topic Re: Need to configure restriction for non compliant wireless user in in Network Access Control

Need to configure restriction for non compliant wireless user in ise

ravina-gurav — Wed, 05 Nov 2025 10:12:42 GMT

We have FortiGate WLC for wireless user .

After posture scanning if the user is non-compliant we are unable to restrict the access user is getting full access.

We tried from ISE to Push ACL still the restriction is not working.

Wireless user connecting through fortiAP.

Is there any solution we can configure restriction for non-compliant user as fortigate is the NAD device for user.

Re: Need to configure restriction for non compliant wireless user in

Aref Alsouqi — Wed, 05 Nov 2025 11:22:04 GMT

I've never done it before, so bear with me please. It seems you could do it using RADIUS "NAS-Filter-Rule" attribute as it states here:

Solved: ISE issue :i cannot input any value on Radius:NAS-Filter-Rule - Cisco Community

FortiWiFi and FortiAP Configuration Guide

Re: Need to configure restriction for non compliant wireless user in

ahollifield — Wed, 05 Nov 2025 15:18:35 GMT

https://cs.co/ise-berg#fortinet

How is the FortiAP managed? You should pass a User Group attribute if managed by a FortiGate instead.

Re: Need to configure restriction for non compliant wireless user in

ravina-gurav — Thu, 06 Nov 2025 06:21:00 GMT

Managed By Fortigate.

I am Using AD for user authentication.

Re: Need to configure restriction for non compliant wireless user in

mary58wilson — Thu, 06 Nov 2025 07:59:39 GMT

@ravina-gurav E-ZPass New Jerseywrote:
We have FortiGate WLC for wireless user .
After posture scanning if the user is non-compliant we are unable to restrict the access user is getting full access.
We tried from ISE to Push ACL still the restriction is not working.
Wireless user connecting through fortiAP.
Is there any solution we can configure restriction for non-compliant user as fortigate is the NAD device for user.

The failure to enforce restrictions on non-compliant users via your FortiGate WLC (acting as the NAD) with Cisco ISE is likely due to a **Vendor-Specific Attribute (VSA) or Change of Authorization (CoA) mismatch**. The FortiGate is likely ignoring the ACL pushed by ISE because it doesn't understand the format. The solution requires ensuring **CoA is properly configured and acknowledged** by the FortiGate, and crucially, configuring the **Non-Compliant Authorization Profile in ISE to send a specific Fortinet VSA** (e.g., `Fortinet-Group-Name`) instead of a standard ACL. The FortiGate can then map this received VSA to a local **Firewall User Group** with a restrictive policy.

Re: Need to configure restriction for non compliant wireless user in

ahollifield — Thu, 06 Nov 2025 13:50:33 GMT

No one should be using MS-CHAPv2 in 2025. It relies on broken encryption. are you disabling credential guard?

Re: Need to configure restriction for non compliant wireless user in

ravina-gurav — Mon, 10 Nov 2025 05:42:50 GMT

Is there any reference link to implement this solution.

We have configure AD as identity source on ISE for authentication .

Then how we can call group from fortigate is it will initiate authentication again?

Re: Need to configure restriction for non compliant wireless user in

Ben Weber — Mon, 10 Nov 2025 06:17:39 GMT

As said further up in the thread, you need to import the Fortinet VSAs into ISE as a dictionary. You can find the VSAs here: Fortinet RADIUS vendor-specific attribute... - Fortinet Community

To quote the process of importing Fortinet VSAs into ISE from this post (all credits to original author): Solved: Fortigate authorization with ISE - Cisco Community

1) Navigate to Policy > Policy Elements > Dictionaries

2) In the Dictionaries left panel, choose System > RADIUS > RADIUS Vendors

3) You should see a list of RADIUS Vendors that does not include Fortinet

4) Select Import

5) Browse... for the Fortinet_VSAs.txt file then click the Import button and acknowledge the dialog to import the file. (Note: You will have to create this file or copy it from the linked post).

6) You should now see Fortinet in the RADIUS Vendors list:

and all of the Fortinet attributes listed under the Dictionary Attributes tab: