NSE5_FNC_AD_7.6 Fortinet NSE 5 - FortiNAC-F 7.6 Administrator Question and Answers

In a corporate domain environment where "enhanced endpoint visibility" is required, thePersistent Agentis the recommended choice. Unlike the Dissolvable Agent, which is temporary and intended for one-time compliance scans during registration, the Persistent Agent is an "install-and-stay-resident" application.

The Persistent Agent is specifically designed to be distributed through automated enterprise methods, includinglogin scripts, Group Policy Objects (GPO), or third-party software management tools. When deployed via a login script, the agent can be configured to silently install and immediately begin communicating with the FortiNAC-F service interface. Once active, it provides continuous visibility by reporting host details such as logged-on users, installed applications, and adapter information. It also listens for Windows session events (logon/logoff) to trigger automatic single-sign-on (SSO) registration in FortiNAC-F, ensuring that as soon as a user connects to the domain, their device is identified and assigned the correct network access policy.

"The Persistent Agent can be distributed to Windows domain machines vialogin scriptor by any other software distribution method your organization might use. The Persistent Agent remains installed on the host at all times. Once the agent is installed it runs in the background and communicates with FortiNAC at intervals established by the FortiNAC administrator." —FortiNAC-F Administration Guide: Persistent Agent Overview.

In FortiNAC-F, theInventory topologyuses specific icons to represent the status and model of discovered network infrastructure. When a switch or other network device is discovered via SNMP, FortiNAC-F retrieves itsSystem ObjectID (sysObjectID)to identify the specific make and model. This OID is then compared against the internal database of supported device mappings.

Aquestion mark (?)icon appearing on a discovered switch indicates that while the discovery process successfully communicated with the device (meaning SNMP credentials were correct), theSNMP ObjectID is not recognizedor mapped in the current version of FortiNAC-F. This essentially means the device is "unsupported" by the current software out-of-the-box. Because the OID is unknown, FortiNAC-F does not know which CLI or SNMP command set to use for critical functions like L2 polling (host visibility) or VLAN switching (enforcement). To resolve this, an administrator can manually "Set Device Mapping" to a similar existing model or a "Generic SNMP Device" if only basic L3 visibility is required.

"Discovered devices displaying a'?' iconindicate the currently running version does not have a mapping for that device'sSystem OID(device is not supported). Device mappings are used to manage the device by performing functions such as L2/L3 Polling, Reading, and Switching VLANs." —Fortinet Technical Tip: Options for devices unable to be modeled in Inventory.

In FortiNAC-F, theSecurity Incidentsengine is used to automate responses to security threats reported by external devices. When an administrator wants to enforce a policy, such as quarantining contractors who access restricted websites, they must create aSecurity Rule. A Security Rule acts as the "if-then" logic that correlates incoming security data with the internal host database.

The documentation specifies that a Security Rule consists of three primary configurable components:

User/Host Profile:This identifieswhoorwhatthe rule applies to (in this case, "Contractors").

Trigger:This is theeventthat initiates the rule evaluation. In this scenario, the Trigger would be configured to match specific syslog messages or NetFlow data indicating access to prohibited websites. Triggers use filters to match vendor-specific data, such as a "Web Filter" event from a FortiGate.

Action:This defineswhathappens when the Trigger and User/Host Profile are matched. For this scenario, the administrator would select a "Quarantine" action, which instructs FortiNAC-F to move the endpoint to a restricted VLAN or apply a restrictive ACL.

While "Methods" (A) relate to authentication and "Security Strings" (E) are used for specific SNMP or CLI matching, they are not the structural components of a Security Rule in the Security Incidents menu.

"Security Rules are used to perform a specific action based on certain criteria... To configure a Security Rule, navigate toLogs > Security Incidents > Rules. Each rule requires aTriggerto define the event criteria, anActionto define the automated response (such as Quarantine), and aUser/Host Profileto limit the rule to specific groups." —FortiNAC-F Administration Guide: Security Rules and Incident Management.

In FortiNAC-F, theConference Manageris a specialized administrative role designed for delegated administration, often used by receptionists or event organizers to create temporary guest accounts. To maintain security and prevent the over-provisioning of credentials, FortiNAC-F allows for granular restrictions on these accounts.

