FortiNAC – Add Your First Device: FortiGate

Before you begin

Confirm each prerequisite before planning changes. Checklist progress is kept for this visit and resets when you reload.

1Overview

This guide adds a FortiGate device model to FortiNAC Inventory and checks the management credentials used by the integration. API, SNMP and CLI access must be prepared on the FortiGate before the device is added. RADIUS signaling is optional and must be configured and tested separately.

FortiGate – SNMPv3 ↗

FortiGate – REST API ↗

FortiGate – RADIUS ↗

Preparation ↗

Appliance Installation ↗

2Prepare the integration

Complete basic FortiNAC deployment first. Have the FortiGate management IP, HTTPS/API port, REST API key, SNMP credentials, and SSH administrator credentials available. Have the RADIUS shared secret available if the device will send RADIUS traffic to FortiNAC.

This guide assumes these accounts and services are already configured on the FortiGate. Use dedicated integration accounts with the permissions required for the intended visibility or control functions. An API key and a CLI administrator password are separate credentials; retain both for this integration.

Example worksheet

Replace these example values with your own. Enter secrets directly into FortiNAC rather than into the worksheet.

Required connectivity

The FortiGate interface must accept HTTPS, SNMP, and SSH as required. Check administrator trusted hosts, API trusted hosts, SNMP source restrictions, and any local-in policies as well as intervening firewall policies. RADIUS requests may originate from an address other than the management IP; confirm the actual source address when configuring signaling.

Enabling inbound snmp on FortiNAC port1 is required for incoming traps when used; it is separate from FortiNAC polling a device on UDP/161. For RADIUS, enable the applicable radius-auth and radius-acct listeners on FortiNAC port1 and configure the RADIUS service itself.

3Choose an Inventory container

Sign in to FortiNAC and open Network → Inventory. Containers organize the device models in Inventory, so choose the location where this FortiGate belongs. You can use Customer, or right-click it to create a container such as Lab or a site name. Right-click the chosen container and select Add Device.

4Identify the FortiGate and API connection

Use IP Address for the FortiGate interface that FortiNAC will manage. Enter the token generated by its REST API Admin account in API Key, and set Port to the FortiGate HTTPS management/API port. Use 443 only when that is the actual HTTPS port; enter the custom value if administration uses a different port.

This Port field is for HTTPS/API communication. It does not change the SSH or RADIUS ports.

Fortinet documents the API key as required for FortiOS 7.4.8+ and 7.6.4+ integration. It supplements the System Administrator credentials used for CLI access. See Configure FortiGate.

5Configure SNMP access

Enable SNMP Settings and select the SNMP version and security mode already configured on the FortiGate. Enter the matching credentials using the table below. These settings must match the FortiGate configuration, including source-host permissions and the algorithms used by SNMPv3.

For SNMPv3, both sides must use the same security level and algorithms. Do not assume that matching only the username is sufficient. Prefer an appropriately secured SNMPv3 configuration when available.

Reference: Credentials.

6Configure CLI access

Enable CLI Settings and select SSH2 for this password-based example. Enter the FortiGate System Administrator username and password prepared for FortiNAC. These are the CLI account credentials, separate from the REST API token.

Leave Enable Password blank for this FortiGate example. The field is intended for devices that require a separate enable password.

For the password-based example, do not enable public-key authentication unless that method has also been configured. If SSH uses a custom port, configure it in the device's supported CLI connection settings; changing the HTTPS/API Port field does not change SSH.

An API key does not replace the System Administrator credentials. Fortinet notes that omitting CLI credentials can prevent discovery of FortiSwitches managed through the FortiGate.

Reference: FortiNAC 7.6.5+ FortiGate integration.

7Add RADIUS settings when required

Enable RADIUS Settings only if the integration uses RADIUS signaling, then enter the shared secret configured for the device’s relationship with FortiNAC. Keep the value identical on the relevant peers; the account credentials used for management do not replace this secret.

The secret must match on the relevant device and FortiNAC configurations. In a multi-VDOM design, verify the RADIUS configuration for each VDOM sending requests.

Entering the secret here does not enable RADIUS on the FortiGate, start the FortiNAC RADIUS service, or configure authentication policies. Authentication, accounting, and CoA must be configured and tested for the intended deployment.

References: Configure FortiNAC – RADIUS settings, Configure FortiGate – RADIUS.

8Validate and save the device

Select Validate Credentials and review the complete result for the checks available in the dialog. Use the troubleshooting sections below to investigate SNMP, CLI or API errors. Select OK to save the FortiGate device model in Inventory.

Open the saved FortiGate’s Credentials tab and confirm that the API key and HTTPS port were retained. After changing either value, choose Save before running Validate Credentials again.

For this FortiOS 7.6.7 example, set the Telnet/SSH and CLI Command timeouts to 30 seconds in Credentials, as directed by the referenced integration guide. Save the settings and repeat credential validation.

If validation in the Add Device dialog cannot complete because API settings have not yet been saved, save the device record and complete the check from its Credentials tab. Do not consider onboarding complete until the required management checks pass.

References: Credential validation, Integration timeouts.

9Troubleshoot credential validation

Record the exact message and time of a failed attempt. Select the device and use Show Events to look for SNMP failures, CLI timeouts, or REST API errors. A general CLI failure message can also indicate unsuccessful API communication.

