Fortinet Document Library

Version:


Table of Contents

New Features

7.0.0
Download PDF
Copy Link

FortiGate NAC engine optimization

The FortiGate NAC engine is responsible for assigning the device to the right VLAN based on the NAC policy when a device first connects to a switch port or when a device goes from offline to online. This process has been optimized to shorten the amount of time it takes for a new device to be recognized and assigned to the VLAN.

These optimizations include:

  • A new event-based approach.

  • A new NAC MAC cache table that populates MAC addresses from the FortiSwitch unit immediately after an event.

  • NAC inactive timers are now applied to the nac-mac-cache table.

  • Added nac-periodic-interval to run the NAC engine at intervals in case any events are missed. The range is 5 to 60 seconds, and the default setting is 15 seconds.

Before these optimizations, the process took approximately 65 seconds from the time the device links to a switch port to matching the device to a NAC policy. After optimization, the process takes a maximum of 16 seconds with a minimum nac-periodic-interval of 5 seconds.

Example

In the following example, you configure the NAC engine to run every five seconds.

To configure the NAC engine to run every five seconds:
config switch-controller system
    set nac-periodic-interval 5
end
To view the NAC clients:
# diagnose switch-controller nac-mac-cache show
VFID     SWITCH             MAC-ADDRESS        VLAN CREATION(secs ago)  LAST-SEEN(secs ago) INTERFACE
1        S524DN4K16000116   00:0c:29:a8:0a:1c 4089 24                 0                  port7
1        S248EPTF18001384   00:0c:29:d4:4f:3c 4089 44                 0                  port6

FortiGate NAC engine optimization

The FortiGate NAC engine is responsible for assigning the device to the right VLAN based on the NAC policy when a device first connects to a switch port or when a device goes from offline to online. This process has been optimized to shorten the amount of time it takes for a new device to be recognized and assigned to the VLAN.

These optimizations include:

  • A new event-based approach.

  • A new NAC MAC cache table that populates MAC addresses from the FortiSwitch unit immediately after an event.

  • NAC inactive timers are now applied to the nac-mac-cache table.

  • Added nac-periodic-interval to run the NAC engine at intervals in case any events are missed. The range is 5 to 60 seconds, and the default setting is 15 seconds.

Before these optimizations, the process took approximately 65 seconds from the time the device links to a switch port to matching the device to a NAC policy. After optimization, the process takes a maximum of 16 seconds with a minimum nac-periodic-interval of 5 seconds.

Example

In the following example, you configure the NAC engine to run every five seconds.

To configure the NAC engine to run every five seconds:
config switch-controller system
    set nac-periodic-interval 5
end
To view the NAC clients:
# diagnose switch-controller nac-mac-cache show
VFID     SWITCH             MAC-ADDRESS        VLAN CREATION(secs ago)  LAST-SEEN(secs ago) INTERFACE
1        S524DN4K16000116   00:0c:29:a8:0a:1c 4089 24                 0                  port7
1        S248EPTF18001384   00:0c:29:d4:4f:3c 4089 44                 0                  port6