Problems with DynamicVlans and machine certificates

[Jojjalu]

We are in the process of switching to fortigate and fortiap, : we have an environment that we are testing on and the radius server is a Microsoft NPS server, when we use user certificates, the dynamic VLAN works, and the user ends up on the VLAN that the NPS provides, but if we set it so that via the policy it is the machine certificate that is to be used, then the client is not moved to the VLAN that the NPS says, but the client remains on what you can say "onboarding" the VLAN, so the CEO can be the difference from the user that works but not when the machine does not?

[Jean-Philippe_P]

Hello Jojjalu, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello again!

I found this solution. Can you tell me if it helps, please?

The difference in behavior between user and machine certificates could be due to incorrect RADIUS server configuration for machine certificates, missing or incorrect RADIUS attributes for VLAN assignment, or misconfiguration in FortiGate settings for handling machine certificates. Ensure that the RADIUS server returns the correct VLAN attributes for machine certificates and that FortiGate is configured to handle these attributes properly.

[Jojjalu]

Hi Jean-Philippe,

Thanks for your reply!

We've confirmed that the NPS server does return the correct VLAN attributes for both machine and user authentication – including Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID.

The same configuration works perfectly in our current Ruckus environment.

In FortiGate + FortiAP, user certificate authentication results in proper VLAN assignment.
However, when machine certificate authentication is used, the VLAN attribute is ignored and the client stays in the default "onboarding" VLAN.

We suspect FortiGate does not properly honor the VLAN assignment for EAP-TLS identities like host/computername.domain.local.

Is there a known limitation, or extra configuration required for dynamic VLAN assignment to work based on machine authentication (rather than user)?

Best regards,
[Johan]

[Jean-Philippe_P]

Hello Jojjalu again :)

I have found this reply for your question, does it help you?

There is no known limitation specific to FortiGate and FortiAP regarding dynamic VLAN assignment based on machine authentication using EAP-TLS. However, there are a few areas you can check to ensure proper configuration:

1. NPS Configuration: Double-check that the NPS policies are correctly configured to handle machine authentication and that the VLAN attributes are being sent correctly.
   
   
2. FortiGate Configuration: Ensure that the FortiGate is configured to support dynamic VLAN assignment and that there are no conflicting settings that might override the VLAN assignment.
   
   
3. FortiAP Profile: Verify that the FortiAP profile is correctly set up to handle dynamic VLANs and that the SSID is configured to allow dynamic VLAN assignment.
   
   
4. Certificate Validation: Ensure that the machine certificates are correctly issued and recognized by both the NPS server and the FortiGate.
   
   
5. Debugging and Logs: Use debugging tools on the FortiGate to capture logs during the authentication process to identify where the failure might be occurring.
   
   
6. Firmware Version: Ensure that you are using the latest firmware version for both FortiGate and FortiAP, as updates may contain fixes for issues related to VLAN assignment.

If the issue persists after these checks, consider reaching out to Fortinet support for further assistance.