Addresses
-
Click System > Settings.
-
Expand the System Communication folder.
-
Select Addresses from the tree.
Introduced in version 9.2, address objects and address group objects are used in the following firewall integrations:
-
FortiGate (SSO or VPN)
These objects are used to determine which firewall should receive SSO messages for hosts connecting to the network. Group objects allow for control over the network ranges and scopes used to filter SSO messages to each firewall.
Address objects can be created by subnet or by IP Range, then combined into address groups. The address groups can then be used within the Model Configuration view of the applicable device to define the scope to be managed. Groups are selected within the model using the SSO Addresses and VPN Addresses drop-down menus. See Model configuration.
Object Auto-Population
By default, the Addresses tables are empty. It is up to the administrator to define the IP address scopes desired for SSO functionality.
Address and group objects will only auto-populate if SSO was configured prior to upgrading to version 9.2 or greater. This is to ensure previous SSO functionality is maintained:
-
Prior to version 9.2, FortiNAC created internal address lists for SSO functionality. The objects are created using the same rules upon upgrade.
-
These rules include reading the FortiGate interface IP scopes and VPN configurations to determine what addresses need to be created.
-
All changes to the objects after they are created must be made manually.
-
Changes take effect during the next endpoint evaluation. This occurs after the L2 poll of the device to which the affected endpoints are connected.
Add or Modify Address Object
Configure using the table below then click OK.
|
Field |
Description |
|---|---|
|
Name |
Name of Address object |
|
Message Type |
Subnet or IP Range |
|
IP/Netmask |
Displays when Message Type Subnet is selected. Enter desired subnet and mask. Required Format: <IP address>/xx (CIDR) Example: 10.25.24.1/24 |
|
IP Range |
Displays when Message Type IP Range is selected.
Enter IP range <Starting IP address> – <Ending IP address>
Example: 10.25.24.1 – 10.25.24.30 |
Add or Modify Address Group
Configure using the table below then click OK.
| Field | Description |
|---|---|
| Name | Name of Address Group |
| Members | Select the drill down menu for existing Address objects or select  to create a new address object. Multiple objects can be selected. |
Identify the Address Group Using a Specific Address Object
Select the Address Object then select In Use above the Address table.
Example Result:
Address In Use
The Address 'FGT-IT:root:VLAN-BYOD' is in use by the following:
- Network Address Groups
- SSOGRP:FGT-IT:root
Identify the Device Model or VDOM Using a Specific Address Group
Select the Address Object then select In Use above the Address table.
Sending Tags for Non-local FortiGate Connections
By default, FortiNAC does not send tags to subnets that do not terminate at that FortiGate.
Example:
-
Address group: 192.168.10.x
-
Endpoint with IP address 192.168.10.85 connecting to a switch downstream of the FortiGate.
-
Endpoint with IP address 192.168.10.90 connecting to a port on the FortiGate.
-
Both endpoints send their traffic through the same FortiGate.
Result: FortiNAC will send a tag to the FortiGate for 192.168.10.90 but not 192.168.10.85.
To allow FortiNAC to send tags for endpoints not directly connected to the FortiGate, a CLI change is required. Use the global option tool to expand the scope.
-
Login to the FortiNAC CLI as root.
-
Type
globaloptiontool -name sso.expand.scope -set true
logout
-
In the FortiNAC UI, navigate to Network > Inventory.
-
Right-click on the FortiGate Device Model and select Resync Interfaces.