Professional Documents
Culture Documents
FortiNAC-9 4 0-Release - Notes
FortiNAC-9 4 0-Release - Notes
Version 9.4.0.0717
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
NSE INSTITUTE
https://training.fortinet.com
FORTIGUARD CENTER
https://fortiguard.com/
FEEDBACK
Email: [email protected]
Version 9.4.0 is the latest release being made available to customers to provide functionality and address some
known issues.
Important
l 9.1.0+ uses a new GUI format. FortiNAC cannot go backwards to a previous version. Snapshots should
always be taken on virtual appliances prior to upgrade.
l Prior to upgrade, review the FortiNAC Known Anomalies posted in the Fortinet Document Library.
l If using agents or configured for High Availability, additional steps may be required after upgrade for
proper functionality. See Upgrade Instructions and Considerations posted in the Fortinet Document
Library.
l Requires CentOS 7.4 or higher. The current CentOS version installed is listed as "Distribution" in the CLI
login banner or typing "sysinfo".
Example:
> sysinfo
************************************************************************
Recognized platform: Linux
Distribution: CentOS Linux release 7.6.1810 (Core)
If the CentOS version is below 7.4, run OS updates and reboot before upgrading. For instructions on
updating CentOS, refer to the Fortinet Document Library.
l For upgrade procedure, see Upgrade Instructions and Considerations posted in the Fortinet Document
Library.
Supplemental Documentation
Version Information
These Release Notes contain additional Enhancements, Device Support, and features. Unique numbering is
used for the various components of the product. The software version and Agent version supplied with this
release are listed below.
Version:9.4.0.0717
Agent Version:9.4.0
A newer Persistent Agent may be required to support certain antivirus and anti-spyware products. Refer to the
Agent Release Notes in the Fortinet Document Library.
Firmware version represents a collection of system services and operating system features imaged on to the
appliance before it leaves manufacturing. The firmware image cannot be updated by a Fortinet customer.
Services within the image are updated by Fortinet or a certified Fortinet Partner in appliance maintenance
packages released as new more robust and secure versions of services become available.
Note that upgrading software versions does not change firmware nor does it automatically require an upgrade
to the Persistent Agent. Newer Persistent Agents are not compatible with older software versions unless that
capability is specifically highlighted in the corresponding release notes.
Compatibility
FortiNAC Product releases are not backwards compatible. It is not possible to go from a newer release to any
older release.
Example: 9.4.0.0171 cannot be downgraded to any other release.
To backup the current system prior to upgrade on virtual machines, perform a snapshot. For physical
appliances refer to the document Back Up and Restore an Image of a FortiNAC Appliance.
Agents
FortiNAC Agent Package releases 5.x are compatible with FortiNAC Product release 9.x. Compatibility of
Agent Package versions 4.x and below with FortiNAC versions 9.x are not guaranteed.
Many of the views in FortiNAC are highly dependent on JavaScript. The browser used directly impacts the
performance of these views. For example, the new Host view in one browser may take 2 seconds to load, but
the same view in a different browser may take 20 seconds. To improve performance, it is recommended that
you choose a browser which is fast at processing JavaScript, such as, Google Chrome. Articles on comparing
the performance of various web browsers are freely available on the internet. Some performance sites include:
l http://legitreviews.com/article/1347/1/
l http://w-shadow.com/blog/2010/04/20/web-browser-performance-comparison/
l http://sixrevisions.com/infographs/browser-performance/
l http://w-shadow.com/blog/2010/11/03/browser-performance-comparison/
If your browser is not optimized for processing JavaScript, you may see an error message display when
accessing a view that uses JavaScript. The message will vary depending on your browser.
Example:
iOS for iPad iOS for iPhone iOS for iPod Linux
New Features
Feature Description
782301 The information displayed in the Connections and Port Changes views are
758840 now combined under Network > Network Events.
785021
785317
615850 Top Host Connection Activity Dashboard Widget. Displays the hosts with
758851 the most connection activity over a configurable period of time.
786342
786363
786382
615850 Host VLAN Changes Dashboard Widget. Displays all Hosts that had access
758840 to each Logical Network over a configurable period of time.
758841
760607
These changes have been made in FortiNAC Version 9.4.0. These enhancements are in addition to the
enhancements that are outlined in previous releases.
Version 9.4.0
Ticket # Description
692446 Added Preserve Port Names option to update port names when changed at
the switch. Option can be modified at the switch and global level. See
Device properties and Network device in the administration Guide for more
information.
709286 New UI menu to download log files for troubleshooting. See Download
logs in the 9.4 Administration Guide.
