Ethernet 802.1X configuration – Fortinet FortiSwitch

In this topic, you will learn how to configure Fortinet FortiSwitch switches to work together with Portnox™ Cloud and 802.1X RADIUS authentication for wired Ethernet connections.

Important:

This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.

Important:

All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.

FortiSwitchOS 7.2.8 (console)

In this section, you will learn how to configure Fortinet FortiSwitch 7.2.8 switches using the console to work together with Portnox™ Cloud and 802.1X RADIUS authentication for Ethernet connections.

Warning:

This configuration was developed on the basis of the official FortiSwitchOS 7.2.8 administration guide. Please refer to the official Fortinet documentation for any further information.

Important:

Define the Portnox Cloud RADIUS servers.

Define the Portnox Cloud US RADIUS server for authentication and accounting.

config user radius
  edit "Portnox Cloud RADIUS US"
    set addr-mode ipv4                               
    set server 20.119.69.248
    set radius-port 10322
    set secret rTHO9HEo9BcqfC9Yg0hHFelK6o0tH8N1
    set auth-type auto
    config acct-server
      edit 1
        set status enable
        set server 20.119.69.248
        set secret rTHO9HEo9BcqfC9Yg0hHFelK6o0tH8N1
        set port 10323
      next
    end
  next
end

Define the Portnox Cloud EU RADIUS server for authentication and accounting.

config user radius
  edit "Portnox Cloud RADIUS EU"
    set addr-mode ipv4                               
    set server 52.232.122.157
    set radius-port 10476
    set secret fnSrSEHhXFZ5Rqpz756NJhkeVqIHTlPt
    set auth-type auto
    config acct-server
      edit 2
        set status enable
        set server 52.232.122.157
        set secret fnSrSEHhXFZ5Rqpz756NJhkeVqIHTlPt
        set port 10477
      next
    end
  next
end

Create a user group that includes both Portnox Cloud RADIUS servers.

config user group
  edit "Portnox Cloud RADIUS group"
    set member "Portnox Cloud RADIUS US" "Portnox Cloud RADIUS EU"
  end
end

Configure port security based on the group that you just created.

config switch interface
  edit "port1"
    set allowed-vlans 1
    config port-security
      set port-security-mode 802.1X
    end
    set security-groups "Portnox Cloud RADIUS group"
  end
end

Optional: Configure the multi-host or multi-domain mode.

For multi-host mode:

config switch-controller managed-switch
  edit S548DF3Z00012345
    config ports
      edit port1
        set security-mode 802.1X
        set dot1x-ports-mode multi-host
        set nac lan-segment 30
      next
    end
  next
end

For multi-domain mode:

config switch-controller managed-switch
  edit S548DF3Z00012345
    config ports
      edit port1
        set security-mode 802.1X
        set dot1x-ports-mode multi-domain
        set voice-vlan 30
        set nac lan-segment 20
      next
    end
  next
end