I85PREP
⌘ K
FCP FortiNAC-F Administrator study materials
FCP FortiNAC-F Administrator study resources

FCP FortiNAC-F Administrator: Guest and Bring-Your-Own-Device (BYOD) Onboarding

FCP FortiNAC-F Administrator · Work through your exam, one topic at a time.

All guide sections

Guest and Bring-Your-Own-Device (BYOD) Onboarding

Domain 6 covers temporary access and personal-device enrollment. The exam tests lifecycle control for guests and certificate-based onboarding for BYOD, including the portals, sponsor roles, and policy differences that keep guest traffic away from corporate resources.

Core rules

  • Guest accounts can be sponsor-created or self-registered. They have start and end times, optional approval, and limited access. Expiry must be enforced, not just displayed.
  • The guest portal usually runs on an isolation VLAN. Guests need DHCP, DNS, and a reachable portal before they can authenticate or register.
  • Sponsor roles allow non-administrators to create or approve guest accounts. Audit logs should record who sponsored whom and when access ends.
  • BYOD onboarding enrolls a personal device and often provisions a certificate through an internal CA or SCEP. The device then authenticates with EAP-TLS instead of user credentials.
  • The BYOD onboarding SSID or VLAN must match the enrollment policy. A device that enrolls on one network but connects on another may fail certificate or policy matching.
  • Guest and BYOD should not share the same access policy by default. Guests are temporary and unmanaged; BYOD devices are enrolled, identified, and often compliance-checked.

Worked example

A visitor self-registers at the guest portal and selects a sponsor. The sponsor approves an eight-hour account, and FortiNAC places the visitor in guest VLAN 50. Separately, an employee enrolls a personal tablet: the device downloads the CA chain, receives a SCEP certificate, installs the profile, and connects to the BYOD SSID with EAP-TLS. FortiNAC maps the certificate identity to the BYOD policy and VLAN 30. The reasoning: guest access is time-bound and sponsor-controlled, while BYOD access is certificate-bound and device-specific.

Traps

  • Creating guest accounts without expiry or failing to enforce expiry.
  • Blocking portal access with an isolation VLAN that has no DNS or DHCP.
  • Not trusting the onboarding CA on the endpoint, causing EAP-TLS failure.
  • Using the guest policy for BYOD and losing device identity.
  • Forgetting that sponsor approval and audit records are part of the control.