726333 Entitlements (such as concurrent licenses) for Subscription Licenses are
not accurately reflected in the Administration UI License Management view
and only show Base licenses.
733943 Changing password in bulk using Set Model Configuration sets the same
username for all selected devices.
747921 Portal renaming does not rename the associated CSS files.
752941 GUI option to select the RADIUS MAC delimiter for Juniper Switches
756167 RADIUS view sort by Winbind column fails, shows empty table.
756499 MicroSoft InTune MDM integration does not support latest API.
759018 Admin user with admin user profile permissions to Access, Add/Modify and
delete "Users" is unable to create a new regular user.
762071 Radius Auth/EAP Type columns empty in Network > Device > Ports >
Adapters table.
Ticket # Description
770208 Juniper switches fail to change VLAN on ports that are RADIUS enabled.
770974 Event Lifetime alarm trigger rule is not being honored when configured.
773828 Not polling L2 information from PNetworks switches with latest firmware.
779414 Client filter for User Accounts, Hosts, and Adapters not functioning properly
rewrite of OmniSources.
781520 RADIUS COA failing for FortiAP when hosts are deleted.
782418 Hide Accepted Requests Enabled and click on Expand Widget - Widget
shows Accept Requests
782740 Unable to read default and current vlans for Ruijie switches.
782760 Huawei S7706 switch is not reflecting the interface port number correctly in
Ticket # Description
783552 NAC service not running at startup when no IP address is configured for
eth0. This causes "Processes Down" to display in UI.
784346 RADIUS Reject doughnut is not centered if filter does not include any reject
counts.
784618 RADIUS Failures after upgrading from 8.5 to 8.8 due to bad secret.
785367 RADIUS GroupName - Group Members list does not show all members.
785438 A None/Use Default option has been added to Users Dialog > Mobile
Providers.
786277 RADIUS Group - Exception when user group already exists with Type non-
User.
786434 Allow changing CLI Passwords from Secondary and FNAC-A systems.
786670 Exception thrown when loading Logical Network Host Access tile.
786744 User Accounts view > create user is not passing password as encoded, and
will not match auth requests.
786751 Distinguished Name (DN) can now be used in User view filters.
786785 Not able to add ciphers under RADIUS > TLS config page.
787271 Certificate Management View - Server Certs & Trusted Certs views both
showing results from both views.
Ticket # Description
787563 Fix null pointer exception during SNMP read of Meraki L2.
787584 Logical Network Host Access host info slider not displaying info.
788066 Server startup delayed by incorrect thread start logic on Network Session
Event updater.
788089 RADIUS service will not start after upgrade to 9.2 if winbind is not fully
configured.
788119 Network Events table does not show totals for Event Type column.
788849 New dashboard tiles relating to Connections were incorrectly not masking
the background.
789018 Service Connectors > REST SMS Gateway > The required fields should be
the same in create and edit page
789061 Service Connectors > REST SMS Gateway > HTTPs Toggle is not working
expectedly when API URL is specified with https.
Ticket # Description
789309 Filtering on the column Type does not work on Network Events.
789316 Deleting multiple User Accounts in a row does not delete all user in table.
789396 Service Connectors > REST SMS Gateway > Overview: Cant tell which
REST SMS Gateway is set as default.
789763 When changing the date via the Settings tile, Recent Hosts tile date range
not updating properly.
789865 Network > Service Connectors > REST SMS Gateway: The default gateway
is not working when the mobile provider is None.
790580 Network > Service Connectors > REST SMS Gateway: Security Incidents of
a host doesn't trigger the corresponding SMS.
790747 FGT interface with VLANs does not show device connections to VLAN sub
interfaces for traps.
790854 Failure to properly read Cisco trunk ports results in undesired VLAN
switching.
790904 Creating new user as non-admin hangs retrieving Role dropdown values.
791276 Clicking EULA Link When Logging In As New User Goes To Broken Link.
791327 FortiNAC is changing WAP Uplink ports Current VLAN to match the Default
VLAN.
791841 Edit Host Dialog > Device Type is not reading/writing the correct value.
792514 A remote unauthorized user can gain the version of the Tomcat used by
FortiNAC by sending an HTTP GET request.
Ticket # Description
794036 User Record values must be populated automatically if the user exists in an
Active Directory or an NCM.
794791 Admin user is brought to the last-viewed page when logging in to UI instead
of designated Landing page.
794937 The Recent Hosts widget is not displaying addtional host info when clicking
counts.
795243 Portal - Request Processing Rules: Text at edge of window for Auto
Configure and Publish.
795260 Local RADIUS Server not returning proxy-state attribute in Access Accept
for Motorola/Extreme Networks WiNG VX 9000.
