Appliance Installation

Before you begin

Confirm each prerequisite before planning changes. Checklist progress is kept for this visit and resets when you reload.

1Configuration

Note: For this deployment we are using VMware as a hypervisor and such the documentation will be for VMware. If you are using a different hypervisor please seek out the relevant documentation.

2Register the product and download the image

1. Sign in to the Fortinet support portal.
2. Register your FortiNAC-F contract - Do not enter UUID or MAC. We will do this later.
3. Open Support → Firmware Download, or the corresponding firmware download area in the current portal.
4. Select FortiNAC-F.
5. Select the intended release and VMware deployment image for the combined CA server.
6. Download and extract the deployment package if required.

Use the image for the deployment platform, rather than an upgrade-only package. While it downloads, verify the two port groups and available datastore capacity.

Reference: Download the virtual machine.

3Deploy the template and inspect the hardware

1. In vCenter or the ESXi Host Client, start Deploy OVF Template or Deploy a virtual machine from an OVF or OVA file.
2. Select the downloaded template and its companion files where required.
3. Choose the VM name, target host, datastore, and deployment options.
4. Map the first adapter to the port group dedicated to port1 and the second adapter to the port group dedicated to port2.
5. Size the VM according to the below table

1. Complete deployment and inspect the VM settings before configuration.

References: Import the VM, Edit settings, Sizing guidance.

4Log in through the console

1. Power on the VM and open its VMware console.
2. Allow the initial boot to complete.
3. Log in to the fresh appliance using admin with a blank password.
4. Set a new CLI password when prompted.

Reference: Assign the management address.

5Configure basic management access on port1

Configure the management address and the https access.

config system interface
    edit port1
        set ip 192.168.98.10
        set allowaccess https-adminui ping
    next
end

If SSH administration is required, include ssh in the complete list:

config system interface
    edit port1
        set allowaccess https-adminui ssh ping
    next
end

https-adminui enables administration on TCP/8443. The https option is for the portal and is not required for this management-only setup.

Do not configure port2 - This will be done in a later guide.

Reference: Interface CLI.

6Configure the management default route

On a fresh appliance, configure the default route through the port1 gateway:

config router static
    edit 1
        set dst 0.0.0.0/0
        set gateway 192.168.98.1
        set device port1
    next
end

Reference: Route CLI.

7Validate FortiNAC Connectivity

Pint the management gateway and a permitted internet service.

execute ping 192.168.98.1
execute ping <internet service>

ICMP results are useful only when those destinations allow ping. A successful ping does not prove HTTPS access or license validation, and a Fortinet service may not answer ICMP.

8Validate NAC HTTPS access

From your client, access your FortiNAC management IP from your prefered browser.

https://192.168.98.10:8443

Expected result: TCP/8443 is reachable after services finish starting.

9Start the first-time setup

Browse to:

https://192.168.98.10:8443

For a fresh installation, the documented first-time GUI credentials are:

Accept the EULA when presented. A fresh appliance may present its initial certificate; verify that you are connecting to the intended appliance. Continue to the license page and record the displayed VM UUID and port1 MAC address.

Reference: Generate and download keys.

10Generate and import the license

1. Return to the Fortinet support portal and open the registered FortiNAC appliance.
2. Enter the VM UUID and port1 MAC address.
3. Check the identifiers carefully before saving. Details can only be changed by opening a support ticket.
4. Generate and download the appliance's .lic file.
5. Return to the FortiNAC setup wizard and import the file.

If you already have a license generated for this exact appliance identity, import that file directly.

References: License-file workflow, License types.

11Create credentials and complete Manual installation

1. Create the new GUI administrator credentials when prompted after the license stage.
2. The wizard offers to clone credentials to the CLI, choose that option deliberately or retain separate CLI credentials. Record which accounts apply to each interface.
3. Select Manual installation, rather than Guided installation.
4. Complete the basic network settings: hostname, management addressing, gateway, DNS servers, and the relevant time settings.
5. Select None for Network Type for now - This will be configured in a seperate guide.
6. Review the summary and click Apply.
7. Use the wizard's Reboot action when requested to finish the configuration.
8. Allow startup to complete, then log in with the new administrator account.

Selecting None here completes a basic, barebones deployment without configuring isolation networks.

References: First GUI access, Appliance configuration workflow

12Final deployment verification

If entitlements are missing or incorrect, compare the appliance's displayed identity and portal registration with the license. A persistent process-down condition can be associated with a UUID/MAC mismatch and should be investigated rather than repeatedly rebooted.

Reference: Appliance configuration and entitlement checks.

The VM deployment and basic management configuration are complete.

Planned next guide: FortiNAC – Layer 3 Registration and Portal Configuration. It will cover selecting Layer 3, configuring port2, registration/isolation addressing and scopes, DHCP/DNS integration, portal certificates, and portal validation. That guide has not yet been created. Network-device modeling, RADIUS, profiling, agents, and enforcement are subsequent configuration tasks.

13Troubleshooting

Verify the result

Use observed results to decide whether the intended outcome has been achieved.

If it isn’t working

Use the symptom-specific Troubleshooting table in this guide.

Video walkthrough