The FortiGate NAC engine is responsible for assigning the device to the right VLAN based on the NAC policy when a device first connects to a switch port or when a device goes from offline to online. This process has been optimized to shorten the amount of time it takes for a new device to be recognized and assigned to the VLAN.
These optimizations include:
A new event-based approach.
A new NAC MAC cache table that populates MAC addresses from the FortiSwitch unit immediately after an event.
NAC inactive timers are now applied to the
nac-periodic-intervalto run the NAC engine at intervals in case any events are missed. The range is 5 to 60 seconds, and the default setting is 15 seconds.
Before these optimizations, the process took approximately 65 seconds from the time the device links to a switch port to matching the device to a NAC policy. After optimization, the process takes a maximum of 16 seconds with a minimum
nac-periodic-interval of 5 seconds.
In the following example, you configure the NAC engine to run every five seconds.
config switch-controller system set nac-periodic-interval 5 end
# diagnose switch-controller nac-mac-cache show VFID SWITCH MAC-ADDRESS VLAN CREATION(secs ago) LAST-SEEN(secs ago) INTERFACE 1 S524DN4K16000116 00:0c:29:a8:0a:1c 4089 24 0 port7 1 S248EPTF18001384 00:0c:29:d4:4f:3c 4089 44 0 port6