Fortinac

---
name: fortinac
description: "Expert agent for FortiNAC network access control. Covers agentless device discovery and profiling, wired and wireless 802.1X, MAC-based authentication, network access policies, Fortinet Security Fabric integration, FortiGate firewall policy enforcement, and OT/IoT device onboarding. WHEN: \"FortiNAC\", \"FortiNAC policy\", \"FortiNAC profiling\", \"Fortinet NAC\", \"FortiNAC OT\", \"FortiNAC IoT\", \"FortiNAC FortiGate integration\"."
license: MIT
---

# FortiNAC

This skill covers FortiNAC, Fortinet's network access control solution. It has deep knowledge of FortiNAC's agentless profiling, wired and wireless access control, Fortinet Security Fabric integration, and OT/IoT device management.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Device profiling** -- Agentless discovery and fingerprinting
   - **Access policy** -- Network access rules and enforcement
   - **Fortinet integration** -- FortiGate, FortiManager, FortiAnalyzer connectivity
   - **OT/IoT onboarding** -- Industrial and IoT device management
   - **Troubleshooting** -- Diagnostic methodology below

2. **Identify version** -- FortiNAC 9.x is current. FortiNAC-F (fabric-integrated) differs from standalone FortiNAC.

3. **Gather context** -- Network infrastructure (Fortinet-heavy vs. multi-vendor), OT/IoT device types, existing 802.1X deployment, scale.

## Core Expertise

### FortiNAC Architecture

**Deployment components:**
- **FortiNAC Server** -- Core policy engine and management console
- **FortiNAC Control Server** -- (High availability / scale-out deployments)
- **FortiNAC Application Server** -- Portal and report services
- **FortiNAC Manager** -- (Multi-site management)

**Deployment modes:**
- **In-line** -- FortiNAC between core and access layer (Layer 2 enforcement)
- **Out-of-band** -- FortiNAC communicates with switches via SNMP/SSH for VLAN changes (most common)
- **FortiGate integration** -- FortiGate enforces segmentation based on FortiNAC identity tags

### Device Discovery and Profiling

FortiNAC emphasizes agentless profiling, making it strong for OT/IoT environments where agents cannot be installed.

**Discovery methods:**
| Method | Description | Best For |
|---|---|---|
| **Passive DHCP** | Monitors DHCP option 55, 60, 43, hostname | All IP-connected devices |
| **Active scan (Nmap)** | Port scan and OS fingerprinting | Managed segments where scanning is acceptable |
| **SNMP polling** | Queries endpoints and network devices for MAC/ARP tables, CDP/LLDP | Managed network devices, some IoT |
| **NetFlow/IPFIX** | Analyzes traffic flows for behavioral profiling | Traffic pattern-based classification |
| **802.1X supplicant data** | OS and certificate data from 802.1X auth | Corporate managed devices |
| **Integration** -- MDM/SCCM/WMI | Pulls asset data from management platforms | Corporate managed endpoints |

**Device profiling workflow:**
1. Device connects to network (or DHCP event observed)
2. FortiNAC collects probe data from all enabled methods
3. Profile rules match collected attributes to known device types
4. Device classified and assigned a FortiNAC Group
5. Network access policy applies based on group assignment
6. Unknown/unclassified devices can be held in quarantine VLAN

**Custom profiling rules:**
```
Device Profiling Rule: Industrial_Controller
  Method: DHCP
  Conditions:
    dhcp.classIdentifier CONTAINS "Siemens"
    dhcp.hostName MATCHES "^PLC-.*"
  
  Result:
    Category: OT Device
    Type: PLC / Controller
    Group: FortiNAC-Group-OT-Devices
    
  Confidence: 75
```

### Network Access Policies

FortiNAC uses "Network Access" policies to determine VLAN assignment and enforcement actions:

**Policy evaluation order:**
1. Registered devices (known, approved)
2. Authentication results (802.1X identity)
3. Device group (profiling result)
4. Default (catch-all)

**Policy configuration example:**
```
Network Access Policy: Corporate_Devices
  Conditions:
    Host State: Registered
    Host Group: Corporate-Laptops
    User Group: Domain-Users
    
  Result:
    VLAN: Corporate (100)
    Access: Full Corporate Access
    Isolation: None
```

```
Network Access Policy: IoT_Devices
  Conditions:
    Host State: Any
    Device Type: IoT Device
    
  Result:
    VLAN: IoT-Segment (60)
    Access: Limited (IoT ACL)
    Isolation: VLAN-only
```

```
Network Access Policy: Unknown_Devices
  Conditions:
    Host State: Unknown
    
  Result:
    VLAN: Quarantine (999)
    Access: Registration Portal Only
    Notification: Admin Alert
```

### Fortinet Security Fabric Integration

FortiNAC is a key component of the Fortinet Security Fabric. Integration points:

**FortiGate integration:**
- FortiNAC pushes device identity tags to FortiGate
- FortiGate enforces firewall policies based on FortiNAC device groups
- Dynamic address objects update automatically when FortiNAC reassigns devices

**FortiGate dynamic policy example:**
```
FortiGate Firewall Policy:
  Source: [FortiNAC-Group-IoT]   # Dynamic -- FortiNAC updates this
  Destination: [Corporate-Servers]
  Action: Deny
  Comment: "Block IoT from accessing corporate servers"
```

**FortiAnalyzer/FortiManager integration:**
- Security events forwarded from FortiNAC to FortiAnalyzer
- FortiManager can push FortiNAC configurations in centralized deployments

**FortiGuard integration:**
- FortiNAC uses FortiGuard Device Identification updates for profiling
- Regular signature updates improve device classification accuracy

### OT/IoT Device Management

FortiNAC is well-suited for industrial and IoT environments:

**Key capabilities:**
- Agentless profiling works for all IP-connected devices (PLCs, HMIs, cameras, medical devices)
- Built-in OT device fingerprint library (Siemens, Rockwell, Schneider, etc.)
- Scheduled profiling scans with configurable scan intensity (avoid disrupting sensitive OT devices)
- MAC-based authentication (MAB) as primary method for non-802.1X OT devices
- VLAN-based isolation for OT networks

**OT deployment considerations:**
```
Recommended OT configuration:
  - Disable active scanning (Nmap) in OT/ICS segments
  - Use passive DHCP + SNMP only for OT device discovery
  - Enforce OT devices to dedicated VLAN from day one (no grace period)
  - Create specific profile rules for each OT vendor/product line
  - Set "require manual approval" for unknown OT devices (don't auto-assign)
  - Alert immediately on any new/unknown device in OT segment
```

**OT network segmentation policy:**
```
Network Access Policy: OT_Approved_Devices
  Conditions:
    Host State: Registered
    Device Category: OT Device
    VLAN: OT-Network (300)
    
  Result:
    VLAN: OT-Network (300)
    Access: OT-Only ACL
    Notification: None (normal operation)

Network Access Policy: OT_Unknown_Device
  Conditions:
    VLAN: OT-Network (300)
    Host State: Unknown
    
  Result:
    VLAN: OT-Quarantine (301)
    Access: No Access
    Notification: CRITICAL ALERT - Unknown device on OT network
```

### High Availability

**FortiNAC HA configuration:**
- Active/Passive HA pair
- Shared virtual IP for management and enforcement
- Database replication between primary and secondary
- Automatic failover with configurable heartbeat timeout

```
HA Configuration:
  Primary FortiNAC: 10.0.0.10
  Secondary FortiNAC: 10.0.0.11
  Virtual IP (HA): 10.0.0.12
  Heartbeat: 5 seconds
  Failover timeout: 15 seconds
```

## Troubleshooting

### Device Not Profiling Correctly

1. Check **Events > Network Events** for the device MAC address -- view all discovery data received
2. Verify probe data: what DHCP options, what NetFlow, what SNMP data was collected
3. Review **Device Profiling Rules** -- Check which rules were evaluated and why they matched or didn't
4. Test against manual profiling: Network > Device Profiling > Test Profile (enter MAC, run rules manually)

### Device Not Getting Expected VLAN

1. Check **Hosts > Host View** -- Find device, view current VLAN and group assignment
2. Review **Network Access Policies** -- Check policy order; first match wins
3. Check **Policy History** for the device -- View past policy applications
4. Verify switch configuration -- Confirm SNMP/SSH access for VLAN changes

### RADIUS/802.1X Issues

```
# FortiNAC RADIUS logs
Administration > Logging > RADIUS Log

# Switch-side verification (Cisco IOS)
show dot1x interface <interface>
show radius statistics
debug dot1x events
```

## Common Pitfalls

1. **Active scanning in OT environments** -- Never enable Nmap scanning in OT/ICS networks without explicit approval from OT team. Active scans can crash PLCs and other sensitive devices.

2. **SNMP write access risk** -- FortiNAC needs SNMP write access to switches for VLAN changes in some modes. Protect SNMP community strings and prefer SNMP v3.

3. **Profiling database not seeded** -- Before enforcing policies, run FortiNAC in discovery-only mode to build the device database. Enforcing before profiling is complete causes legitimate devices to land in quarantine.

4. **FortiGate policy lag** -- Dynamic address object updates from FortiNAC to FortiGate have a small delay (seconds to minutes). Design policies to account for this transition period.

5. **Certificate management for 802.1X** -- If using EAP-TLS, build a certificate renewal process before deployment. Expired certificates will lock out devices and generate help desk tickets.