FortiSwitch network access control

You can configure a FortiSwitch network access control (NAC) policy within FortiOS that matches devices with the specified criteria, devices belonging to a specified user group, or devices with a specified FortiClient EMS tag. Devices that match are assigned to a specific VLAN or have port-specific settings applied to them.

NOTE: The FortiSwitch NAC settings must be configured before defining a NAC policy. See Configuring the FortiSwitch NAC settings.

Summary of the procedure

1. Define a FortiSwitch NAC VLAN. See Defining a FortiSwitch NAC VLAN.
2. Configure the FortiSwitch NAC settings. See Configuring the FortiSwitch NAC settings.
3. Create a FortiSwitch NAC policy. See Defining a FortiSwitch NAC policy.
4. View the devices that match the NAC policy. See Viewing the devices that match the NAC policy.

Defining a FortiSwitch NAC VLAN

When devices are matched by a NAC policy, you can assign those devices to a FortiSwitch NAC VLAN. By default, there are six VLAN templates:

• default—This VLAN is assigned to all switch ports when the FortiSwitch unit is first discovered.
• quarantine—This VLAN contains quarantined traffic.
• rspan—This VLAN contains RSPAN and ERSPAN mirrored traffic.
• voice—This VLAN is dedicated for voice devices.
• video—This VLAN is dedicated for video devices.
• onboarding—This VLAN is for NAC onboarding devices.

You can use the default onboarding VLAN, edit it, or create a new NAC VLAN. If you want to use the default onboarding NAC VLAN, specify it when you configure the FortiSwitch NAC settings. If you want to edit the default onboarding VLAN or create a new NAC VLAN, use the following procedures.

Creating a NAC VLAN

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch VLANs, select Create New, and change the following settings:

   Interface Name	VLAN name
   VLAN ID	Enter a number (1-4094)
   Color	Choose a unique color for each VLAN, for ease of visual display.
   Role	Select LAN, WAN, DMZ, or Undefined.

2. Enable DHCP for IPv4 or IPv6.
3. Set the Admission access options as required.
4. Select OK.

Using the CLI:

config system interface

edit <VLAN_name>

set vlanid <1-4094>

set color <1-32>

set interface <FortiLink-enabled interface>

end

Editing a NAC VLAN

You can edit the default onboarding NAC VLAN.

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch VLANs.
2. Select the onboarding NAC VLAN.
3. Select Edit.
4. Make your changes.
5. Select OK to save your changes.

Using the CLI:

config switch-controller initial-config template

edit onboarding

set vlanid <1-4094>

set allowaccess {ping | https | ssh | snmp | http | telnet | fgfm | radius-acct | probe-response | fabric | ftm}

set auto-ip {enable | disable}

set dhcp-server {enable | disable}

end

Configuring the FortiSwitch NAC settings

NOTE: The FortiSwitch NAC settings must be configured before defining a NAC policy.

The local mode uses the local port-level settings of managed FortiSwitch units. The global mode applies the NAC to all managed FortiSwitch ports. Be default, the mode is local.

You can set how many minutes that NAC devices are allowed to be inactive. By default, NAC devices can be inactive for 15 minutes. The range of values is 0 to 1 440 minutes. If you set the inactive-timer to 0, there is no limit to how long the NAC devices can be inactive for.

When NAC devices are discovered, they are assigned to the NAC onboarding VLAN. You can specify the default onboarding VLAN or specify another existing VLAN. By default, there is no NAC onboarding VLAN assigned.

When NAC devices are discovered and match a NAC policy, they are automatically authorized by default.

When NAC mode is configured on a port, the link of a switch port goes down and then up by default, which restarts the DHCP process for that device.

When a link goes down, the NAC devices are cleared from all switch ports by default.

Starting in FortiOS 7.0.0, you can use the set nac-periodic-interval command to specify how often the NAC engine runs in case any events are missed. The range is 5 to 60 seconds, and the default setting is 15 seconds.

