Connection Process

Network Connect

1. FortiNAC detects a device has connected

2. The device is evaluated against the existing Network Access Policies in FortiNAC.

3. SSO Logon message is sent to FortiGate containing the following information:

• IP Address

• User ID – (logged on user, owner, or MAC address if userID is unknown)

• Group: Group name or Firewall Tag name (determined by the matching Network Access Policy)

4. Based upon the received information, FortiGate applies the appropriate IPv4 Policy to the device.

Change

1. FortiNAC detects one of the following has changed:

• Device status (e.g. Registered, Authenticated, Unauthenticated, At-Risk, Safe, - Disabled or Rogue)

• Ownership (“Registered to”)

• User logon or logoff

• IP Address

  Note: FortiNAC performs L2 Polls regularly and makes corrections as required. This includes changing the network access if the applied Network Access Policy no longer matches.

2. The device is re-evaluated against the existing Network Access Policies in FortiNAC.

3. If the matching policy has changed, SSO message is sent to FortiGate containing the IP Address, User ID and updated Group

4. Based upon the received information, FortiGate applies the appropriate IPv4 Policy to the device.

Network Disconnect

1. FortiNAC detects the device has disconnected

2. SSO Logon message is sent to FortiGate containing the IP Address, User ID and Group

3. FortiGate removes the group or firewall tag association and IPv4 Policy.