Configuring FortiNAC

A FortiNAC device can be added to the Security Fabric on the root FortiGate. After the device has been added and authorized, you can log in to the FortiNAC from the FortiGate topology views.

Adding a FortiNAC to the Security Fabric requires a FortiNAC with a license issued in the year 2020 or later that includes an additional certificate. The device cannot be added if it has an older license. Use the licensetool in the FortiNAC CLI to determine if your license includes the additional certificate.

The FortiNAC tags connector under Security Fabric > Fabric Connectors has been deprecated. It was replaced with a REST API (in FortiNAC and FortiOS) that is used by FortiNAC to send user logon and logoff information to the FortiGate. The FortiNAC tag dynamic firewall address type is used to store the device IP, FortiNAC firewall tags, and FortiNAC group information sent from FortiNAC by the REST API when user logon and logoff events are registered (see FortiNAC tag dynamic address for more information).

For upgrade support, the FSSO FortiNAC user type can still be configured in the CLI.

To add a FortiNAC to the Security Fabric:

1. On the FortNAC, configure telemetry and input the IP address of the root FortiGate. See Security Fabric Connection in the FortiNAC Administration Guide for more information.
2. On the root FortiGate, authorize the FortiNAC.
3. Verify the connection status in the topology views.

To authorize the FortiNAC on the root FortiGate in the GUI:

1. Go to Dashboard > Status and locate the Security Fabric widget.
2. Click the highlighted unauthorized FortiNAC.
3. Select Authorize.

   

   Optionally, you can also deny authorization to the FortiNAC to remove it from the list.

To authorize the FortiNAC on the root FortiGate in the CLI:

config system csf
    config trusted-list
        edit "FNVMCATM20000306"
            set action accept
        next
    end
end

To verify the connection status:

1. After the FortiNAC is authorized, go to Security Fabric > Physical Topology and confirm that it is included in the topology.

   

2. Go to Security Fabric > Logical Topology and confirm the FortiNAC is also displayed there.

   

3. Run the following command in the CLI to view information about the FortiNAC device's status:

   # diagnose sys csf downstream-devices fortinac 
   {
     "path":"FG5H1E5818900126:FNVMCATM20000306",
     "mgmt_ip_str":"10.1.100.197",
     "mgmt_port":0,
     "admin_port":8443,
     "serial":"FNVMCATM20000306",
     "host_name":"adnac",
     "device_type":"fortinac",
     "upstream_intf":"port2",
     "upstream_serial":"FG5H1E5818900126",
     "is_discovered":true,
     "ip_str":"10.1.100.197",
     "downstream_intf":"eth0",
     "authorizer":"FG5H1E5818900126",
     "idx":1
   }

To log in to the FortiNAC from the FortiGate:

1. On the FortiGate, go to Security Fabric > Physical Topology or Security Fabric > Logical Topology.
2. Click on the FortiNAC and select Login to <serial_number>.

   

   A new tab will open to the FortiNAC log in page.

3. Enter the username and password to log in to the FortiNAC.