According to theFortiNAC-F Administration GuideregardingAdministrative Profiles, when an administrator creates a profile for a Conference Manager, they can define specific "Account Limits." Under the profile settings (located inSystem > Settings > Admin Profiles), there is a field specifically for"Max Accounts."By entering "30" into this field, the administrator ensures that any user assigned to this profile cannot exceed 30 active conference accounts at any given time.

This setting is distinct from the Portal configuration or the Guest templates. While templates define thetypeof account (e.g., duration and access level), theAdministrative Profiledefines thecapabilities and limitationsof the person creating those accounts. This ensures that even if a guest template allows for unlimited registrations, the specific administrator is physically restricted by the system from generating more than the allotted 30.

"Administrative Profiles define what an administrator can see and do within the system. For delegated administration roles like the Conference Manager, the'Max Accounts'field in the Administrative Profile is used to specify the maximum number of accounts the user is permitted to create. Once this limit is reached, the user will be unable to generate additional accounts until existing ones expire or are deleted." —FortiNAC-F Administration Guide: Administrative Profiles and Delegated Administration.

When FortiNAC-F manages VPN clients through a FortiGate, the agent plays a fundamental role in device identification that standard network protocols cannot provide on their own. In a standard VPN connection, the FortiGate establishes a Layer 3 tunnel and assigns a virtual IP address to the client. While the FortiGate sends a syslog message to FortiNAC-F containing the username and this assigned IP address, it typically does not provide the hardware (MAC) address of the remote endpoint's physical or virtual adapter.

FortiNAC-F relies on theMAC addressas the primary unique identifier for all host records in its database. Without the MAC address, FortiNAC-F cannot correlate the incoming VPN session with an existing host record to apply specific policies or track the device's history. By running either a Persistent or Dissolvable Agent, the endpoint retrieves its own MAC address and communicates it directly to the FortiNAC-F service interface. This allows the "IP to MAC" mapping to occur. Once FortiNAC-F has both the IP and the MAC, it can successfully identify the device, verify its status, and send the appropriateFSSO tagsor group information back to the FortiGate to lift network restrictions.

Furthermore, while the agent can also perform compliance checks (Option D), the architectural requirement for the agent in a managed VPN environment is primarily driven by the need for session data correlation—specifically the collection of the IP and MAC address pairing.

"Session Data Components: • User ID (collected via RADIUS, syslog and API from the FortiGate). • Remote IP address for the remote user connection (collected via syslog and API from the FortiGate and from the FortiNAC agent). •Device IP and MAC address (collected via FortiNAC agent).... The Agent is used to provide the MAC address of the connecting VPN user (IP to MAC)." —FortiNAC-F FortiGate VPN Integration Guide: How it Works Section.

FortiNAC-F serves as a central manager for security events originating from a diverse ecosystem of third-party security appliances, such as FortiGate, Check Point, and Cisco. Each vendor utilizes its own internal scale forseverity levelswithin syslog messages (e.g., Check Point uses a 1–5 scale, while others may use 0–7). To provide a consistent response regardless of the source, FortiNAC-F usesSeverity Mappingsto normalize these incoming values.

According to theFortiNAC-F Administration Guide, severity mappings allow the administrator to translate vendor-specific threat levels into standardizedFortiNAC Security Levels(such as High, Medium, or Low Violation). When a syslog message arrives, the parser extracts the vendor's severity code, and the system immediately references theSecurity Event Severity Level Mappingstable to determine how that event should be categorized internally. This normalization is vital because it allows a singleSecurity Alarmto be configured to respond to any "High Violation" event, whether it was reported as a "Critical" by one vendor or a "Level 5" by another. Without these mappings, the administrator would have to create separate, redundant security rules for every vendor to account for their different naming conventions and numerical scales.

"Each vendor defines its own severity levels for syslog messages. The following table shows the equivalent FortiNAC security level... To normalize these events, configure theSeverity Level Mappingsfound in the device integration guides. This allows FortiNAC to generate a consistent security event that can then trigger an alarm regardless of the reporting vendor's specific terminology." —FortiNAC-F Administration Guide: Vendor Severity Levels and Syslog Management.