795260 Motorola controllers proxying AP auth requests send Proxy-State attr and
expect it unchanged in response. RADIUS (local) does not send it back.
795623 Log output from Windows Profile method when parsing fails.
796065 Unable to set device profiling to Host to Logged in User (if Present) on
NCM.
796145 Guest and Contractors > Select one and View > send SMS throws a null
pointer exception.
796259 In Pending Tasks page, tasks are allowed to be completed, even if their
parent task is incomplete.
796659 Host information does not display when clicking "Total Count" on Persistent
Agent Summary widget.
Ticket # Description
796663 Setting option for Persistent Agent System Page is not allowing to toggle
between visualizations.
796908 Clicking the number in the Logical Network Host Access tile does not open
the hosts slide.
796965 Network Device Summary widget not showing complete switches and
Wireless AP counts.
797439 Host > Edit Host > Cannot change the Role or manually Register as Device.
797919 Network > Service Connector > REST SMS: All of the SMS sent out using
the default SMS Gateway even when the mobile provider is set.
798181 RADIUS Service Host MAC filter does not print debug if supplicant does not
use colon mac delimiter.
798234 Rejected Hosts view in RADIUS Activity tab doesn't properly filter table
results to exclude a specific reject cause.
798511 Upgrading from 0159 to 0160 results in error: Access denied for user
nac@localhost (using password: NO).
798651 Can not access RADIUS Activity view if user has "Activity" but not "Local
Service" RADIUS view permissions.
798665 REST SMS Gateway: In Captive network > Guest Self Registratiion page,
when Mobile Provider=None, the SMS is not sent.
800323 Policy name in Admin Profile > Permissions are not consistent with policy
name in Policy & Object.
800408 API query for FLink FSW data deprecated in FOS 7.2+.Prevents
FortiSwitches in Link mode from being added to Inventory when the
managing FortiGate is discovered.
800811 User with permission for access users is also able to delete user.
Ticket # Description
801252 RADIUS not mapping to correct AD server when kerberos and netbios
names differ for a single winbind instance.
801661 GUI - URI navigation drops query params, losing tab indicator, prevents
direct links to secondary views.
802343 The message template under Notify User Via Email is not editable in Self
Registration Login Portal Configuration.
802372 Vulnerability Scan Status on Host view page displays as "-1" instead of
passed, failed or not scanned.
802913 Clicking Cancel in Create User view results in browser console errors.
803061 Multicast IPv6 addresses can now be excluded using the MAC address
Exclusion view. See MAC address exclusion in the 9.4 Administration
Guide for details. Note: After upgrade, toggle the option off and on in order
for the function to take effect.
803651 Model Config of VDOM reports 404 error and exception in output.master.
803745 Top Host Activity Widget - maps Device Type to User&Hosts > Hosts >
Operating Systems Column instead of Device Type.
803745 The Top Host Activity tile was using getTypeLabel instead of getIconType
to populate the Device Type column
804913 Logical Network Host Access total count slide out shows all hosts for the
Logical Network instead of only hosts for the specificed time sample.
Ticket # Description
806141 Network > NetworkEvents Type, LogicalNetwork and NetID is not showing
expected data.
806282 When a user attempts to complete a task via the notification bell, and it has
a parent task that is still open, it incorrectly displays a "Changes Saved"
message.
807383 The POST method to add a new HostRecord has changed in this
version.POST attempts using the old API call fails.
782391 782386 RADIUS health activity- Current last 90 min does not match Timeline Chart
Time Span for 90 min
784737 785526 Location and IPRange method match failure prevent matching lower rank
rules.
801948 803681 Fresh Deployed server will not start: java.sql.SQLException: Connections
could not be acquired from the underlying database.
Known Issues
Ticket # Description
780312 FortiNAC does not integrate with Azure Active Directory due to SAML
connection requirements.
686910 Control Manager (NCM) communication issues when the NAC systems are
714219 connected through the WAN.For details see related KB article
https://community.fortinet.com/t5/FortiNAC/Technical-Note-NCM-
communication-issues-with-systems-across-WAN/ta-p/192434.
792968 Legacy View for Users & Hosts > Hosts does not display items in tables.
Workaround: Enter “*” (asterisk) in search field.
752538 When in the Users & Hosts > Applications view, selecting an
application and clicking the Show Hosts option displays a page that does
not provide accurately filtered results. Workaround: Navigate Users &
Hosts > Hosts and create a custom filter to list hosts associated to an
application.
770091 Port changes/VLAN assignments made using Local RADIUS are not being
logged as port changes.
710416 There can be a delay in updating IP addresses for isolated hosts in host
and adapter view.
