Profiling IoT Devices

Device profiler is a mechanism that automatically categorizes and controls unknown or rogue devices that connect to your network and receive an IP address. Running continuously, this process scans the host database for rogues with IP addresses and assigns them a device type based on profiles or rules set up in FortiNAC. Device profile rules use information such as operating system and vendor OUI to determine what the connecting device might be. The Device Profiler is installed with some default rules which can be refined; new rules can be added as well. You can evaluate uncategorized rogues manually as new rules are added or existing rules are modified.

After a device has been categorized, the rule used to profile the device is associated with that device. If the device disconnects from the network and later reconnects, the device profiler confirms that the device still matches the rule. If the device does not match its associated rule, the device profiler can disable the device or notify the administrator by using events and alarms. Rule confirmation is an optional setting. This setting can be applied globally on the rule itself or individually on a profiled device.

FortiNAC supports up to 26 methods of device profiling; in this section, we will create the profile definitions for IOT Devices. The initial example profiles a FortiCamera using the active method based on NMAP scans. The same steps can be used to define profiling with other methods.

Profile IoT Devices

1. In the FortiNAC management interface, go to Users & Hosts and click on Device Profiling Rules. Click Add.

   

2. In the General tab, configure the following options:

   Check the Enabled checkbox Name: FortiCamera(nmap) Registration: Automatic Type: Camera Role: Click Add and use “IP_Camera” in the field and click OK. Register as: Device in Host View. Check Add to Group: Click Add and use the “IP_Cameras” as group name.

3. Click on the Methods tab and check the Active checkbox:

   Mark the checkbox of the Match Custom option Add the Value of “FortiCamera” and click OK.

4. After clicking OK, the device profiling for FortiCameras is completed.

For reference, to configure profiling for other IoT Devices, the following shows configuration steps for creating profiling rules for a Lexmark Printer and HP Printer devices:

i – Lexmark Printer

ii – HP Printer