I85PREP
⌘ K
FCP FortiNAC-F Administrator study materials
FCP FortiNAC-F Administrator study resources

FCP FortiNAC-F Administrator: Endpoint Detection, Profiling, and Device Registration

FCP FortiNAC-F Administrator · Work through your exam, one topic at a time.

All guide sections

Endpoint Detection, Profiling, and Device Registration

Domain 3 examines how FortiNAC-F discovers endpoints, decides what they are, and records ownership. Detection supplies raw evidence; profiling turns that evidence into a device type; registration ties a host to a user or administrative record. The exam often asks which evidence source is authoritative when they disagree.

Core rules

  • Detection sources include SNMP MAC and ARP tables, DHCP fingerprints, RADIUS accounting, agent data, and administrative imports. Each has a freshness and trust level.
  • Profiling rules combine MAC OUI, DHCP fingerprint, open ports, hostname, operating system, and agent attributes. A rule should be specific enough to avoid classifying every device from one vendor as the same model.
  • FortiNAC uses host states such as rogue, registered, guest, and disabled. An unknown endpoint is not automatically blocked until policy says so.
  • Registration can be user-driven through a portal or administrator-driven in the Host view. Registration creates or updates the host record and owner; it is separate from authentication.
  • Agents can provide compliance and identity detail, but profiling must still work for agentless devices such as printers, cameras, and IoT controllers.
  • Device Registration is not the same as user registration. A shared printer may be registered to a department, while a laptop is registered to a named user.

Worked example

A new label printer appears as rogue. SNMP shows its MAC on a access port, the OUI identifies the vendor, and the DHCP fingerprint matches a printer rather than a workstation. The engineer creates a profiling rule for that vendor and DHCP fingerprint, maps it to the Printer device type, then registers the host to the Logistics department. A policy later places Printer in the IoT VLAN. The reasoning: OUI alone is weak because virtualization and randomized MACs can imitate vendors; combining DHCP and port behavior raises confidence.

Traps

  • Classifying from OUI alone and mislabeling virtual machines or randomized Wi-Fi MACs.
  • Using stale DHCP data after an endpoint has moved or changed OS.
  • Confusing a registered user account with a registered host record.
  • Expecting an agent on devices that cannot run one.
  • Forgetting that profile changes may need a policy re-evaluation before enforcement changes.