FortiSwitch network access control

You can configure a FortiSwitch network access control (NAC) policy within FortiOS that matches devices with the specified criteria, devices belonging to a specified user group, or devices with a specified FortiClient EMS tag. Devices that match are assigned to a specific VLAN or have port-specific settings applied to them.

NOTE: The FortiSwitch NAC settings must be configured before defining a NAC policy. See Configuring the FortiSwitch NAC settings.

Summary of the procedure

1. Define a FortiSwitch NAC VLAN. See Defining a FortiSwitch NAC VLAN.
2. Configure the FortiSwitch NAC settings. See Configuring the FortiSwitch NAC settings.
3. Create a FortiSwitch NAC policy. See Defining a FortiSwitch NAC policy.
4. View the devices that match the NAC policy. See Viewing the devices that match the NAC policy.

Defining a FortiSwitch NAC VLAN

When devices are matched by a NAC policy, you can assign those devices to a FortiSwitch NAC VLAN. By default, there are six VLAN templates:

• default—This VLAN is assigned to all switch ports when the FortiSwitch unit is first discovered.
• quarantine—This VLAN contains quarantined traffic.
• rspan—This VLAN contains RSPAN and ERSPAN mirrored traffic.
• voice—This VLAN is dedicated for voice devices.
• video—This VLAN is dedicated for video devices.
• onboarding—This VLAN is for NAC onboarding devices.

You can use the default onboarding VLAN, edit it, or create a new NAC VLAN. If you want to use the default onboarding NAC VLAN, specify it when you configure the FortiSwitch NAC settings. If you want to edit the default onboarding VLAN or create a new NAC VLAN, use the following procedures.

Creating a NAC VLAN

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch VLANs, select Create New, and change the following settings:

   Interface Name	VLAN name
   VLAN ID	Enter a number (1-4094)
   Color	Choose a unique color for each VLAN, for ease of visual display.
   Role	Select LAN, WAN, DMZ, or Undefined.

2. Enable DHCP for IPv4 or IPv6.
3. Set the Admission access options as required.
4. Select OK.

Using the CLI:

config system interface

edit <VLAN_name>

set vlanid <1-4094>

set color <1-32>

set interface <FortiLink-enabled interface>

end

Editing a NAC VLAN

You can edit the default onboarding NAC VLAN.

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch VLANs.
2. Select the onboarding NAC VLAN.
3. Select Edit.
4. Make your changes.
5. Select OK to save your changes.

Using the CLI:

config switch-controller initial-config template

edit onboarding

set vlanid <1-4094>

set allowaccess {ping | https | ssh | snmp | http | telnet | fgfm | radius-acct | probe-response | fabric | ftm}

set auto-ip {enable | disable}

set dhcp-server {enable | disable}

end

Configuring the FortiSwitch NAC settings

NOTE: The FortiSwitch NAC settings must be configured before defining a NAC policy.

The local mode uses the local port-level settings of managed FortiSwitch units. The global mode applies the NAC to all managed FortiSwitch ports. Be default, the mode is local.

You can set how many minutes that NAC devices are allowed to be inactive. By default, NAC devices can be inactive for 15 minutes. The range of values is 0 to 1 440 minutes. If you set the inactive-timer to 0, there is no limit to how long the NAC devices can be inactive for.

When NAC devices are discovered, they are assigned to the NAC onboarding VLAN. You can specify the default onboarding VLAN or specify another existing VLAN. By default, there is no NAC onboarding VLAN assigned.

When NAC devices are discovered and match a NAC policy, they are automatically authorized by default.

Starting in FortiOS 7.0.0, you can use the set nac-periodic-interval command to specify how often the NAC engine runs in case any events are missed. The range is 5 to 60 seconds, and the default setting is 15 seconds.

