Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • FortiNAC Manager

    Home FortiNAC 9.4.0 FortiNAC Manager
    9.4.0
    9.4.0
    9.2.0
    9.1.0

    Mobile Agent

    Mobile Agent

    Mobile Agent is an application that works on Android devices to identify them to FortiNAC Manager, assist with authentication and provide an inventory of installed Apps. The Mobile Agent can scan the device for indicators of rooting. Rooting is a process allowing users of devices running the Android operating system to attain privileged control (known as "root access") within Android's subsystem.

    FortiNAC Manager will only require or respond to a Mobile Agent if the Policy that applies to the host includes settings requiring the Mobile Agent. If for any reason a mobile device had a Mobile Agent installed, the user would not be able to register the device unless the policy assigned included the Mobile Agent. If the policy assigned is set to None-Deny, the mobile device is not allowed to register. If the policy is set to None-Bypass, the mobile device can be registered but not using the installed Mobile Agent.

    The Mobile Agent does work within the context of FortiNAC Manager's VPN integration.

    Setup Requirements
    • Make sure the latest Agent package is installed on FortiNAC Manager.
    • Add SRV records to your production DNS server that allow the agent to locate the FortiNAC Manager Server or Application server to which it should connect.
    • The Mobile device must be running Android operating system 2.3.3 or higher.
    • Users can download the agent one of two ways:
      • If the Android device is configured to allow downloads from unknown sources, the Mobile Agent can be downloaded from the captive portal. For example, configure an Android phone by choosing Settings from a Home screen, then selecting Applications and enabling the Unknown Sources option.
      • If the Android device does not allow downloads from unknown sources, the Mobile Agent must be downloaded through Google Play.
    • FortiNAC Manager appliance must be configured with SSL and must have a valid third party SSL certificate from a CA. A self-signed certificate cannot be used. See Agent server communications.
    • Create an endpoint compliance policy for Android devices to control whether or not an agent is required and whether or not the device can register. See Endpoint compliance policies.

    • To prevent Rooted devices from registering, enable Root Detection in the Scans used for Mobile devices. See Add or modify a scan. When Root Detection is not enabled, the Mobile Agent still determines whether the device is rooted, but allows the device to register and appends (Rooted) to the operating system information displayed in the Host View.

      Note

      Root Detection happens only during registration. If a user registers a device and then later alters that device causing it to be Rooted, FortiNAC Manager is not notified. You may want to age these devices out of the database quickly so the user is forced to re-register periodically.

    • Enable the Potential Rooted Device event and alarm to be notified when the Mobile Agent determines that the devices may be rooted. The event message contains the username of the user and the MAC addresses of the device. See Enable and disable events.
    • Mobile device users are authenticated based on the settings for standard user login. Navigate to System > Portal Configuration > Content Editor. In the tree on the left select Global > Settings and verify that the Standard User Login Type is correct.
    • You can modify the default text shown in the captive portal as mobile device users connect to the network. Navigate to System > Portal Configuration > Content Editor. In the tree on the left scroll to the Registration > Mobile Agent Download section to review or modify the download page. In the tree on the left, scroll to the Agent > Mobile section to review or modify the Login page.
    Notes
    • If the Mobile device attempts to connect to the network but never reaches the agent download page and is never prompted for credentials, verify that the device is receiving an IP address within the Registration VLAN. Verify that the device is connected to the correct SSID.
    • If the user receives a message indicating that they do not have rights to access the network, verify that there is a Policy in place for mobile devices and that it is configured correctly.
    Previous
    Next

    Mobile Agent

    Mobile Agent

    Mobile Agent is an application that works on Android devices to identify them to FortiNAC Manager, assist with authentication and provide an inventory of installed Apps. The Mobile Agent can scan the device for indicators of rooting. Rooting is a process allowing users of devices running the Android operating system to attain privileged control (known as "root access") within Android's subsystem.

    FortiNAC Manager will only require or respond to a Mobile Agent if the Policy that applies to the host includes settings requiring the Mobile Agent. If for any reason a mobile device had a Mobile Agent installed, the user would not be able to register the device unless the policy assigned included the Mobile Agent. If the policy assigned is set to None-Deny, the mobile device is not allowed to register. If the policy is set to None-Bypass, the mobile device can be registered but not using the installed Mobile Agent.

    The Mobile Agent does work within the context of FortiNAC Manager's VPN integration.

    Setup Requirements
    • Make sure the latest Agent package is installed on FortiNAC Manager.
    • Add SRV records to your production DNS server that allow the agent to locate the FortiNAC Manager Server or Application server to which it should connect.
    • The Mobile device must be running Android operating system 2.3.3 or higher.
    • Users can download the agent one of two ways:
      • If the Android device is configured to allow downloads from unknown sources, the Mobile Agent can be downloaded from the captive portal. For example, configure an Android phone by choosing Settings from a Home screen, then selecting Applications and enabling the Unknown Sources option.
      • If the Android device does not allow downloads from unknown sources, the Mobile Agent must be downloaded through Google Play.
    • FortiNAC Manager appliance must be configured with SSL and must have a valid third party SSL certificate from a CA. A self-signed certificate cannot be used. See Agent server communications.
    • Create an endpoint compliance policy for Android devices to control whether or not an agent is required and whether or not the device can register. See Endpoint compliance policies.

    • To prevent Rooted devices from registering, enable Root Detection in the Scans used for Mobile devices. See Add or modify a scan. When Root Detection is not enabled, the Mobile Agent still determines whether the device is rooted, but allows the device to register and appends (Rooted) to the operating system information displayed in the Host View.

      Note

      Root Detection happens only during registration. If a user registers a device and then later alters that device causing it to be Rooted, FortiNAC Manager is not notified. You may want to age these devices out of the database quickly so the user is forced to re-register periodically.

    • Enable the Potential Rooted Device event and alarm to be notified when the Mobile Agent determines that the devices may be rooted. The event message contains the username of the user and the MAC addresses of the device. See Enable and disable events.
    • Mobile device users are authenticated based on the settings for standard user login. Navigate to System > Portal Configuration > Content Editor. In the tree on the left select Global > Settings and verify that the Standard User Login Type is correct.
    • You can modify the default text shown in the captive portal as mobile device users connect to the network. Navigate to System > Portal Configuration > Content Editor. In the tree on the left scroll to the Registration > Mobile Agent Download section to review or modify the download page. In the tree on the left, scroll to the Agent > Mobile section to review or modify the Login page.
    Notes
    • If the Mobile device attempts to connect to the network but never reaches the agent download page and is never prompted for credentials, verify that the device is receiving an IP address within the Registration VLAN. Verify that the device is connected to the correct SSID.
    • If the user receives a message indicating that they do not have rights to access the network, verify that there is a Policy in place for mobile devices and that it is configured correctly.
    Previous
    Next