Configuring NAC on a global level

config switch-controller fortilink-settings

edit <name_of_this_FortiLink_configuration>

set inactive-timer <integer>

set link-down-flush {enable | disable}

config nac-ports

set onboarding-vlan <string>

set bounce-nac-port {enable | disable}

end

next

end

config switch-controller system

set nac-periodic-interval <5-60 seconds>

end

Configuring NAC on a local level

Using the CLI:

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

config ports

edit <port_name>

set access-mode nac

next

end

next

end

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch Ports.
2. Right-click a port.
3. Select Mode > NAC.

Synchronizing MAC events

config switch interface

edit <FortiSwitch_interface>

set nac enable

end

For example

config switch interface

edit port20

set nac enable

end

Defining a FortiSwitch NAC policy

In the FortiOS GUI, you can create three types of NAC policies:

• Device—The NAC policy matches devices with the specified MAC address, hardware vendor, device family, type, operating system, and user. Visit https://filestore.fortinet.com/product-downloads/fortilink/HTFO_list.json to see a list of values for hardware vendor, type, device family, and operating system.
• User—The NAC policy matches devices belonging to the specified user group.
• EMS tag—The NAC policy matches devices with the specified FortiClient EMS tag.

Using the CLI, you can specify a MAC policy to be applied to devices that have been matched by the NAC policy. See Creating a MAC policy.

NOTE: The FortiSwitch NAC settings must be configured before defining a FortiSwitch NAC policy. See Configuring the FortiSwitch NAC settings.

Creating a device policy

A device policy matches devices with the specified criteria and then assigns a specific VLAN to those devices or applies port-level settings to those devices. You can specify the MAC address, hardware vendor, device family, type, operating system, and user for the devices to match.

By default, there is a default device policy, Onboarding VLAN, which uses the default onboarding NAC VLAN. You can use the default Onboarding VLAN policy, edit it, or create a new NAC policy.

To identify devices to add to a device policy, try the following: Use the diagnose user device list command to see devices connected to your FortiGate device. Use the FortiGuard Device Detection service (https://www.fortiguard.com/learnmore#dds) to provide information about an IoT device based on its MAC address.

Using the GUI:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Click Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Click Specify to select which FortiSwitch units to apply the NAC policy to or click All.
6. Select Device for the category.
7. If you want the device to match a MAC address, move the MAC Address slider and enter the MAC address to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the MAC address (for example, xx:xx:xx:**:**:**).
8. If you want the device to match a hardware vendor, move the Hardware Vendor slider and enter the name of the hardware vendor to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the hardware vendor.
9. If you want the device to match a device family, move the Device Family slider and enter the name of the device family to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the device family.
10. If you want the device to match a device type, move the Type slider and enter the device type to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the device type.
11. If you want the device to match an operating system, move the Operating System slider and enter the operating system to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the operating system.
12. If you want the device to match a user, move the User slider and enter the user name to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the user name.
13. If you want to assign a specific VLAN to the device that matches the specified criteria, select Assign VLAN and enter the VLAN identifier.
14. Select OK to create the new NAC policy.

Using the CLI:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category device

set status enable

set mac <MAC_address>

set hw-vendor <hardware_vendor>

set type <device_type>

set family <device_family>

set os <operating_system>

set hw-version <hardware_version>

set sw-version <software_version>

set host <host_name>

set user <user_name>.

set src <source>

set switch-fortilink <FortiLink_interface>

set switch-scope <list_of_managed_FortiSwitch_serial_numbers>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

end

Creating a user policy

A user policy matches devices that are assigned to the specified user group and then assigns a specific VLAN to those devices or applies port-level settings to those devices.

Using the GUI:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Select Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Select which FortiSwitch units to apply the NAC policy to or select All.
6. Select User for the category.
7. Select which user group that devices must belong to.
8. If you want to assign a specific VLAN to a device assigned to the specified user group, select Assign VLAN and enter the VLAN identifier.
9. Select OK to create the new NAC policy.