When NAC mode is configured on a port, the link of a switch port goes down and then up by default, which restarts the DHCP process for that device. When a link goes down, the NAC devices are cleared from the switch port that bounced. Bouncing the switch port and restarting DHCP changes the IP addresses of hosts and invalidates firewall sessions. Starting in FortiOS 7.0.1, you can avoid these problems by assigning each VLAN to a separate LAN segment.

LAN segments prevent the IP addresses of hosts from changing but still provide physical isolation. For example, the following figure shows how four LAN segments have been assigned to four separate VLANs:

The switch controls traffic between LAN segments. Enable Block Intra-VLAN Traffic in the GUI or use the set switch-controller-access-vlan command to allow or prevent traffic between hosts in a LAN segment.

An RSPAN VLAN interface cannot be a member of a LAN segment group. IGMP snooping is not supported with LAN segments.

LAN segments require the following:

• FortiGate devices running FortiOS 7.0.1 or higher with managed FortiSwitch units running FortiSwitchOS 7.0.1 or higher.
• To see which FortiSwitch models support this feature, refer to the FortiSwitch feature matrix.

To use LAN segments:

• Configure FortiSwitch VLANs without layer-3 properties (unset the IP address, set the access mode to static, unset allowaccess, and disable the DHCP server).
• Optionally, enable Block Intra-VLAN Traffic.
• Enable LAN segments.
• Specify the NAC LAN interface.
• Specify which VLANs belong to that LAN segment.

Do not make changes after assigning a VLAN to a LAN segment. Changing VLANs assigned to LAN segments might have unexpected results.

Configuring NAC on a global level

config switch-controller fortilink-settings

edit <name_of_FortiLink_interface>

set inactive-timer <integer>

set link-down-flush {enable | disable}

config nac-ports

set onboarding-vlan <string>

set bounce-nac-port {enable | disable}

set lan-segment {enabled | disabled}

set nac-lan-interfaces <string>

set nac-segment-vlans <VLAN_interface_name>

end

next

end

config switch-controller system

set nac-periodic-interval <5-60 seconds>

end

For example:

config switch-controller fortilink-settings

edit "fortilink"

config nac-ports

set onboarding-vlan "onboarding"

set lan-segment enabled

set nac-lan-interface "nac_segment"

set nac-segment-vlans "voice" "video"

end

next

end

config switch-controller system

set nac-periodic-interval <5-60 seconds>

end

Configuring NAC on a local level

Using the CLI:

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

config ports

edit <port_name>

set access-mode nac

next

end

next

end

Using the GUI:

1. Go to WiFi & Switch Controller > FortiSwitch Ports.
2. Right-click a port.
3. Select Mode > NAC.

Synchronizing MAC events

config switch interface

edit <FortiSwitch_interface>

set nac enable

end

For example

config switch interface

edit port20

set nac enable

end

Defining a FortiSwitch NAC policy

In the FortiOS GUI, you can create three types of NAC policies:

• Device—The NAC policy matches devices with the specified MAC address, hardware vendor, device family, type, operating system, and user. Visit https://filestore.fortinet.com/product-downloads/fortilink/HTFO_list.json to see a list of values for hardware vendor, type, device family, and operating system.
• User—The NAC policy matches devices belonging to the specified user group.
• EMS tag—The NAC policy matches devices with the specified FortiClient EMS tag.

Using the CLI, you can specify a MAC policy to be applied to devices that have been matched by the NAC policy. See Creating a MAC policy.

Starting in FortiOS 7.0.2, you can specify FortiSwitch groups in NAC policies instead of specifying individual managed FortiSwitch units when creating a NAC policy. In FortiOS 7.0.2, the set switch-scope command has been replaced with the set switch-group command. You can select more than one FortiSwitch group in the CLI and GUI, and the same FortiSwitch unit can be included in more than one FortiSwitch group. If no FortiSwitch group is specified in the set switch-group command, all FortiSwitch groups are used for the NAC policy.

