FCP FortiNAC-F Administrator key terms

The FortiGate-integrated FortiNAC form factor that runs as a virtual machine managed through FortiGate, using FortiOS-style configuration and licensing rather than the standalone FortiNAC appliance interface.

The FortiGate feature that hosts and controls a FortiNAC-F instance, letting administrators configure and monitor the NAC service from the FortiGate GUI and CLI.

The FortiNAC web interface used for configuration, policy authoring, host management, and reporting; in FortiNAC-F it is reached through the FortiGate management extension or its own management address.

The FortiNAC component that stores configuration and policy and pushes it to enforcement devices; it is the central brain of the deployment and the target of backups.

The FortiNAC component that performs endpoint discovery, profiling, and communication with network devices; larger deployments can add secondary application servers for scale.

Optional endpoint software installed on managed hosts that reports identity, posture, and adapter details to FortiNAC and can enforce agent-based checks in policy.

A temporary agent downloaded and run by an endpoint during onboarding or remediation, used to collect information or apply fixes without a permanent install.

The process of representing a network device in FortiNAC with its interfaces, VLANs, and capabilities so the system can read MAC tables and issue enforcement actions.

The read string FortiNAC uses to poll a network device for MAC address tables, interface status, and traps; read-write access is needed only for certain enforcement methods.

An asynchronous notification a switch or wireless controller sends to FortiNAC when a link changes or a host connects, triggering faster detection than polling alone.

The username, password, and enable secret FortiNAC stores to log into a network device over SSH or Telnet for configuration changes such as VLAN reassignment.

A scheduled FortiNAC query of device interfaces to learn which ports are up and which MAC addresses are present, supplementing or replacing trap-based detection.

The per-switch mapping of learned MAC addresses to ports that FortiNAC reads to determine where an endpoint is connected before applying policy.

The classification of a connecting device by operating system, device type, and manufacturer using fingerprints such as DHCP options, MAC OUI, user agent, and open ports.

A stored pattern of endpoint attributes FortiNAC matches against observed traffic or agent data to assign a device to a profile and drive policy decisions.

Profiling that inspects DHCP request parameters, vendor class, and hostname options to infer an endpoint's operating system or device category.

The act of associating a known endpoint with an owner and a record in FortiNAC, which allows persistent policy treatment across reconnects.

A FortiNAC grouping of hosts, users, and devices that policies reference, letting administrators apply rules to categories instead of individual endpoints.

A rule that matches a host, user, or device condition and assigns an access result, such as a VLAN, role, or deny, when the endpoint connects.

The ordered list of access policies FortiNAC evaluates for a connection; the first matching policy determines the enforcement outcome.

Dynamic enforcement that places a port or wireless session into a specific VLAN by changing switch or controller configuration when policy matches.

The mechanism FortiNAC uses to apply a policy decision, such as CLI-based VLAN change, RADIUS attribute, or firewall address change.

A Change of Authorization message FortiNAC sends to a network access device to reauthenticate or reassign a session after a policy or posture change.

The IEEE port-based access control standard in which a supplicant authenticates through an authenticator to a RADIUS server before gaining network access.

MAC Authentication Bypass, an 802.1X fallback in which the switch sends the endpoint's MAC address to RADIUS as both username and password for devices without supplicants.

Extensible Authentication Protocol, the framework carried inside 802.1X that negotiates authentication methods such as PEAP, EAP-TLS, and EAP-TTLS.

An 802.1X method, typically EAP-TLS, in which the supplicant proves identity with a client certificate issued by a trusted certificate authority.

The FortiNAC role that receives authentication requests from network devices, validates credentials against an identity source, and returns access attributes.

An external directory or local database, such as LDAP, Active Directory, or RADIUS, that FortiNAC queries to authenticate users and retrieve group membership.

A collection of directory accounts imported into FortiNAC that policies and guest roles reference instead of naming individual users.

A web page presented to unregistered visitors where they request or receive sponsored access and are placed into a restricted guest network until approved.

An authorized internal user who reviews and approves guest access requests created through the guest portal, optionally setting an expiration.

A workflow in which visitors enter their own details on the guest portal and receive credentials or approval without administrator involvement.

The guided process that registers a personally owned device, installs required certificates or agents, and grants it access under a device-based policy.

A deployment of paired FortiNAC nodes that share state so the secondary can take over control and enforcement duties if the primary fails.

An export of FortiNAC configuration and database used to restore the system after failure or to replicate settings to another node.

Routine administrative tasks such as updating software, rotating logs, cleaning stale hosts, and verifying database health to keep FortiNAC reliable.

A record of administrative and system events in FortiNAC that supports change tracking and investigation of unexpected configuration or policy behavior.

A chronological record of connection, authentication, and enforcement activity that administrators filter to troubleshoot why a host received a particular result.

The systematic diagnosis of access failures by checking device modeling, credential validity, policy order, identity source reachability, and event logs in sequence.