FortiNAC
NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
FortiKoala
Staff
Staff
Article Id 194851
Description
"Persistent Agent Scan not performed" alarm not triggering right away when the Persistent Agent is no longer detected.  

Before the "Persistent Agent Scan not performed" event is generated, the host record's MAC to IP must be resolved to check the host's status. If the information is not in cache, the event will not trigger until the next L3 Poll completes.  This in turn delays the alarm trigger. 


Solution
Ensure L3 Polling is completing.  This can be verified by navigating to Network Devices > L3 Polling (IP -> MAC).  The L3 Last Polled and L3 Last Poll Success should be the same timestamp.

For more details and instructions on triggering alarms when the Persistent Agent stops scanning, refer to the Coobook recipe in the Fortinet Document Library

Contributors