how to push Dynamic access control lists via fortinac

[ganesh_karale]

Hi, We are using Fortigate, Fortiswitch and Fortinac.

They are using static ip configuration in their client system.

We wanted to push Dynamic access control lists via fortinac.

Can someone please guide in this case.

[Hatibi · Accepted solution]

Hello @ganesh,

you can use DACLs enabled on 802.1x ports in FSW to apply different configurations using Attributes set per logical network in FortiNAC.

Fortswitch configuration:

https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/922505/dynamic-access-cont...

You can use one of the following:

• Filter-Id += “<filter-name>”
• NAS-Filter-Rule (supports 80 characters)

NAS-Filter-Rule += “<deny | permit> in <ip | ip-protocol-value> from any to <any |     host | <ip-addr> | ipv4-addr/mask> [<tcp/udp-port | tcp/udp-port range>] [cnt]

You will create the Radius Server attribute in FNAC by following this guide:

https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/239599/attribute-groups

So once a host matches a policy with a Logical configuration you can add an Attribute group that sends "Filter-ID" with the Isolation or production ACL name or you can use "NAS-Filter-Rule" with the permitted criteria.

Regards