When you upgrade to FortiOS 7.0.2, the individual FortiSwitch units selected for the NAC policy are assigned to a new FortiSwitch group, and the new FortiSwitch group replaces the individual FortiSwitch units in the NAC policy. If you downgrade from FortiOS 7.0.2, the individual FortiSwitch units in the FortiSwitch group are listed in the set switch-scope command in the NAC policy, and the set switch-group command is removed from the NAC policy.

NOTE: The FortiSwitch NAC settings must be configured before defining a FortiSwitch NAC policy. See Configuring the FortiSwitch NAC settings.

Creating a device policy

A device policy matches devices with the specified criteria and then assigns a specific VLAN to those devices or applies port-level settings to those devices. You can specify the MAC address, hardware vendor, device family, type, operating system, and user for the devices to match.

By default, there is a default device policy, Onboarding VLAN, which uses the default onboarding NAC VLAN. You can use the default Onboarding VLAN policy, edit it, or create a new NAC policy.

Starting in FortiOS 7.0.1, you can configure a dynamic firewall address for devices and use it in a NAC policy. When a device matches the NAC policy, the MAC address for that device is automatically assigned to the dynamic firewall address, which can be used in firewall policies to control traffic from/to these devices. Configuring a dynamic firewall address requires setting the address type to dynamic and the address subtype to swc-tag. Using the dynamic firewall address in a NAC policy requires specifying the conditions that a device must match and setting the firewall address to the name of the dynamic firewall address.

To identify devices to add to a device policy, try the following: Use the diagnose user device list command to see devices connected to your FortiGate device. Use the FortiGuard Device Detection service (https://www.fortiguard.com/learnmore#dds) to provide information about an IoT device based on its MAC address.

Using the GUI to configure a NAC policy and a dynamic firewall address:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Click Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Click Specify to select which FortiSwitch groups to apply the NAC policy to or click All.
6. Select Device for the category.
7. If you want the device to match a MAC address, enable MAC Address and enter the MAC address to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the MAC address (for example, xx:xx:xx:**:**:**).
8. If you want the device to match a hardware vendor, enable Hardware Vendor and enter the name of the hardware vendor to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the hardware vendor.
9. If you want the device to match a device family, enable Device Family and enter the name of the device family to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the device family.
10. If you want the device to match a device type, enable Type and enter the device type to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the device type.
11. If you want the device to match an operating system, enable Operating System and enter the operating system to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the operating system.
12. If you want the device to match a user, enable User and enter the user name to match. Starting in FortiOS 6.4.6, you can use the wildcard * character when entering the user name.
13. If you want to assign a specific VLAN to the device that matches the specified criteria, select Assign VLAN and enter the VLAN identifier.
14. If you do not want to bounce the switch port (administratively bringing the link down and then up) when NAC mode is configured, disable Bounce port.
15. To use a dynamic firewall address for matching a device, enable Assign device to dynamic address and, from the dropdown list, click Create.
    1. In the Name field, enter the name of the dynamic firewall address.
    2. To change the color, click Change and select the color used for the corresponding icon in the GUI.
    3. The address type is set to Dynamic by default and the subtype is set to Switch Controller NAC Policy Tag by default.
    4. For the interface, select the interface whose IP address is to be used.
    5. In the Comments field, enter a description of the dynamic firewall address.
    6. Click OK to save the dynamic firewall address.
16. Select OK to create the new NAC policy.

Using the CLI to configure a dynamic firewall address:

config firewall address

edit <name_of_dynamic_firewall_address>

set type dynamic

set sub-type swc-tag

next

end

For example:

config firewall address

edit "office_vm_device"

set type dynamic

set sub-type swc-tag

next

end

To view the dynamic MAC addresses attached to the firewall:

diagnose firewall dynamic list

Using the CLI to configure a NAC policy:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category device

set status enable

set mac <MAC_address>

set hw-vendor <hardware_vendor>

set type <device_type>

set family <device_family>

set os <operating_system>

set hw-version <hardware_version>

set sw-version <software_version>

set host <host_name>

set user <user_name>.

