Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ganesh_karale
New Contributor III

how to push Dynamic access control lists via fortinac

Hi, We are using Fortigate, Fortiswitch and Fortinac.

They are using static ip configuration in their client system.

We wanted to push Dynamic access control lists via fortinac.

Can someone please guide in this case.

1 Solution
Sx11
Staff
Staff

Hello @ganesh,

 

you can use DACLs enabled on 802.1x ports in FSW to apply different configurations using Attributes set per logical network in FortiNAC.

 

Fortswitch configuration:

https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/922505/dynamic-access-cont...

 

You can use one of the following:

  • Filter-Id += “<filter-name>”
  • NAS-Filter-Rule (supports 80 characters)

NAS-Filter-Rule += “<deny | permit> in <ip | ip-protocol-value> from any to <any |     host | <ip-addr> | ipv4-addr/mask> [<tcp/udp-port | tcp/udp-port range>] [cnt]

 

You will create the Radius Server attribute in FNAC by following this guide:

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/239599/attribute-groups

 

So once a host matches a policy with a Logical configuration you can add an Attribute group that sends "Filter-ID" with the Isolation or production ACL name or you can use "NAS-Filter-Rule" with the permitted criteria.

 

Regards

sx11

View solution in original post

1 REPLY 1
Sx11
Staff
Staff

Hello @ganesh,

 

you can use DACLs enabled on 802.1x ports in FSW to apply different configurations using Attributes set per logical network in FortiNAC.

 

Fortswitch configuration:

https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/922505/dynamic-access-cont...

 

You can use one of the following:

  • Filter-Id += “<filter-name>”
  • NAS-Filter-Rule (supports 80 characters)

NAS-Filter-Rule += “<deny | permit> in <ip | ip-protocol-value> from any to <any |     host | <ip-addr> | ipv4-addr/mask> [<tcp/udp-port | tcp/udp-port range>] [cnt]

 

You will create the Radius Server attribute in FNAC by following this guide:

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/239599/attribute-groups

 

So once a host matches a policy with a Logical configuration you can add an Attribute group that sends "Filter-ID" with the Isolation or production ACL name or you can use "NAS-Filter-Rule" with the permitted criteria.

 

Regards

sx11
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors