FCP FortiNAC-F Administrator flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FortiNAC-F default management access

Administration is performed through the web UI over HTTPS and through the appliance CLI. Both the CLI account and the UI admin account exist and should have their default credentials changed right after the initial deployment wizard completes.

NTP requirement before device onboarding

System time must be synchronized before network devices are added, because certificate validation, RADIUS accounting timestamps, and log correlation all depend on accurate time across the appliance and the authenticators.

FortiNAC-F minimum interface design

Most designs use one interface for management and administration and a separate interface on the isolation or enforcement network that connects to the Layer 2 and Layer 3 edge devices performing authentication.

Profiling update dependency

The appliance must reach FortiGuard or a configured update server to receive OS fingerprint and profiling packages. Without current packages, newly released device models and operating systems are classified as unknown.

SNMP read versus write

SNMP read is used for topology, MAC address table, and interface state polling. SNMP write is optional and enables enforcement actions such as interface shutdown on models that support it.

CLI credential privilege requirement

The CLI credential stored for a network device must be able to enter configuration mode, because VLAN changes and other enforcement actions are applied through configuration commands on many switch models.

Device validation before polling

The validate or test function confirms SNMP reachability and credential correctness. A device that fails validation is not polled for endpoint data and will not contribute MAC table or topology information.

CoA port requirement

Change of Authorization uses UDP 3799 and must be permitted in both directions between the appliance and the authenticator. Without it, existing sessions keep their previously assigned VLAN until re-authentication.

MAC OUI profiling limitation

The OUI identifies only the hardware vendor, not the operating system. Using OUI alone as a profiling signal is weak and should not drive access decisions without corroborating DHCP or other fingerprints.

DHCP fingerprinting visibility

DHCP fingerprinting requires the appliance to see DHCP traffic, either by acting as the DHCP server, by being a relay target, or by receiving mirrored or forwarded DHCP packets from the network.

Host record lifecycle

A host record represents a discovered endpoint and moves through unknown or unregistered, registered, and optionally at-risk or quarantined states as authentication, profiling, and policy evaluation occur.

Host aging and purge

A host not seen for the configured aging period is purged from the active host table. Long aging increases database size, while short aging forces re-profiling and re-evaluation each time the endpoint returns.

MAB credential construction

MAC Authentication Bypass sends the endpoint MAC address as both the username and the password in a RADIUS Access-Request. It is intended for devices that cannot run an 802.1X supplicant.

MAB spoofing exposure

Because a MAC address can be spoofed, MAB-authenticated hosts are weaker than 802.1X hosts. They should be placed in a restricted VLAN or subjected to additional profiling before being trusted.

RADIUS shared secret mismatch symptom

If the shared secret differs between the appliance and an authenticator, Access-Requests are silently dropped and the port fails authorization. The symptom is an authentication failure with no matching request in the log.

802.1X versus MAB ordering

If MAB is attempted before 802.1X, a capable device may be authenticated by MAC before its supplicant responds. Configure the switch to try 802.1X first and fall back to MAB.

Tunnel attributes for VLAN assignment

VLAN assignment is delivered through RADIUS Tunnel-Type set to VLAN, Tunnel-Medium-Type set to IEEE-802, and Tunnel-Private-Group-ID carrying the VLAN ID or name to the authenticator.

Policy evaluation order

Policies are evaluated top-down and the first match wins. Specific rules for known or compliant devices must sit above broad catch-all rules, or the catch-all will capture every endpoint.

Dynamic VLAN switch configuration

The switch must be configured to accept a VLAN from RADIUS, for example with a dynamic VLAN authentication setting. Without it, the port remains in its default VLAN regardless of the policy result.

Fallback policy behavior

When no policy matches, evaluation falls to the default or fallback policy. If none is defined, the endpoint stays in the default VLAN or is denied, depending on how the authenticator is configured.

Guest sponsor approval

Guest self-registration can route the request to a sponsor who approves or denies access. Approval can be time-limited, and the guest is placed in the guest VLAN by policy after approval.

Guest account expiration handling

Guest accounts carry an expiration. When the account expires, the host is re-evaluated and moved out of the guest role at the next authentication or Change of Authorization.

BYOD device count limit

BYOD registration binds a device MAC to a user account. A per-user maximum number of registered devices prevents credential sharing and limits how many endpoints one identity can onboard.

Pre-authentication portal reachability

The onboarding portal must be reachable from the pre-authentication VLAN, which requires DNS resolution and HTTPS access to the portal before the device has been authorized onto the network.

HA replication network

A FortiNAC-F high availability pair requires a dedicated heartbeat and replication network between the nodes, plus matching software versions, licenses, and network settings on both appliances.

Failover session impact

Failover is not instantaneous. The secondary detects the failure, promotes itself, and re-establishes RADIUS and device connections, so existing sessions may need to re-authenticate after the transition.

Backup scope

A backup includes the database and configuration but not the OS image. Rebuilding on new hardware therefore requires reinstalling the same software version before the backup can be restored.

Disk usage monitoring

Persistent storage holds logs and the database. A full disk stops logging and can corrupt the database, so disk usage must be monitored and retention settings adjusted accordingly.

RADIUS troubleshooting sequence

Start by verifying shared secrets, then check UDP 1812 and 1813 reachability, then inspect the authenticator configuration. The appliance log shows the Access-Request and the attributes returned.

Unknown device type diagnosis

An unknown device type usually means profiling updates are stale or DHCP traffic is not visible to the appliance. Confirm update currency first, then verify that DHCP packets actually reach the appliance.

CoA failure symptom

When CoA fails, sessions do not change VLAN after a policy change. Verify UDP 3799 reachability and confirm the switch supports and is configured for RFC 5176 dynamic authorization.

SNMP polling failure effect

Failed SNMP polling produces missing MAC table data and stale topology. Check community strings, SNMPv3 credentials, ACLs, and whether the device validated successfully in inventory.