topic Re: Cisco ISE and Fortinet in Network Access Control

Cisco ISE and Fortinet

Davion Stewart — Mon, 17 Dec 2018 15:23:33 GMT

Good day,

Is there any official support for integrating ISE with fortigate/FortiAPs?

Want to know the possibility of using ISE as the RADIUS server to authenticate wireless users using fortiAPs.

Re: Cisco ISE and Fortinet

Timothy Abbott — Mon, 17 Dec 2018 15:29:01 GMT

It depends on how you want them to integrate with ISE. ISE is a standards-based RADIUS server. Chances are good that basic 802.1X authentication will work. However, if you are looking to integrate for use cases such as BYOD then you will most likely have to figure out if they support RADIUS CoA and URL-Redirect. You can also explore using a NAD profile.

Regards,

-Tim

Re: Cisco ISE and Fortinet

Davion Stewart — Mon, 17 Dec 2018 15:49:06 GMT

Oh ok thanks alot for the reply.

That's some good information

Do you know if there are any official documentation to refer to customers that are interested in doing this type of integration.

Re: Cisco ISE and Fortinet

Jason Kunst — Mon, 17 Dec 2018 16:01:13 GMT

There is no official documentation, please check with fortigate as well

https://www.google.com/search?q=ise+fortinet+integration&oq=ise+fortinet+integration&aqs=chrome..69i57j0j69i64.5112j1j7&sourceid=chrome&ie=UTF-8

Also look into using our auth vlan if redirection is not an option for byod/guest where needed
https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01001.html#concept_CDD87F6FE3A54351B27FF35316A23DA3

Some other links
https://community.cisco.com/t5/security-documents/does-ise-support-my-network-access-device/ta-p/3650231
https://community.cisco.com/t5/security-documents/ise-community-resources/ta-p/3621621#Deploy

http://cs.co/ise-guides
check fortigate

Re: Cisco ISE and Fortinet

Timothy Abbott — Mon, 17 Dec 2018 18:03:13 GMT

We don’t have anything specific for integrating the two systems. Are official documentation on ISE and RADIUS standards can be found in the ISE compatibility matrix.

Regards,
-Tim

Re: Cisco ISE and Fortinet

Davion Stewart — Mon, 17 Dec 2018 18:23:49 GMT

Ok cool thanks alot.

Will check the links.

Re: Cisco ISE and Fortinet

Davion Stewart — Mon, 17 Dec 2018 18:24:33 GMT

Got you,

thanks much for the reply.

Re: Cisco ISE and Fortinet

johan.loven — Mon, 18 Feb 2019 07:18:50 GMT

did you ever get this to work?

Re: Cisco ISE and Fortinet

AdamF1 — Tue, 24 Dec 2019 16:25:01 GMT

I am also curious if you ever got this to work and what dictionary set you used?

Re: Cisco ISE and Fortinet

Davion Stewart — Thu, 16 Apr 2020 16:56:55 GMT

Hi guys,

Unfortunately i was unable to configure/test out this kind of implementation. Has anyone been able to?

Re: Cisco ISE and Fortinet

AdamF1 — Wed, 12 Aug 2020 03:13:15 GMT

After working with TAC and fortinet support I was able to get this to work for 802.1x authentications.

Re: Cisco ISE and Fortinet

eiver_fori — Thu, 26 Nov 2020 22:46:03 GMT

Hi AdamF1,I wish you are very well.

Could you share the configuration that was done so that everything works correctly.

I thank you

Re: Cisco ISE and Fortinet

AdamF1 — Mon, 30 Nov 2020 14:31:23 GMT

Create a new device profile for Fortinet controller and apply the appropriate protocols and conditions to 802.1x and MAB.

-MAB- IEEE 802.11 and call check

-802.1x- IEEE 802.11

Build out the controller in network devices and apply the profile.

Depending on your policies you may need to build out a new one that sits above it as authentication may continue to try and use it and fail. You can make it unique by setting it to something like call-station id ( mac address of controller), this way only devices utilizing it will hit the policy. Just be careful when editing your global policy sets and conditions you create as you could impact your current authentications.

Re: Cisco ISE and Fortinet

jcayetano-securesoft — Thu, 19 Dec 2024 12:16:12 GMT

Hello Team Support,

I have achieved the integration of Cisco ISE and Fortigate and can be integrated to authenticate with EAP-TLS via cable and wifi.

However, there are many difficulties in the guest portal. This is done with CWA and LWA and is not functional.

In some cases the web portal is loaded and in addition it does not appear on the web portal.

Did you experience how it works? This official Fortigate document is, if possible, but you may have problems replicating your configuration.

These are cases with some supports from both Cisco and Fortinet so that I can help me solve this problem.

Quedo attento.

Greetings
Jesus Cayetano

Re: Cisco ISE and Fortinet

sandesh-dhuri — Fri, 23 May 2025 12:18:53 GMT

Can posture will work with Forti APs wireless ?