Need to configure restriction for non compliant wireless user in ise

[ravina-gurav]

We have FortiGate WLC for wireless user .

After posture scanning if the user is non-compliant we are unable to restrict the access user is getting full access.

We tried from ISE to Push ACL still the restriction is not working.

Wireless user connecting through fortiAP.

Is there any solution we can configure restriction for non-compliant user as fortigate is the NAD device for user.

[Aref Alsouqi]

I've never done it before, so bear with me please. It seems you could do it using RADIUS "NAS-Filter-Rule" attribute as it states here:

Solved: ISE issue :i cannot input any value on Radius:NAS-Filter-Rule - Cisco Community

FortiWiFi and FortiAP Configuration Guide

[ahollifield]

https://cs.co/ise-berg#fortinet 

How is the FortiAP managed? You should pass a User Group attribute if managed by a FortiGate instead.

[ravina-gurav]

Managed By Fortigate.

I am Using AD for user authentication.

[ahollifield]

No one should be using MS-CHAPv2 in 2025. It relies on broken encryption. are you disabling credential guard?

[mary58wilson]

---

@ravina-gurav E-ZPass New Jerseywrote:

We have FortiGate WLC for wireless user .

After posture scanning if the user is non-compliant we are unable to restrict the access user is getting full access.

We tried from ISE to Push ACL still the restriction is not working.

Wireless user connecting through fortiAP.

Is there any solution we can configure restriction for non-compliant user as fortigate is the NAD device for user.

---

The failure to enforce restrictions on non-compliant users via your FortiGate WLC (acting as the NAD) with Cisco ISE is likely due to a **Vendor-Specific Attribute (VSA) or Change of Authorization (CoA) mismatch**. The FortiGate is likely ignoring the ACL pushed by ISE because it doesn't understand the format. The solution requires ensuring **CoA is properly configured and acknowledged** by the FortiGate, and crucially, configuring the **Non-Compliant Authorization Profile in ISE to send a specific Fortinet VSA** (e.g., `Fortinet-Group-Name`) instead of a standard ACL. The FortiGate can then map this received VSA to a local **Firewall User Group** with a restrictive policy.