topic Cisco ISE is Missing endpoint IP Address (Managed Forti Switch) in Network Access Control

Cisco ISE is Missing endpoint IP Address (Managed Forti Switch)

dimi.kard — Tue, 26 Nov 2024 14:42:02 GMT

Hello,

In our case we have a fortinet firewall (7.2.8) and about 30 fortiswitches managed by fortinet. We are going to perform eap-tls auth with certificate for 802.1X users & computers and MAB for devices like printers, cameras,phones e.t.c. My issue is that while i am testing the authenticatio & authorization policy MAB devices authenticate & authorize successfully, cisco ise displays devices as connected but is not showing use the ip address of the endpoint device. Any guess why this happens ?

Re: Cisco ISE is Missing endpoint IP Address (Managed Forti Switch)

MHM Cisco World — Tue, 26 Nov 2024 19:45:05 GMT

In cisco SW we use ip helper to forward dhcp traffic into ISE

MHM

Re: Cisco ISE is Missing endpoint IP Address (Managed Forti Switch)

dimi.kard — Tue, 26 Nov 2024 22:23:18 GMT

On same deployment with cisco switches defining ISE as Radius, feeds into ISE endpoint ip addresses (either static or dhcp). I think it has to do with framed ip address avp missing (done packet caputer between fortinet firewall & ISE).

Re: Cisco ISE is Missing endpoint IP Address (Managed Forti Switch)

thomas — Mon, 02 Dec 2024 17:40:55 GMT

Is Fortinet sending the Framed IP Address in the RADIUS Accounting Start message? That's the standard way for the network device to share it. You may need to enable this behavior on the network devices to share this attribute.