Device does not respond or all checks time out

• Confirm the IP address, routing, and return route from FortiNAC.
• Check which FortiNAC source IP reaches the FortiGate, particularly if NAT exists between them. Trusted-host and SNMP restrictions must match the observed source.
• Verify the FortiGate interface accepts the required management services.
• Check local-in policies and intervening firewall rules for the actual HTTPS, SSH, and SNMP ports.

From the FortiNAC CLI, test reachability to the example device:

execute ping 192.168.98.1

Ping failure is not conclusive if ICMP is intentionally blocked. Use the protocol-specific checks below.

SNMP validation fails

• Recheck the community string, or the complete SNMPv3 security level, username, algorithms, and passwords.
• Confirm that the FortiGate SNMP configuration permits the FortiNAC source address and that UDP/161 is reachable.
• Run the saved device's SNMP test from the FortiNAC CLI:

diagnose network device test-snmp ip 192.168.98.1

• Review Show Events for timeout, authentication, or OID-access errors. Correct the reported condition and validate again.

For third-party devices, credentials can validate successfully while the SNMP view still lacks tables needed for polling. Successful read access also does not prove write permission where that integration requires SNMP control.

Reference: Troubleshoot SNMP communication.

SNMP succeeds but CLI validation fails

• Confirm SSH2, the username, password, SSH port, and the account's required permissions.
• Ensure the account is not locked, expired, or waiting for an interactive password change.
• Keep the enable password blank for this FortiGate example. Verify the selected password/public-key authentication method.
• Test SSH directly from FortiNAC with the same account:

execute ssh [email protected]

• If the FortiGate has been rebuilt or its SSH host key changed, verify the new fingerprint before using Clear Known Hosts in the device's Credentials tab. Then reconnect and validate again.
• Allow any configured administrator lockout period to expire before retrying. Confirm the two command timeouts are set to 30 seconds for this example.

If manual SSH works but validation still fails, continue with the API checks. Do not assume the message proves the SSH password is wrong. For SSH negotiation errors, record the offered algorithms and check firmware compatibility before changing cryptographic settings.

Reference: Validate Credentials not working for FortiGate.

API validation or REST API communication fails

If the API Key field was not populated during addition, enter it under Inventory → FortiGate → Credentials, click Save, then validate again. Do not repeatedly regenerate keys while the actual fault is a wrong port or blocked source.

On the FortiGate, the following setting is required on affected FortiOS releases for API-based FortiSwitch port/VLAN control. Apply it only when the intended integration requires it; this is not a general fix for credential validation.

config system global
    set rest-api-key-url-query enable
end

Apply that setting when the integration requires it; it allows API tokens in URL parameters. It does not correct an invalid token or grant missing permissions. Retain HTTPS and appropriate API source restrictions.

References: API token placement, FortiGate integration prerequisites.

Management validation passes but RADIUS signaling fails

• Check the RADIUS destination, source IP, shared secret, and FortiNAC device association.
• Confirm radius-auth and radius-acct are enabled on FortiNAC port1 for the services being used. Preserve other required entries when changing allowaccess.
• Check that the FortiNAC RADIUS service is running and listening, and that UDP/1812 and UDP/1813 are permitted as needed.
• Trigger a test authentication or session event and inspect Network → RADIUS service logs.
• For disconnect detection, confirm that session accounting is enabled on the authenticator and that FortiNAC receives an Accounting-Stop. Authentication alone does not enable accounting.
• Test CoA separately if the design uses it. Confirm the authenticator's dynamic-authorization configuration, accepted FortiNAC source, shared secret, and CoA port.

To check whether RADIUS traffic reaches FortiNAC:

execute tcpdump -i any 'udp port 1812 or udp port 1813' -v

Stop with Ctrl+C after reproducing the test. Receiving packets proves network delivery; inspect the service logs to establish whether FortiNAC accepts and processes them.

Device is saved but interfaces or managed switches are missing

• Confirm all required credentials are saved and validate successfully.
• Right-click the FortiGate and select Resync Interfaces.
• Review the discovered interfaces/VDOMs and, where applicable, managed FortiSwitches.
• If information remains missing, check account permissions, VDOM access, device events, and the FortiGate/FortiNAC integration requirements.

An empty host list can be expected when no endpoints have been learned yet. Validate discovery/polling with a known test endpoint before interpreting an empty list as a credential failure.

10Next steps

The first device is now added. Continue with device-specific model configuration, signaling, network mapping, and policy configuration for the intended deployment.

11References

Fortinet – Add or modify a device ↗

Fortinet – Credentials ↗

Fortinet – Configure FortiGate ↗

Fortinet – FortiNAC 7.6.5+ FortiGate integration ↗

Fortinet – Troubleshooting SNMP communication ↗

Fortinet – Validate Credentials not working for FortiGate ↗

Fortinet – Use RADIUS accounting to update port state ↗

The supplied article targets FortiNAC-F and FortiOS 7.6.7 and cites shared Fortinet 7.6 documentation published under 7.6.0. Menu labels can vary by build. The procedure has not been independently lab-validated, and none of the appliance commands were executed while preparing this Fieldnotes draft.

Verify the result

Use observed results to decide whether the intended outcome has been achieved.

If it isn’t working

Use the symptom-specific troubleshooting sections above. Correlate the validation result with Show Events, protocol-specific tests and the saved API/CLI settings. Management validation does not establish end-to-end RADIUS, accounting, CoA or enforcement success.

Video walkthrough