set src <source>

set switch-fortilink <FortiLink_interface>

set switch-group <list_of_FortiSwitch_groups>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

set firewall-address <name_of_dynamic_firewall_address>

end

For example:

config user nac-policy

edit "OFFICE_VM"

set hw-vendor "VMware"

set switch-fortilink "fortilink"

set switch-mac-policy "OFFICE_VM"

set firewall-address "office_vm_device"

next

end

Creating a user policy

A user policy matches devices that are assigned to the specified user group and then assigns a specific VLAN to those devices or applies port-level settings to those devices.

Using the GUI:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Select Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Click Specify to select which FortiSwitch groups to apply the NAC policy to or click All.
6. Select User for the category.
7. Select which user group that devices must belong to.
8. If you want to assign a specific VLAN to a device assigned to the specified user group, select Assign VLAN and enter the VLAN identifier.
9. Select OK to create the new NAC policy.

Using the CLI:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category firewall-user user

set status enable

set user-group <name_of_user_group>

set switch-fortilink <FortiLink_interface>

set switch-group <list_of_FortiSwitch_groups>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

end

Creating an EMS-tag policy

An EMS-tag policy matches devices with a specified MAC address and then assigns a specific VLAN to those devices or applies port-level settings to those devices. The MAC address is derived from an Endpoint Management Server (EMS) tag created in FortiClient.

NOTE: The FortiClient EMS server must be 6.4.1 build 1442 or higher. FortiOS must be 6.4.2 build 1709 or higher.

Before creating an EMS-tag policy on a managed FortiSwitch unit:

1. In FortiClient EMS, group FortiClient Fabric Agent endpoints with an EMS tag.
2. In FortiClient EMS, share these endpoint groups with a FortiGate unit over the EMS connector.
3. In FortiOS, add an on-premise FortiClient EMS server to the Security Fabric:

   config endpoint-control fctems

   edit <ems_name>

   set server <ip_address>

   set certificate <string>

   next

   end

   For example:

   config endpoint-control fctems

   edit EMS_Server

   set server 1.2.3.4

   set certificate REMOTE_Cert_1

   next

   end

4. In FortiOS, verify the EMS certificate. For example:

   execute fctems verify EMS_Server

5. In FortiOS, check that the FortiGate unit and FortiClient are connected:

   diagnose user device get <FortiClient_MAC_address>

6. In FortiOS, verify which MAC addresses the dynamic firewall address resolves to:

   diagnose firewall dynamic list

Using the GUI to create an EMS-tag policy:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Select Create New.
3. In the Name field, enter a name for the NAC policy.
4. Make certain that the status is set to Enabled.
5. Click Specify to select which FortiSwitch groups to apply the NAC policy to or click All.
6. Select EMS Tag for the category.
7. Select which FortiClient EMS tag that devices must be assigned.
8. If you want to assign a specific VLAN to a device assigned to the specified EMS tag, select Assign VLAN and enter the VLAN identifier.
9. Select OK to create the new NAC policy.

Using the CLI to create an EMS-tag policy:

config user nac-policy

edit <policy_name>

set description <description_of_policy>

set category ems-tag

set ems-tag <string>

set status enable

set switch-fortilink <FortiLink_interface>

set switch-group <list_of_FortiSwitch_groups>

set switch-auto-auth {enable | disable}

set switch-mac-policy <switch_mac_policy>

next

end

For example:

config user nac-policy

edit nac_policy_1

set category ems-tag

set ems-tag MAC_FCTEMS0000108427_Low

set switch-fortilink fortilink1

next

end

Creating a MAC policy

You can apply a MAC policy to the devices that were matched by the NAC policy. You can specify which VLAN is applied, select which traffic policy is used, and enable or disable packet count.

config switch-controller mac-policy

edit <MAC_policy_name>

set description <policy_description>

set fortilink <FortiLink_interface>

set vlan <VLAN_name>

set traffic-policy <traffic_policy_name>

set count {enable | disable}

next

end

Viewing the devices that match the NAC policy

Using the GUI:

1. Go to WiFi & Switch Controller > NAC Policies.
2. Click View Matched Devices.
3. Click Refresh to update the results.

When a NAC device is matched to a NAC policy and assigned to a VLAN, an event log is created.

