FortiNAC / current FortiNAC-F generation
Network access control and connected-asset governance
Hardware or virtual architecture, design dependent
PLUS and PRO options in current Fortinet materials
Confirm model, capacity, license, support and region
Direct answer: what Fortinet Network Access Control is for
Fortinet Network Access Control is the FortiNAC platform used to discover and profile devices and users, apply network access policies, support segmentation, and coordinate responses to network or security events. Organisations should consider it when unmanaged, unknown, guest, BYOD, IoT, OT, healthcare, or other specialised devices must be identified and governed before or while they use the network. A buyer should not select a license or appliance from endpoint count alone. The existing switch and wireless estate, RADIUS and identity requirements, site topology, virtualisation preference, high-availability design, desired incident-response automation, and current Fortinet ordering rules all influence the final architecture.
What the platform does
FortiNAC operates as a network access control layer that works with the surrounding network infrastructure rather than becoming the data path for every user packet. Fortinet describes the architecture as out of band: the platform obtains visibility from the environment, integrates with network and security systems, and then applies policy through the points of connection and connected infrastructure. That architecture can be valuable for organisations that want central policy and visibility across many switches, access points, sites, device types, and user populations.
The practical objective is not simply to create another inventory database. The platform can discover and classify devices, associate users and devices with policy, support onboarding, place devices into appropriate network segments, check conditions, and trigger actions when a device or behaviour does not fit policy. Which actions are available depends on the chosen license tier, integration, network-device support, configuration, and deployment design.
Who should consider it
Fortinet NAC is most relevant where the network contains more than a simple, known set of centrally managed laptops. Universities, healthcare organisations, manufacturing and industrial environments, hospitality groups, distributed enterprises, government environments, logistics operations, large offices, and multi-site businesses may have a mixture of employee systems, contractors, printers, cameras, phones, sensors, controllers, medical or industrial devices, and visitors. Network teams need a repeatable method to determine what each connection is and what it should be allowed to reach.
A smaller organisation may also benefit when regulatory, segmentation, guest-access, or connected-device requirements justify the project, but FortiNAC should not be purchased only because the brand is already present in the network. The business case should be tied to measurable access-control, visibility, onboarding, segmentation, or response requirements.
Business challenges a NAC project can address
Unknown devices at the edge
When security teams cannot reliably answer what is connected, ownership and risk become difficult to assess. Profiling and inventory functions can provide context before policy is applied.
Overly broad network access
A device that only needs a narrow service path should not automatically receive the same reachability as a managed employee workstation. NAC can support role- and device-aware segmentation.
Manual onboarding
Guest, contractor, BYOD, and device registration can become inconsistent when each site uses a different process. Policy-led onboarding helps establish repeatable handling.
Slow containment decisions
Where a security event should result in a network action, automation can reduce the number of manual handoffs, provided the incident logic and response permissions are designed carefully.
A practical fit matrix for FortiNAC planning
| Requirement | Suitable when | Confirm before ordering |
|---|---|---|
| Connected-device visibility | You need a current picture of users and devices across wired, wireless, IoT or specialised environments. | Required profiling methods, network-device integrations and coverage boundaries. |
| Policy-based network access | Different users and device classes require different permissions or network placement. | RADIUS design, 802.1X readiness, MAB use, identity sources, VLAN or segmentation strategy. |
| Guest and BYOD onboarding | Visitors, contractors or personal devices need controlled registration and access workflows. | Portal flow, sponsorship, authentication, acceptable-use process and network isolation. |
| Automated incident response | Security events should trigger predefined containment or access changes. | PRO licensing, event sources, workflows, approval model and operational rollback process. |
| Multi-site central governance | Policy and visibility need to span multiple locations without inserting an inline appliance into every traffic path. | Server roles, resilience, WAN reachability, site scale and current supported topology. |
Current platform and ordering information to verify
Fortinet’s current public product material describes FortiNAC as a product line with hardware appliances, virtual machines and endpoint licenses. It also states that FortiNAC deployments use Control and Application functions, with Manager components available for larger distributed designs. Fortinet publishes different capacity measures in different official materials, including network ports on the product page and supported endpoint counts in the data sheet. These are not interchangeable metrics, so procurement teams should size against the current document set and the exact proposed topology rather than comparing a port number directly with an endpoint number.
