Appendix

Persistent Agent Server Discovery Process

The Persistent Agent communicates on the following ports:

• Agent 3.x and 4.x: TCP 4568 and UDP 4567

• Agent 5.x and later with NAC 8.1 and lower: TCP 4568 and UDP 4567

• Agent 5.x and later with NAC 8.2 and later: TCP 4568 only

• All versions: TCP 80 (required for upgrades)

Discovery using SRV lookups (steps 2, 7 & 8) can be disabled in agent versions 5.3 and greater.

The discovery process is as follows:

1. The Persistent Agent starts.

2. The agent checks DNS for SRV records of _bradfordagent._udp.example.com

   and _bradfordagent._tcp.example.com.

3. The agent looks at the host registry (Windows) or preferences (OS X), or .conf (Linux).

4. First it checks the entry for lastConnectedServer. If lastConnectedServer is set, it adds the server to the top of the list.**

5. Then it checks the entry for HomeServer. If HomeServer is set, it adds it to a list.

6. Then the agent checks the entry for AllowedServers. This entry contains a list of additional servers to which the agent can connect. It adds each of these servers to the list.

7. If SRV records are returned, the agent processes them in reverse priority order (highest value first). If homeServer is not already set, the name contained in the SRV response is written to the host registry HKLM\Software\Bradford Networks\Client Security Agent (Windows) or preferences (OS X, Linux).*

8. For each SRV record:

   1. If the name is not already in the list, and restrictRoaming is disabled, the agent adds the name to the top of the list and to the lastConnectedServer value.

   2. Otherwise, if the name is already in the list, the agent moves the name to the top of the list.

9. Now that the list of servers is complete, the agent tries to connect to each server over SSL/TLS until it successfully connects to one. Unless security is disabled on the agent, this is done over SSL/TLS (requires valid certificate installed for the Persistent Agent Certificate Target).

10. Once the agent has successfully connected to a server, that server will be set to the lastConnectedServer value, and moved to the top of the list.**

11. Once a server has been added to the lastConnectedServer, if restrictRoaming is enabled, it will remain at the top of the list until that server is no longer reachable by the agent. At that point the list will be parsed until the agent connects to a server and then that server will be moved to lastConnectedServer and to the top of the list.**

*Registry/preferences settings remain until one of the following occurs:

• Entry is manually changed.

• Agent is uninstalled.

• Agent is updated.

**Requires Agent Version 4.1.4 and higher.

Note: If the agent cannot be configured through Agent Configuration, the same SRV records may be added to the corporate production DNS servers. Agents can then query the DNS servers to determine the FortiNAC server with which they should communicate.