Using the CLI:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category firewall-user user

set status enable

set user-group <name_of_user_group>

set switch-fortilink <FortiLink_interface>

set switch-scope <list_of_managed_FortiSwitch_serial_numbers>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

end

Creating an EMS-tag policy

An EMS-tag policy matches devices with a specified MAC address and then assigns a specific VLAN to those devices or applies port-level settings to those devices. The MAC address is derived from an Endpoint Management Server (EMS) tag created in FortiClient.

NOTE: The FortiClient EMS server must be 6.4.1 build 1442 or higher. FortiOS must be 6.4.2 build 1709 or higher.

Before creating an EMS-tag policy on a managed FortiSwitch unit:

1. In FortiClient EMS, group FortiClient Fabric Agent endpoints with an EMS tag.
2. In FortiClient EMS, share these endpoint groups with a FortiGate unit over the EMS connector.
3. In FortiOS, add an on-premise FortiClient EMS server to the Security Fabric:

   config endpoint-control fctems

   edit <ems_name>

   set server <ip_address>

   set certificate <string>

   next

   end

   For example:

   config endpoint-control fctems

   edit EMS_Server

   set server 1.2.3.4

   set certificate REMOTE_Cert_1

   next

   end

4. In FortiOS, verify the EMS certificate. For example:

   execute fctems verify EMS_Server

5. In FortiOS, check that the FortiGate unit and FortiClient are connected:

   diagnose user device get <FortiClient_MAC_address>

6. In FortiOS, verify which MAC addresses the dynamic firewall address resolves to:

   diagnose firewall dynamic list

Using the GUI to create an EMS-tag policy:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Select Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Select which FortiSwitch units to apply the NAC policy to or select All.
6. Select EMS Tag for the category.
7. Select which FortiClient EMS tag that devices must be assigned.
8. If you want to assign a specific VLAN to a device assigned to the specified EMS tag, select Assign VLAN and enter the VLAN identifier.
9. Select OK to create the new NAC policy.

Using the CLI to create an EMS-tag policy:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category ems-tag

set ems-tag <string>

set status enable

set switch-fortilink <FortiLink_interface>

set switch-scope <list_of_managed_FortiSwitch_serial_numbers>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

next

end

For example:

config user nac-policy

edit nac_policy_1

set category ems-tag

set ems-tag MAC_FCTEMS0000108427_Low

set switch-fortilink fortilink1

next

end

Creating a MAC policy

You can apply a MAC policy to the devices that were matched by the NAC policy. You can specify which VLAN is applied, select which traffic policy is used, and enable or disable packet count.

config switch-controller mac-policy

edit <MAC_policy_name>

set description <policy_description>

set fortilink <FortiLink_interface>

set vlan <VLAN_name>

set traffic-policy <traffic_policy_name>

set count {enable | disable}

next

end

Viewing the devices that match the NAC policy

Using the GUI:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Click View Matched Devices.
3. Click Refresh to update the results.

When a NAC device is matched to a NAC policy and assigned to a VLAN, an event log is created.

Using the CLI:

To show known NAC devices with a known location that match a NAC policy:

diagnose switch-controller mac-device nac known

To show pending NAC devices with an unknown location that match a NAC policy:

diagnose switch-controller mac-device nac onboarding

To view the NAC clients:

diagnose switch-controller mac-device cache

To display the NAC cache of MAC addresses on the FortiSwitch unit:

execute switch-controller get-nac-mac-cache

Using the FortiSwitch NAC VLAN widget

The widget shows a pie chart of the assigned FortiSwitch NAC VLANs. When expanded to the full screen, the widget shows a full list of devices grouped by VLAN, NAC policy, or last seen.

The widget is added to the Users & Devices dashboard after a dashboard reset or can be manually added to a dashboard. It can also be accessed by going to WiFi & Switch Controller > NAC Policies and clicking View Matched Devices.

The expanded view of the widget shows Assigned VLAN and Last Seen pie charts and a full device list. The list can be organized By VLAN, By NAC Policy, or By Policy Type.

Click View NAC Policies to go to WiFi & Switch Controller > NAC Policies.