Using the CLI:

To show known NAC devices with a known location that match a NAC policy:

diagnose switch-controller mac-device nac known

To show pending NAC devices with an unknown location that match a NAC policy:

diagnose switch-controller mac-device nac onboarding

To view the NAC clients:

diagnose switch-controller mac-device cache

To display the NAC cache of MAC addresses on the FortiSwitch unit:

execute switch-controller get-nac-mac-cache

Example of using LAN segments with NAC

In this example, devices are initially placed in the onboarding VLAN and receive IP addresses from the nac_segment DHCP server. Ports connected to the devices are configured with the NAC access mode. NAC policies are used to identify devices by OS and place them into the appropriate VLAN segment and dynamic firewall address. Firewall policies match traffic from the nac_segment interface by the dynamic firewall address and apply the appropriate security profiles to each.

1. Configure the FortiSwitch VLANs for Office 1 and Office 2.

   config system interface

   edit "Office2"

   set vdom "root"

   set device-identification enable

   set role lan

   set snmp-index 33

   set color 10

   set interface "fortilink"

   set vlanid 2000

   next

   edit "Office1"

   set vdom "root"

   set device-identification enable

   set role lan

   set snmp-index 34

   set color 5

   set interface "fortilink"

   set vlanid 2001

   next

   end

2. The following is the configuration for the nac_segment interface and its corresponding DHCP server settings. These settings are the default.

   config system interface

   edit "nac_segment"

   set vdom "root"

   set ip 10.255.13.1 255.255.255.0

   set description "NAC Segment VLAN"

   set alias "nac_segment.fortilink"

   set device-identification enable

   set snmp-index 32

   set switch-controller-feature nac-segment

   set interface "fortilink"

   set vlanid 4088

   next

   end

   config system dhcp server

   edit 5

   set lease-time 300

   set dns-service default

   set default-gateway 10.255.13.1

   set netmask 255.255.255.0

   set interface "nac_segment"

   config ip-range

   edit 1

   set start-ip 10.255.13.2

   set end-ip 10.255.13.254

   next

   end

   set timezone-option default

   next

   end

3. Add the Office 1 VLAN and Office 2 VLAN to the LAN segment VLANs.

   config switch-controller fortilink-settings

   edit "fortilink"

   config nac-ports

   set onboarding-vlan "onboarding"

   set lan-segment enabled

   set nac-lan-interface "nac_segment"

   set nac-segment-vlans "voice" "video" "Office2" "Office1"

   end

   next

   end

4. Configure the NAC policy for devices in Office 1 and Office 2.

   If you configure the NAC policy from the GUI, you can create the office2_device and office1_device dynamic firewall addresses inline. However, if you create the NAC policy from the CLI, first create the firewall addresses and then create the MAC policy and NAC policies.

   config firewall address

   edit "office2_device"

   set type dynamic

   set sub-type swc-tag

   set color 19

   next

   edit "office1_device"

   set type dynamic

   set sub-type swc-tag

   set color 10

   next

   end

   config switch-controller mac-policy

   edit "Office2_FAP"

   set fortilink "fortilink"

   set vlan "Office2"

   next

   edit "Office2_PC"

   set fortilink "fortilink"

   set vlan "Office2"

   next

   edit "Office1_PC"

   set fortilink "fortilink"

   set vlan "Office1"

   next

   end

   config user nac-policy

   edit "OFFICE2_FAP"

   set hw-vendor "Fortinet"

   set family "FortiAP"

   set os "FortiAP OS"

