Description
This article describes how to solve an issue where the policy does not match with access values defined in auser/host Profile. The user/host profile has access values defined as part of the criteria.
Scope
FortiNAC.
Solution
To check the matching policy without waiting for the end user to raise an issue or perform testing after each change is made in FortiNAC configuration, use the test tool that can be accessed in Hosts. Right-click on the desired host and select 'Policy Details'. Below is an example of a host not matching any user/host profile:
Create or check the user/host profile that is expected to match for this host:
Make sure to check all the tabs and the configurations are correct.
There are also other matching criteria that can be configured directly in the profile, such as location, user/host group, time, or information extracted from RADIUS attributes.
After making the correct changes, the result should include a Logical network and the desired VLAN ID or name will be shown:
If the correct policy is used but there is no VLAN shown (VLAN name or VLAN ID), make sure that the VLAN is tied with the logical network that is used in the Network access policy.
- Navigate to Network Devices -> Topology.
- Right-click on the device and select Model Configuration.
To debug from the CLI, run the following:
nacdebug -name PolicyHelper true
Example output:
yams.PolicyHelper FINER :: 2023-09-25 11:59:21:767 :: #955 :: HostRecord.getEPCPolicy() HostRecord DBID: 132 calling HostRecord.getAbstractPolicy()
HostRecord.getAbstractPolicy() HostRecord DBID: 132 Using User:
UserRecord:
Landscape = 91754594318 00:15:5D:00:00:0E
ID = 10
Role = AD-NetworkUserRole
Type = Administrative
Admin Profile DBID = 3
Directory Policy =
DN = CN=gimi,OU=Usr,DC=eb,DC=eu
Position = Shef IT
Email Address = gimi@eb.eu
First Name = gimi
...
Setting adapters from host record.
HostRecord.getAbstractPolicy() HostRecord DBID: 132 Using HostRecord
Host Record:
Landscape = 91754594318 00:15:5D:00:00:0E
ID = 132
hostName = WIN-10-USB
owner = beni
policy = null
os = Windows 10 Pro 6.3 21H2 10.0.19044.3086
hardwareType = VMware, Inc. VMware20,1 None
application = Anti-Virus :: Microsoft Windows Defender,Anti-Virus :: Microsoft Windows Defender Engine Updates,Anti-Virus :: Microsoft Windows Defender Signatures,Anti-Virus :: Windows Defender Real-time Protection Check,Operating-System :: ...
