fortiswitch lldp with NAC integration

[osaleem2_10]

Hi everyone,

I do have Fortigate, Foriswitch, and FortiNAC in my environment. I did a normal LLDP profile on my fortigate to let Fortiswitch handle my cisco phones and data vlans. it was working fine. I have created custom LLDP profiles named "LLDP-Prof2" can see it at below and all are okay till now.

The issue once I do NAC enforcement and add NAC security policy on fortiswitch, nothing works fine till I change the LLDP profile to default !! which is confusing me. I have open ticket with Fortisupport but unfortunately NAC team asking to check with the switch team and switch team do the same and till now no one has advised me about that kindly if anyone can help and explain how LLDP affects and the relation between LLDP and NAC. The reason that I need to understand if there is something wrong in my config, to avoid any issue when I do need to remove NAC enforcement as again I have to change from default to my custom LLDP prof.

my LLDP Config:

config switch-controller lldp-profile
edit "default"
set med-tlvs inventory-management network-policy location-identification
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "voice"
set status disable
next
edit "voice-signaling"
set status disable
next
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
config med-location-service
edit "coordinates"
set status disable
next
edit "address-civic"
set status disable
next
edit "elin-number"
set status disable
next
end
next
edit "default-auto-isl"
unset med-tlvs
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl enable
set auto-isl-hello-timer 3
set auto-isl-receive-timeout 60
set auto-isl-port-group 0
set auto-mclag-icl disable
next
edit "default-auto-mclag-icl"
unset med-tlvs
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl enable
set auto-isl-hello-timer 3
set auto-isl-receive-timeout 60
set auto-isl-port-group 0
set auto-mclag-icl enable
next
edit "fortivoice.fortilink"
set med-tlvs inventory-management network-policy location-identification
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
config med-location-service
edit "coordinates"
set status disable
next
edit "address-civic"
set status disable
next
edit "elin-number"
set status disable
next
end
next
edit "LLDP-Prof2"
set med-tlvs inventory-management network-policy
unset 802.1-tlvs
unset 802.3-tlvs
set auto-isl disable
config med-network-policy
edit "voice"
set status enable
set vlan-intf "voice"
set assign-vlan enable
set priority 0
set dscp 46
next
edit "voice-signaling"
set status disable
next
edit "guest-voice"
set status disable
next
edit "guest-voice-signaling"
set status disable
next
edit "softphone-voice"
set status disable
next
edit "video-conferencing"
set status disable
next
edit "streaming-video"
set status disable
next
edit "video-signaling"
set status disable
next
end
next
end

[ebilcari]

FNAC will not do any changes related to LLDP configuration or communication between the SW and the IP Phone. But if you are referring with 'Security Policy' to apply authentication via RADIUS on the switch port, than if the IP Phone is not authenticated there is no allowed traffic.

Make sure that the IP Phone is able to authenticate via MAB and FNAC has registered the IP Phone, some details may be found in the integration guide.

You can check the authentication status in the port by using this command:

# diagnose switch-controller switch-info 802.1X S10... port4

     Port State: authorized (  )

Technically by having an authorized state in the port should allow the LLDP to negotiate and add the Voice VLAN in the allowed VLAN list but if required RADIUS attributes can also be used. Some details can be found in these articles here and here .