| Brand | Fortinet |
|---|---|
| Platform | FortiNAC; current post-9.4 documentation is published under FortiNAC-F |
| Product type | Network Access Control and connected-device access governance |
| Deployment choices | Physical appliances and virtual machines; exact architecture is environment dependent |
| Current hardware examples | FortiNAC-CA-500F, CA-600F and CA-700F Control/Application appliances; FortiNAC-M-550F Manager |
| Virtual examples | FNC-CAX-VM Control/Application VM and FNC-MX-VM Manager VM in current Fortinet material |
| License tiers | PLUS and PRO are the two current tiers presented in the FortiNAC data sheet; features and response capabilities differ |
| License models | Perpetual and subscription options are documented; combinations can be supported in current FortiNAC-F deployment guidance |
| Network integration | Fortinet advertises extensive multivendor support; exact switch, AP, firewall and software versions must be confirmed |
| Architecture | Out-of-band network access control architecture |
| Pricing | Configuration dependent. Request a UAE quotation for the selected servers, endpoint licenses, support and services. |
| Availability | Contact FourTeck for current model, license and UAE lead-time guidance. |
Important: model capacities, licensing, supported integrations and cloud or hypervisor options can change with software generation and ordering updates. Confirm the exact bill of materials before purchase.
PLUS or PRO: choose the operating outcome, not only the feature list
PLUS licensing
Current Fortinet data-sheet material positions PLUS for organisations that need endpoint visibility, advanced network access control, automated provisioning for users, guests and devices, and reporting or analytics, but do not require the automated threat-response functions associated with PRO. For many NAC projects this can align with the core requirement: identify, authenticate, register, segment and govern devices and users.
The decision should still be validated against the exact workflow. For example, a requirement that sounds like “quarantine suspicious devices automatically” may place the project beyond a simple access-control brief, depending on the event source and intended action.
PRO licensing
PRO extends the current licensing position into automated threat response and incident-oriented workflows. It is more relevant when the NAC platform is expected to consume security context, correlate events, triage them and drive network actions as part of a wider response process. That can be useful where the security operations team wants network enforcement to be connected with endpoint or security events.
PRO should not be selected merely because it is the higher tier. Automated actions require design, testing, operational ownership and rollback procedures. A containment workflow that is technically possible may still need approval boundaries so that a false positive does not unnecessarily disrupt a critical production or medical device.
Architecture and compatibility dependencies
A FortiNAC project touches the access layer, identity processes and operational network controls, so compatibility is a design input rather than a box to tick at the end. Fortinet advertises interaction with network devices from more than 150 vendors and current product material highlights integration with FortiGate and the wider Security Fabric. That breadth does not mean every switch, access point, firewall, controller or software version has identical control capability. The exact device model and firmware matter, as do the enforcement method, authentication method and planned workflow.
A discovery-only requirement is technically different from a design that will dynamically change VLANs, push network policy, enforce RADIUS decisions, quarantine endpoints, or integrate security events. Buyers should therefore provide a representative infrastructure inventory rather than just the name of the main network vendor. Include switch families, wireless controllers or cloud-managed WLAN, firewall platforms, identity directories, certificate services, endpoint management, SIEM or analytics platforms, and any OT or medical-network restrictions that affect active scanning or enforcement.
A six-stage purchase and deployment journey
Define the access problem
Document the device groups, sites, onboarding pain points, segmentation objectives, compliance expectations and incidents that the NAC programme should address.
Inventory the environment
Capture network-device models and software, endpoint estimates, identity systems, WAN design, guest workflows, virtualisation choices and security integrations.
Select architecture and license
Choose physical or virtual roles, resilience, multi-site structure, server capacity and PLUS or PRO based on the required policy and response outcomes.
Validate integrations
Confirm supported switches, wireless, authentication, event sources and enforcement actions. Use a controlled pilot where integration or operational impact is uncertain.
Implement in policy phases
Begin with visibility and classification, then move to registration, access control and stronger enforcement after device classes and exceptions are understood.
Operate and refine
Review profiles, exceptions, policy ownership, software lifecycle, licensing and incident workflows as the network and connected-device estate changes.
Device visibility that supports policy decisions
The first operational value of a NAC platform is knowing what is actually present, not what the asset register says should be present. FortiNAC uses multiple profiling methods and can work with agentless and agent-based approaches depending on the device and requirement. Fortinet’s current public product page advertises 21 profiling methods, while its data sheet describes broader device classification categories and the use of FortiGuard context. The key buyer question is not the raw count of profiling techniques; it is whether the platform can reliably distinguish the device classes that matter in your environment.
