Monitoring, Logging, Reporting, and Troubleshooting
Domain 8 tests how you prove what happened and isolate why an endpoint got the wrong access. FortiNAC-F troubleshooting is evidence-driven: host state, authentication logs, policy evaluation, device integration, and packet-level checks must agree before you change a rule.
Core rules
- Use the Host view as the primary investigation point. It shows the host record, profiling result, authentication events, policy match, and switch port location.
- Monitor Network Devices for reachability, SNMP polling errors, and CLI failures. A device that is reachable but not polled correctly produces misleading endpoint data.
- Logs include system events, authentication and RADIUS logs, audit logs, and policy events. Forward logs to syslog for retention, but keep local logs long enough to investigate.
- Reports cover registration, guest activity, compliance, and policy outcomes. Reports are only as good as the underlying host and session data; stale sessions produce misleading counts.
- Diagnostic tools include ping, traceroute, DNS lookup, and packet capture. Use them to separate appliance reachability from network-device or supplicant problems.
- Troubleshoot in order: Is the endpoint detected? Is it authenticated? Did a policy match? Was the enforcement action delivered? Did the switch apply it?
Worked example
A user authenticates successfully but lands in the wrong VLAN. The Host view shows a valid RADIUS authentication and a policy match to the guest profile. The RADIUS log shows Access-Accept with the guest VLAN attributes. The engineer checks policy rank and finds a broad guest rule above the employee rule. After reordering and re-evaluating the host, CoA moves the port to the employee VLAN. The reasoning: authentication was correct; authorization order was wrong, and the log proved which attributes were actually sent.
Traps
- Changing policy before confirming which rule matched.
- Reading only syslog and ignoring RADIUS and audit logs.
- Forgetting that NTP skew makes log correlation unreliable.
- Not enabling packet capture before reproducing an intermittent failure.
- Assuming a CoA was applied without checking the switch port VLAN.