Preparation
Prepare the networks, addressing, licensing, VMware resources, and firewall access needed to deploy a FortiNAC-F server.
On this page
Before you begin
Confirm each prerequisite before planning changes. Checklist progress is kept for this visit and resets when you reload.
Example environment
Replace or re-use every example with values from your environment. Do not create any networks yet .
| Setting | Example |
|---|---|
| Hostname | nac01 |
| Management FQDN | nac01.corp.example.com |
| port1 VLAN / VMware port group | VLAN 98 |
| port1 network | 192.168.98.0/24 |
| port1 address | 192.168.98.10 |
| Management default gateway | 192.168.98.1 |
| port2 VLAN / VMware port group | VLAN 112 |
| port2 network | 192.168.112.0/24 |
| port2 address | 192.168.112.2 |
| Registration VLAN | 21 |
| Registation network | 192.168.21.0/24 |
| Registration default gateway | 192.168.21.1/24 |
| Upstream DNS servers | 8.8.8.8 |
| Portal FQDN and certificate | Planned portal name and matching certificate |
Prepare the two networks
Create the VLANS on your Fortigate firewall or firewall of choice:
- FortiNAC Port1 FortiNAC uses this interface for administration and communication with managed infrastructure. Create a dedicated network and VLAN for port1 or re-use an existing server network and vlan.
- FortiNAC Port2 Create a dedicated network and VLAN for the registration and isolation design. This interface provides the client-facing connectivity used by the portal and related services.
- Registration VLAN Create a dedicated registration VLAN on your firewall. This VLAN will be used to distribute DHCP addresses to your clients profiled as rogue devices. DHCP Relay should be enabled and set to FortiNAC port2 IP.
Do not place port1 and port2 on the same subnet. Fortinet explicitly identifies that arrangement as unsupported in its VMware deployment instructions. See VMware network settings.
For the example, each VM adapter connects to an ordinary VLAN-backed VMware port group. The VLAN is selected by the port group; the CLI examples do not configure VLAN tagging inside FortiNAC.
Decide who supplies DHCP on the registration network. If FortiNAC supplies it, plan the scopes and any relay configuration. If an external server supplies it, plan the client DNS and portal reachability accordingly. Enabling a listening service alone does not create DHCP scopes or a working captive portal.
Prepare firewall access
Build policies around the connection initiator and the required feature. The table below is a planning baseline, not a requirement to enable every service. Below policies cover NAC<->Network Inventory connectivity. If you know you will require other integrations please prepare firewall policies accordingly(Active Directory, SMTP etc.)
| Source | Destination | Protocol / destination port | Purpose / condition |
|---|---|---|---|
| Admin workstation/network | FortiNAC port1 | TCP/8443 | HTTPS Admin UI |
| Admin workstation/network | FortiNAC port1 | TCP/22 | Optional SSH administration |
| FortiNAC port1 | Network-device management addresses(Firewalls, Switches, APs) | ICMP | Reachability checks |
| FortiNAC port1 | Firewalls, Switches, APs | UDP/161 | SNMP polling where used |
| Network devices | FortiNAC port1 | UDP/162 | SNMP traps where used |
| FortiNAC port1 | Network-device management addresses | TCP/22 | CLI integration where required |
| FortiNAC port1 | Network-device API addresses | TCP/443 or configured admin/API port | HTTPS API integration where required |
| Switches/controllers/authenticators | FortiNAC port1 | UDP/1812 | RADIUS authentication |
| Switches/controllers/authenticators | FortiNAC port1 | UDP/1813 | RADIUS accounting |
| FortiNAC port1 | Switches/controllers/authenticators | UDP/3799, or device-configured CoA port | RADIUS Change of Authorization |
| FortiNAC port1 | Upstream DNS servers | UDP/TCP 53 | Resolve infrastructure and service names |
| FortiNAC port1 | NTP servers | UDP/123 | Time synchronization |
| FortiNAC port1 | Required FortiCloud licensing services | TCP/443 | Subscription entitlement retrieval, where applicable |
| FortiNAC port1 | Required Fortinet update/FortiGuard services | Feature-specific ports and destinations | Match the current CA firewall requirements and enabled features |
| Registration VLAN | FortiNAC port2 | TCP/443; TCP/80 where required | Portal access and applicable HTTP workflow |
| Registration VLAN | FortiNAC port2 | UDP/TCP 53 | DNS when FortiNAC serves isolation DNS |
| Registration VLAN | FortiNAC port2 | UDP/67–68 for the IPv4 DHCP design | Only when FortiNAC supplies DHCP |
| Persistent Agent | FortiNAC port1 and port2 | TCP/4568 | Persistent Agent, according to client reachability |
References: CA firewall requirements, Deployment requirements, Licensing types.
Plan interface services
Firewall policies and FortiNAC interface access are separate controls. set allowaccess selects services that FortiNAC accepts on an interface. It does not enable outbound API, SSH, or SNMP polling on another device.
| Interface | Baseline for these guides | Conditional additions |
|---|---|---|
| port1 | https-adminui ping snmp radius-auth radius-acct nac-agent | ssh if remote CLI administration is required |
| port2 | https http dhcp dns nac-agent ping |
https-adminui serves administration on TCP/8443. https serves the portal on TCP/443. The examples prepare RADIUS, SNMP and agent listeners; those features still require application configuration.
When changing an existing interface, preserve every service still needed: set allowaccess replaces the configured list. If adding a new service use append allowaccess <service>
We will not be implementing all services on the interfaces initially. Services will be added to the interfaces as you go through the guides relating to them.
Reference: FortiNAC access configuration, Interface CLI reference.
Final preparation checklist
Continue with FortiNAC Deployment – VMware.
Verify the result
Use observed results to decide whether the intended outcome has been achieved.
Expected result
If it isn’t working
Change one variable at a time
Video walkthrough
The written guide stands on its own. A companion video can be added after the guide is validated.