Administration Guide

What's new in FortiNAC 9.1
FortiNAC
- Introduction
- DNS configuration
- IPv6 support
- Login procedure
- Connection errors
- Internet access
- Licenses
- Navigation
- Menus
- Passwords
- Time stamps and time zones
- Icons
- Certificates
- Manage hosts and ports
- Locate
- Guest accounts
- Send messages to hosts
Dashboard
- Adding panels
- Alarms
- Host Summary
- User Summary
- Network Device Summary
- License Information
- Performance
- Persistent Agent Summary
- Security Summary
- Scans
- Summary
Settings
- Control
- Identification
- Network device
- Persistent Agent settings
- Security
  - Portal SSL
  - Certificate management
- System communication
- System management
- Updates
- User/host management
Authentication
- Automatic authentication
- Google authentication
- Directories
- RADIUS
- Local RADIUS Server
  - Configure Local RADIUS Server settings
  - RADIUS Attribute Groups
- Roaming guests
Portal configuration
- Registration Approval (Version 8.8.2 and above)
- Splash page
- Portal content editor
- Multiple portals
- Configure authentication credentials
- Portal configuration - version 1 settings
- Content fields
- Social Media for Captive Portal
- Request Processing Rules
Device profiler
- Process
- Implementation
- Rules
- Profiles for device managers
- Add an administrator
- Events and alarms
- Profiled devices
Monitor devices
- View and register known devices
- Learning about hosts on the network
- Isolate unknown devices
- Control access based on device types
- View logs and reports
- FortiGate sessions
Policies
- Policy assignment
- Policy details
- Policy simulator
- User/host profiles
- Portal policies
- Authentication policies
- Authentication configurations
  - Add or modify a policy
  - Delete a configuration
- Network access policies
- Network access configurations
- Endpoint compliance policies
- Endpoint compliance configurations
- Supplicant EasyConnect policies
- Supplicant configurations
- Remediation configurations
Scans
- Scan on connect
- Scan hosts without enforcing remediation
- Delayed remediation
- Add or modify a scan
- Delete a scan
- Scans in use
- Schedule a scan
- Custom scans
  - Create a scan
  - Scan categories
  - Windows
  - macOS
  - Linux
  - Severity level
  - Use case
- Scan parameters
Endpoint compliance
- Implementation
- Agent overview
- Dissolvable Agent
- Passive Agent
- Persistent Agent
- Mobile Agent
- Agent server communications
- Auto-definition updates
Role management
- Configuration
- Assigning roles
- Roles view
- Network device roles
  - Add role mappings
  - Modify or delete role mapping
Guest manager
- Implementation
- Guest/contractor templates
- Administrator profile
- Administrators
- Portal page setup
- Printer settings for guest badges
- Events and alarms
- Sponsors
- Guest/contractor login
- Using a kiosk
- Guest self registration
Automated Threat Response (ATR)
- Implementation
- Security rules
  - Add or modify a rule
  - Delete a rule
- Triggers
- Security actions
- Security alarms
- Security events
- Vendor severity levels
User View
- Configure table columns and tooltips
- Search settings
- User drill-down
- User properties
- Add or modify a user
- Delete a user
- Add users to groups
- Group membership
- Guest account details
- Set user expiration date
Administrator profiles
- Default administrator profiles
- Permissions list
- Add an administrator profile
- Modify administrator profiles
- Delete an administrator profile
- Copy an administrator profile
- Administrator profile mappings
Administrators
- Add an administrator
- Modify an administrator
- Delete an administrator
- Copy an administrator
- Modify an administrator profile
- Limit access with groups
- Set privileges based on directory groups
- Add administrators to groups
- Group membership
- Configure secure mode
Import and export data
- Import archived data
- Import hosts, users or devices
- Import an administrator
- Import IP ranges
- CLI import tool
  - Create .csv files for device import
  - Import devices with the CLI tool
- Import port descriptions
- Export data
Inventory
- Inventory tree contact status
- Network summary
- Customer icon
  - Configure container for devices
  - Rename the customer icon
- Container icon
- Device view
- Device configuration
- Ports view
- SSID view
  - SSID configuration
  - Modify multiple SSIDs
- Logical networks
Hosts, adapters, and applications
- USB/Thunderbolt external Ethernet adapters
- Host View
- Adapter View
- Aging out host or user records
- Application view
Device identity
Containers
- Configure container for devices
Network devices
- Network device groups
Groups view
- Add groups
- Copy a group
- Delete a group
- Limit user access with groups
- Modify a group
- Group membership
- Show group members
- Group in use
- Aging hosts in a group
- System groups
- Customer defined groups
Audit Logs
- Configuration
- Accessing the auditing log
Scheduler
- Add a task
- Add other scheduled tasks
- Copy a task
- Delete a task
- Modify a task
- Run task now
Event management
- Enable and disable events
- Event thresholds
- Log events to an external log host
- Examples of syslog messages
- View events currently mapped to alarms
Events
- Event notes
- Events and alarms list
Alarms
- Show or hide alarm details
- Map events to alarms
- Add or modify alarm mapping
- Bulk modify alarm mappings
- Delete alarm mapping
Reports
- Standard report templates
- Custom reports
- Schedule reports
- Archived reports
Scan results view
- Show details
- Archive and clear all scans
- Archive and clear selected scans
Connections
CLI configuration
- Configuration in use
- Show configuration
- Port based and host based configurations
- Add or modify a configuration
- Sample configurations
- Implement configurations
- Port changes view
- Requirements for ACL based configurations
High availability
- Server communication
- Using a shared IP address (Layer 2)
- Servers on different subnets (Layer 3)
- Connectivity configuration
- Primary and secondary configuration
- Update software
- High availability concepts
- Troubleshooting tips
Receive data from external devices
Send SMS messages
Wireless security
- Auto-configured data
- SSID mappings
- Secure SSID for guest management
- Open SSID for guest management
- Secure SSID for device onboarding
- Open SSID for device onboarding