708936 FortiNAC will logoff SSO for sessions that remain connected to a managed
FortiGate IPSec VPN tunnel after 12 hours.
708720 Policy evaluation may not be triggered after a host status update in
Microsoft InTune. This can prevent the host from being moved to the
proper network. For details and workaround see related KB article
https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Policy-
evaluation-not-triggered-after-Microsoft/ta-p/203843.
Ticket # Description
694407 Linux hosts running CrowdStrike Falcon sensor 6.11 and later are not being
detected by the agent. This causes hosts running CrowdStrike Falcon to
incorrectly fail scans. For details and workaround, see related KB article
https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Linux-
hosts-running-CrowdStrike-Falcon/ta-p/202694.
682438 Page Unresponsive' error when exporting hosts.For details and workaround
see related KB article
https://community.fortinet.com/t5/FortiNAC/Technical-Note-Page-
Unresponsive-error-when-exporting-hosts/ta-p/193878.
677628 Cisco WLC Port Channel not classified as Learned Uplink.For details and
workaround see related KB article
https://community.fortinet.com/t5/FortiNAC/Technical-Note-Cisco-
WLC-Port-Channel-not-classified-as-Learned/ta-p/196208.
675180 False positive Scan Results when there are no sub-settings selected in
Operating System check.
674438 "Processes" Scan Type option is not available when creating custom scans
for macOS systems.
646580 Restarting FortiNAC services can generate a large number of SSH sessions
with ASA. For details, refer to related KB article
https://community.fortinet.com/t5/FortiNAC/Technical-Note-Restarting-
services-can-generate-large-number-of/ta-p/195876.
631115 Only 50000 records display in Adapter and Host Views. Example: Adapters
- Displayed: 50000Total: 57500
609976 Cisco WLC 9800 Model Configuration tab does not include the drop down
VLAN lists under Access Value.For details and workaround see related KB
article https://community.fortinet.com/t5/FortiNAC/Technical-Note-
Cisco-WLC-9800-Model-Configuration-tab-does-not/ta-p/198790.
609046 A port where the master Aruba Instant AP (IAP) with VIP is connected
becomes a “learned uplink”. This type of uplink is not dynamically undone /
removed when the IAP (with the VIP) is disconnected from that port.
522468 Although there are fields to set the role or access value in the
Authentication portal, these functions are currently not supported.
762704 After clicking the 'restart services' button when applying SSL certificates to
the Admin UI Certificate Target, the prompt does not clear and there is no
confirmation dialogue (even though it was successful). Clicking the 'restart
services' button again generates an error.
789970 FortiNAC sends SSO login msg to only one slot on the 7000E FortiGate
chassis.
Ticket # Description
784642 Norton Antivirus Plus (Norton 360) installed from app store not detected in
endpoint compliance scan.
808523 Delete User: Admin User without Admin User Permissions is able to delete
another Admin User
804519 Network Events and other Views - Filtering based on content entered in the
filter field does not produce results.
Workaround: Leave filter field blank and select an object in the drop-down
instead.
804913 Logical Network Host Access total count slide out shows all hosts for the
logical network
Not all models of all network devices can be configured to perform Physical
MAC Address Filtering even though the Admin UI indicates that the
configuration can be set. Resolution: Hosts can be disabled by
implementing a Dead-end VLAN.
For Portal v2 configurations, web pages that are stored in the site directory
to be used for Scan Configurations will not be included when you do an
Export of the Portal v2 configuration. Resolution: The files in the site
directory are backed up with the Remote Backup feature, but otherwise
keep a copy of these files in a safe place.
The "Set all hosts 'Risk State' to 'Safe'" button changes the status of all
hosts marked At-Risk to Safe. However, the status of the individual scans
for each host remain unchanged.
System > Settings > Updates > Operating System will only record and
display dates of OS updates that are completed through the Administrative
UI. If Operating System updates are run via command line using the "yum"
tool, the update is not recorded. Resolution: Execute Operating System
Updates through the Administrative UI in order to maintain update history.
Ticket # Description
Ticket # Description
679230 Aruba 9012-US currently not supported.If required, contact sales or support
to submit a New Feature Request (NFR).
At this time, integration with Cisco 1852i Controller is not supported due to
the device's limited CLI and SNMP capability. For details, see related KB
article 189545.
At this time, Fortinet does not support wired port management for the
Cisco 702W. The access point does not provide the management
capabilities required.
At this time, Fortinet is not able to support the Linksys LAPN600 Wireless-
N600 Dual Band Access Point.
Device models for Avaya 4800 switches (and potentially other related
models) only support SSH. Device models for Avaya Ethernet Routing
Switches only support Telnet. Contact Support if the alternate protocol is
required.
