How it Works
Visibility
FortiNAC learns where endpoints are connected on the network using the following methods:
-
RADIUS communication
-
Device Detection SNMP traps
-
L2 Polling (MAC address table read)
-
L3 Polling (ARP cache read)
Control FortiWiFi Connections: FortiNAC provisions a wireless device’s network access by assigning VLANs during RADIUS authentication. In addition, firewall policies can be applied to the connected device’s session.
Control Wired Interfaces: FortiNAC provisions a wired device’s network access by applying a firewall policy to the connected device’s session. VLANs are not assigned.
FortiGates/FortiSwitches managed by FortiManager: When FortiNAC makes any changes to the FortiGate or FortiSwitch, the Fortigate/FortiSwitch updates FortiManager. This keeps FortiManager in sync.
Device Support Methods - FortiWiFi
|
Device Support Method |
Protocol |
|
Network Device Management/Device Discovery |
SNMP (UDP 161) SSH (TCP 22) |
|
Dynamic Connection Status |
RADIUS 802.1x or MAC-auth (UDP 1812) RADIUS Accounting (UDP 1813) |
|
L2 Poll (Collect MAC Address information) |
SSH (TCP 22) REST API (TCP 443 or as defined on FortiGate) |
|
L3 Poll (Collect IP to MAC address information) |
SNMP (UDP 161) SSH (TCP 22) REST API (TCP 443 or as defined on FortiGate) |
|
Provision Network Access/VLAN Assignment |
VLANs: RADIUS 802.1x or MAC-auth (UDP 1812) Firewall policies:
|
|
De-auth |
RADIUS Disconnect (UDP 3799) RADIUS Change of Authentication (CoA) (UDP 3799) |
Device Support Methods – Wired Interfaces
|
Device Support Method |
Protocol |
|
Network Device Management/Device Discovery |
SNMP (UDP 161) SSH (TCP 22) |
|
Dynamic Connection Status |
RADIUS 802.1x or MAC-auth (UDP 1812) RADIUS Accounting (UDP 1813) Device Detection SNMP Trap |
|
L2 Poll (Collect MAC Address information) |
SSH (TCP 22) REST API (TCP 443 default) |
|
L3 Poll (Collect IP to MAC address information) |
SNMP (UDP 161) SSH (TCP 22) REST API (TCP 443 default) |
|
Provision Network Access/VLAN Assignment |
Firewall policies:
|