Home FortiNAC 9.1.0 Administration Guide

9.1.0

Server communication

Shared IP - same subnet

In a FortiNAC Control Server and FortiNAC Application Server configuration that uses a shared IP, the FortiNAC Application Server appliances are separate standbys from the FortiNAC Control Server appliances.

Examples:

If the primary FortiNAC Control Server fails, the secondary FortiNAC Control Server communicates with whichever FortiNAC Application Server is in control (either the primary or the secondary).
If the primary FortiNAC Application Server fails, the primary FortiNAC Control Server communicates whichever FortiNAC Application Server is in control.

No shared IP - different subnets

In a FortiNAC Control Server and FortiNAC Application Serverconfiguration that does not use a shared IP, the FortiNAC Application Server and FortiNAC Control Server appliances failover in pairs.

Examples:

If the primary FortiNAC Control Server fails the primary FortiNAC Application Server is also brought down and the secondary pair of appliances take control.
If the primary FortiNAC Application Server fails, the primary FortiNAC Control Server is also brought down and the secondary pair of appliances take control.

Server communication

Shared IP - same subnet

Examples:

If the primary FortiNAC Control Server fails, the secondary FortiNAC Control Server communicates with whichever FortiNAC Application Server is in control (either the primary or the secondary).
If the primary FortiNAC Application Server fails, the primary FortiNAC Control Server communicates whichever FortiNAC Application Server is in control.

No shared IP - different subnets

In a FortiNAC Control Server and FortiNAC Application Serverconfiguration that does not use a shared IP, the FortiNAC Application Server and FortiNAC Control Server appliances failover in pairs.

Examples:

If the primary FortiNAC Control Server fails the primary FortiNAC Application Server is also brought down and the secondary pair of appliances take control.
If the primary FortiNAC Application Server fails, the primary FortiNAC Control Server is also brought down and the secondary pair of appliances take control.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

Server communication

Server communication

Shared IP - same subnet

Examples:

No shared IP - different subnets

Examples:

Server communication

Server communication

Shared IP - same subnet

Examples:

No shared IP - different subnets

Examples: