I85PREP
⌘ K
FCP FortiNAC-F Administrator study materials
FCP FortiNAC-F Administrator study resources

FCP FortiNAC-F Administrator: Authentication, Identity Sources, and 802.1X/MAB

FCP FortiNAC-F Administrator · Work through your exam, one topic at a time.

All guide sections

Authentication, Identity Sources, and 802.1X/MAB

Domain 4 covers how FortiNAC-F authenticates users and devices, and how it fits between supplicants, switches, and identity stores. The exam distinguishes authentication from authorization: proving identity does not by itself assign a VLAN.

Core rules

  • Identity sources can include local accounts, LDAP or Active Directory, and external RADIUS. Source order matters when the same username exists in more than one store.
  • FortiNAC can act as a RADIUS server for network devices. Each switch or controller must be configured as a RADIUS client with the correct shared secret; authentication uses UDP 1812 and accounting uses UDP 1813.
  • For 802.1X, FortiNAC can terminate EAP or proxy to an external RADIUS server. EAP methods such as PEAP-MSCHAPv2 and EAP-TLS require a trusted server certificate whose CN or SAN matches the configured RADIUS name.
  • MAB sends the MAC address as both username and password. It is identification, not strong authentication; pair MAB with profiling and device registration to reduce spoofing risk.
  • Authorization attributes, including VLAN assignment, are returned in the RADIUS Access-Accept or applied later through CoA. CoA uses RFC 5176, commonly UDP 3799.
  • Accounting should be enabled so FortiNAC sees session start, stop, and interim updates; without it, host location and session state can go stale.

Worked example

A wired 802.1X rollout uses Active Directory. The switch is configured with FortiNAC as its RADIUS server, and FortiNAC uses AD as the identity source. A domain laptop authenticates with PEAP-MSCHAPv2; FortiNAC validates the user, matches a User/Host Profile, and returns the employee VLAN in Access-Accept. A printer on the same switch uses MAB; FortiNAC matches its registered host record and returns the printer VLAN. The reasoning: the same RADIUS service handles both, but the evidence and policy path differ.

Traps

  • A shared-secret mismatch or missing RADIUS client entry, which causes silent rejects.
  • Using MAB as if it were secure user authentication.
  • A certificate name mismatch that breaks supplicant trust.
  • Forgetting accounting and then wondering why sessions never clear.
  • Blocking CoA ports between the switch and FortiNAC.