I85PREP
⌘ K
FCP FortiNAC-F Administrator study materials
FCP FortiNAC-F Administrator study resources

FCP FortiNAC-F Administrator: Network Access Policies, VLAN Assignment, and Enforcement

FCP FortiNAC-F Administrator · Work through your exam, one topic at a time.

All guide sections

Network Access Policies, VLAN Assignment, and Enforcement

Domain 5 tests the policy engine that converts identity, profiling, and compliance into access. The exam focuses on how User/Host Profiles and Network Access Policies combine, how VLAN attributes are delivered, and how enforcement actually reaches the switch port.

Core rules

  • A User/Host Profile defines who or what is being matched: user group, host type, location, operating system, registration state, or compliance result. A Network Access Policy defines the access result: permit, deny, VLAN, or another access value.
  • Policy configuration is ranked. Evaluation is top-down, and the first matching rule wins in typical designs. Specific profiles must sit above broad catch-all rules.
  • RADIUS VLAN assignment uses three attributes: Tunnel-Type set to VLAN, Tunnel-Medium-Type set to IEEE-802, and Tunnel-Private-Group-ID set to the VLAN ID or name. The switch must understand the value it receives.
  • Enforcement methods include RADIUS CoA or Disconnect, SNMP VLAN changes, and CLI commands. The method must match what the device supports and what the administrator has enabled.
  • Isolation and registration VLANs are policies too. Unknown or noncompliant endpoints need a reachable portal VLAN before they can be remediated or registered.
  • A VLAN must exist on the network device and be allowed on the uplink and access port. Policy success does not guarantee network success.

Worked example

An enterprise wants registered employees in VLAN 20 and unknown endpoints in isolation VLAN 99. The engineer creates a User/Host Profile for registered domain users and a Network Access Policy that returns VLAN 20. A second profile matches unregistered hosts, with a policy returning VLAN 99. The specific employee rule is ranked above the unknown catch-all. After a test, the employee laptop receives VLAN 20 in Access-Accept, while an unregistered phone is placed in VLAN 99 and reaches the portal. The reasoning: ranking and VLAN existence are as important as the policy content.

Traps

  • Leaving a broad permit-all policy above specific rules.
  • Assigning a VLAN that is not configured or allowed on the switch.
  • Mismatching VLAN name versus VLAN ID between RADIUS and the device.
  • Forgetting CoA or SNMP write access, so the initial port state never changes.
  • Ignoring voice VLAN or special port modes that alter expected enforcement.