FortiNAC Network Authentication Configuration Review
Budget: $30 – $250 USD
We are working on an 802.1X / EAP-TLS deployment using FortiNAC (9.x), FreeRADIUS (running on the FortiNAC appliance), and Extreme Networks EXOS switches. Authentication works successfully, but the wrong VLAN (ID 15) is being assigned to domain-joined Windows machines during 802.1X authentication.
We can see from the FreeRADIUS logs that FortiNAC’s REST API (/api/v2/radius/post-auth) returns:
Tunnel-Type = VLAN
Tunnel-Private-Group-Id = "15"
Tunnel-Medium-Type = IEEE-802
However, VLAN 15 is not defined in any access policy, host configuration, or default NAC settings, and should not be used. The goal is to identify where this VLAN ID is coming from within FortiNAC and correctly assign VLANs based on the authentication context (e.g., domain computers, users, or device groups).
Scope of Work:
Review FortiNAC → FreeRADIUS → EXOS integration (EAP-TLS setup).
Locate and fix the incorrect VLAN assignment (currently VLAN 15).
Ensure proper VLANs are applied based on device certificates or host groups.
Verify dynamic VLAN assignment via RADIUS works as expected on EXOS.
(Optional) Clean up any redundant default NAC policies or fallback profiles causing the issue.
Environment:
FortiNAC version: 9.4.x
Switches: Extreme Networks EXOS (S5570S-28S-HPWR-EI-A)
Authentication: 802.1X EAP-TLS (certificate-based)
Clients: Windows computers
Requirements:
Chat GPT experience is not enough!
Experience with FortiNAC (fluent)
Knowledge of RADIUS, EAP-TLS and EXOS NAC/NetLogin.
Ability to troubleshoot RADIUS REST integrations and policy chains in FortiNAC.
Access to logs and configuration excerpts can be provided (no sensitive data).
Remote SSH session or screen-share can be arranged if needed.
We can see from the FreeRADIUS logs that FortiNAC’s REST API (/api/v2/radius/post-auth) returns:
Tunnel-Type = VLAN
Tunnel-Private-Group-Id = "15"
Tunnel-Medium-Type = IEEE-802
However, VLAN 15 is not defined in any access policy, host configuration, or default NAC settings, and should not be used. The goal is to identify where this VLAN ID is coming from within FortiNAC and correctly assign VLANs based on the authentication context (e.g., domain computers, users, or device groups).
Scope of Work:
Review FortiNAC → FreeRADIUS → EXOS integration (EAP-TLS setup).
Locate and fix the incorrect VLAN assignment (currently VLAN 15).
Ensure proper VLANs are applied based on device certificates or host groups.
Verify dynamic VLAN assignment via RADIUS works as expected on EXOS.
(Optional) Clean up any redundant default NAC policies or fallback profiles causing the issue.
Environment:
FortiNAC version: 9.4.x
Switches: Extreme Networks EXOS (S5570S-28S-HPWR-EI-A)
Authentication: 802.1X EAP-TLS (certificate-based)
Clients: Windows computers
Requirements:
Chat GPT experience is not enough!
Experience with FortiNAC (fluent)
Knowledge of RADIUS, EAP-TLS and EXOS NAC/NetLogin.
Ability to troubleshoot RADIUS REST integrations and policy chains in FortiNAC.
Access to logs and configuration excerpts can be provided (no sensitive data).
Remote SSH session or screen-share can be arranged if needed.