage antivirus to disable temporany it to reinstall persistent agent.

Update

I reinstalled the agent after the antivirus was disabled. After doing this I found the log files in the C:\ProgramData\Bradford Networks folder.
I also installed the agent on another PC with active antivirus and it was successful.

[ndumaj]

Hello @rzanella 

You should have logs on the %ProgramData%\Bradford Networks folder.

Check the installation user privileges (administrative privileges are required) once again, disable antivirus, uninstall/install the PA.
Article:Windows Persistent Agent logs 

BR