   set switch-fortilink "fortilink"

   set switch-group "Office2switches"

   set switch-mac-policy "Office2_FAP"

   set firewall-address "office2_device"

   next

   edit "OFFICE2_PC"

   set os "Linux"

   set switch-fortilink "fortilink"

   set switch-group "Office2switches"

   set switch-mac-policy "Office2_PC"

   set firewall-address "office2_device"

   next

   edit "OFFICE1_PC"

   set hw-vendor "VMware"

   set switch-fortilink "fortilink"

   set switch-group "Office1switches"

   set switch-mac-policy "Office1_PC"

   set firewall-address "office1_device"

   next

   end

5. Configure the firewall policy for devices in Office 1 or Office 2.

   The source of all traffic is nac_segment, but the traffic is filtered on the srcaddr by the dynamic firewall address previously assigned by the NAC policies.

   config firewall policy

   edit 5

   set name "Office1_Device"

   set uuid d3e2bbdc-d9c1-51eb-dbd3-cb534366b58d

   set srcintf "nac_segment"

   set dstintf "port1"

   set action accept

   set srcaddr "office1_device"

   set dstaddr "all"

   set schedule "always"

   set service "ALL"

   set ssl-ssh-profile "certificate-inspection"

   set logtraffic all

   set nat enable

   next

   edit 4

   set name "Office2_Device"

   set uuid a724c2fc-d9c1-51eb-e8d8-a501419308b3

   set srcintf "nac_segment"

   set dstintf "port1"

   set action accept

   set srcaddr "office2_device"

   set dstaddr "all"

   set schedule "always"

   set service "ALL_ICMP" "FTP" "FTP_GET" "FTP_PUT" "HTTP" "HTTPS" "TFTP"

   set ssl-ssh-profile "certificate-inspection"

   set logtraffic all

   set nat enable

   next

   edit 3

   set name "All_devices"

   set uuid 0accfbae-d9c1-51eb-b0bf-2ba0b00647c0

   set srcintf "nac_segment"

   set dstintf "port1"

   set action accept

   set srcaddr "all"

   set dstaddr "all"

   set schedule "always"

   set service "ALL"

   set utm-status enable

   set ssl-ssh-profile "certificate-inspection"

   set av-profile "default"

   set webfilter-profile "default"

   set dnsfilter-profile "default"

   set ips-sensor "default"

   set application-list "default"

   set logtraffic all

   set nat enable

   next

   end

6. Place the ports in NAC mode.

   config switch-controller managed-switch

   edit "S524DN4K16000116"

   config ports

   edit "port7"

   set vlan "onboarding"

   set allowed-vlans "quarantine" "nac_segment"

   set untagged-vlans "quarantine" "nac_segment"

   set access-mode nac

   next

   end

   next

   edit "S248EPTF18001384"

   config ports

   edit "port1"

   set vlan "onboarding"

   set allowed-vlans "quarantine" "nac_segment"

   set untagged-vlans "quarantine" "nac_segment"

   set access-mode nac

   next

   edit "port6"

   set vlan "onboarding"

   set allowed-vlans "quarantine" "nac_segment"

   set untagged-vlans "quarantine" "nac_segment"

   set access-mode nac

   next

   end

   next

   end

Using the FortiSwitch NAC VLAN widget

The widget shows a pie chart of the assigned FortiSwitch NAC VLANs. When expanded to the full screen, the widget shows a full list of devices grouped by VLAN, NAC policy, or last seen.

The widget is added to the Users & Devices dashboard after a dashboard reset or can be manually added to a dashboard. It can also be accessed by going to WiFi & Switch Controller > NAC Policies and clicking View Matched Devices.

The expanded view of the widget shows Assigned VLAN and Last Seen pie charts and a full device list. The list can be organized By VLAN, By NAC Policy, or By Policy Type.

Click View NAC Policies to go to WiFi & Switch Controller > NAC Policies.