Device Support
These changes have been made in FortiNAC Version 9.4.0. These are in addition to the device support added
in previous releases.
Version 9.4.0
Ticket # Vendor
781634 Add Device support from set mapping emails (Huawei S5700-52P-LI-AC)
Ticket # Vendor
796633 fortigate
Cisco IOS Software, C1000 Software (C1000-UNIVERSALK9-M), Version
15.2(7)E4
Aruba R8N87A 6000 24G CL4 4SFP Swch PL.10.08.1010
Meraki MS355-48X2 Cloud Managed Switch
Dell EMC Networking OS10 Enterprise.S5224F-ON
783982 S5720-12TP-LI-AC
S5720-36PC-EI-AC
S5720S-52P-SI-AC
S5700-10P-PWR-LI-AC
1. In the FortiNAC Administrative UI, navigate to System > Settings > Updates > System.
2. Update the appropriate fields to configure connection settings for the download server.
Field Definition
3. When the download settings have been entered, click Save Settings
Fortinet is committed to providing periodic maintenance releases for the current generally available version of
FortiNAC. From time to time, Fortinet may find it necessary to discontinue products and services for a number
of reasons, including product line enhancements and upgrades. When a product approaches its end of support
(EOS) or end of life (EOL), we are committed to communicating that information to our customers as soon as
possible
End of Support
Agent
Versions 2.x and below of the Fortinet Agent will no longer be supported. FortiNAC may allow the agent to
communicate but functionality will be disabled in future versions. Please upgrade to either the Safe Harbor or
latest release of the Fortinet Agent at your earliest convenience.
Fortinet Mobile Agent for iOS will no longer be supported. It will be completely removed in a future version.
EasyConnect features are not affected as they do not require an agent on iOS.
Software
When a code series has been announced End of Support, no further maintenance releases are planned.
Customer specific fixes will still be done.
Hardware
Physical appliance hardware reaches end-of-support when the maintenance contract is non-renewed, or at the
end of year 4 (48 months beyond purchase date), whichever is first.
Fortinet relies on the CentOS organization to publish periodic bug fixes and security updates for the CentOS
Distribution.
CentOS 5
Effective March 31, 2017, CentOS will no longer provide updates for CentOS 5. Any vulnerabilities found with
CentOS 5 after March 31st will not be addressed. FortiNAC software releases will continue to be supported on
CentOS 5 through December 31, 2018.
As of 2016 Fortinet’s appliances are based on the CentOS 7 Linux distribution. New appliance migration
options are available for customers with CentOS 5 appliances who require operating system vulnerability
patches, maintenance updates and new features available on CentOS 7.
CentOS 7
Effective June 30 2024, CentOS will no longer provide updates for CentOS 7. Any vulnerabilities found with
CentOS 7 after June 30th will not be addressed.
FortiNAC and Analytics software releases will continue to be supported on CentOS 7 through December 31
2026 or end of product life (whichever comes first). See Product Life Cycle chart for details.
(https://support.fortinet.com/Information/ProductLifeCycle.aspx )
End of Life
Software
When a code series has been announced End of Life, no further maintenance releases are planned. In
addition, customer specific fixes will not be done. If experiencing problems with a version of FortiNAC in the
code series, you would be required to update before any issues can be addressed.
With the release of FortiNAC Version 8.5.0, Fortinet announced the End-Of-Life for FortiNAC 8.1. Existing
customers under maintenance are strongly encouraged to upgrade to the current Safe Harbor release.
Considerations are as follows:
l FortiNAC Versions 7.0 and higher are not supported on appliances running firm‐ware Version 2.X (SUSE)
because of the limitations of this operating system and the hard‐ware on which it is installed. Please
contact your sales representative for hardware upgrade options.
l If you attempt to install FortiNAC Versions 7.0 and higher on an unsupported Operating System and
hardware combination, the install process displays the following message: “This release is not supported
on 1U SUSE‐ Linux appliances (firmware 2.x). The install process will exit now. Please contact Fortinet at:
+1 866.990.3799 or +1 603.228.5300”
l On July 13, 2010 Microsoft ended support for Windows 2000 and Windows 2000 Server. These Operating
Systems will be removed from the list of options in the Scan Policy Configuration screens in a future
release.
Numbering Conventions
l Release Notes pertain to a certain version of the product. Release Notes are revised as needed. The Rev
letter increments accordingly. For example, updating the Release Notes from Rev C to Rev D indicates
changes in the Release notes only -- no changes were made to the product.
l The next number represents the version in which a Known Anomaly was added to the release notes (for
example, V8.0).