A university may need to distinguish student BYOD, managed faculty systems, lab equipment, printers and building-control devices. A hospital may need separate handling for clinical systems, IoMT devices, staff workstations and visitors. A factory may have workstations, cameras, industrial controllers, engineering laptops and contractor equipment. These examples create different classification tolerances and enforcement risks. A device that is uncertain should often enter a restricted or observation policy rather than being automatically treated as a known trusted endpoint.
For procurement, this means a demonstration should include representative devices from the real environment. Ask how the proposed FortiNAC release will profile them, what evidence is used, how confidence or unknown states are handled, and which data remains available for reporting and investigation. Visibility is the foundation for policy, but visibility quality depends on integration coverage and how well the deployment is tuned to local device behaviour.
Segmentation and access control at the point of connection
Network access control becomes useful when identity and device context can change what the network permits. FortiNAC supports mechanisms such as network access policies, RADIUS/EAP, MAC Address Bypass, captive portals, guest management, BYOD onboarding and firewall segmentation in current licensing material. Which mechanism is appropriate depends on the endpoint type. A managed laptop can often participate in certificate-based or 802.1X authentication. A headless sensor or legacy device may need a different method, and an unmanaged visitor device may use a portal-oriented workflow.
The segmentation objective should be written in business terms before it is translated into VLANs or firewall rules. For example, “building cameras may reach only their management services and required time or DNS infrastructure” is more durable than “put cameras in VLAN 260.” The technical implementation can then evolve while the security intent remains clear. FortiNAC can help dynamically assign or enforce network treatment, but the surrounding switch, wireless and firewall environment must support the selected approach.
A phased rollout is especially important for critical devices. Begin with observation, identify exceptions, confirm that authentication and fallback behaviour are understood, and then introduce enforcement in controlled groups. For OT, IoMT and other sensitive environments, active scanning and remediation should be reviewed with the system owner. Network security should improve control without creating avoidable interruption to systems that have strict availability or vendor-support requirements.
Automated response without turning policy into a black box
The PRO tier is relevant when FortiNAC is expected to do more than admission and segmentation. Fortinet’s current material associates PRO with event correlation, alert handling, triage workflows and automated threat response. This can connect network enforcement with security operations: a device associated with a validated incident can be moved, restricted or otherwise handled through a predefined workflow rather than waiting for a manual network change.
Automation should still be governed. Buyers should define which events can trigger an automatic network action, which require approval, what happens to critical systems, how an action is logged, and how it is reversed. A malware detection on a standard office endpoint may justify a rapid containment action. The same logic applied to a life-safety, industrial-control or operationally critical device could have unacceptable consequences. Policy should therefore combine security context with asset criticality and operational ownership.
During design, map each automated workflow from source event to final network effect. Identify the integration that provides the event, the criteria that qualify it, the FortiNAC policy action, the infrastructure component that enforces the change, the user or team that is notified, and the conditions for restoring normal access. This makes the response process understandable to network, security and business owners and prevents a higher license tier from being purchased without a practical operating model.
Ideal business environments and use cases
Campus and education
Large volumes of student and staff devices, visitors, labs, printers and facility systems can require differentiated onboarding and access policies.
Healthcare and clinical networks
IoMT, clinical endpoints, administrative systems and guests create a need for visibility and segmentation, with careful change control for sensitive devices.
Industrial and OT environments
Factories, utilities and operational networks can use NAC to improve asset context and restrict reachability, provided profiling and enforcement are compatible with OT constraints.
Distributed enterprises
Multi-site organisations may want central policy, common device classification and coordinated response across branches without placing NAC inline with all user traffic.
Hospitality and guest-heavy sites
Guest, contractor, operational and corporate device groups often need different registration, access and isolation processes.
Regulated business networks
Organisations that must demonstrate controlled access can use policy, inventory and reporting as part of a wider governance programme; specific compliance outcomes still depend on implementation.
Operational considerations after go-live
NAC is not a one-time configuration project because the network changes continuously. New endpoint types appear, operating-system behaviour changes, switch firmware is upgraded, cloud-managed network services evolve, and business teams introduce devices that the original policy did not anticipate. The operating model should therefore assign ownership for device profiling, access-policy changes, guest processes, exception approvals, integration health, software upgrades and license consumption.
Network and security teams should agree on where responsibilities meet. A security analyst may decide that a device is risky, while the network team understands the operational consequence of changing its access. Service-desk staff may need to handle legitimate users who are placed in a remediation or registration state. Asset owners may need to approve exceptions for specialised devices. The strongest technical policy still needs a human support path when something does not behave as expected.
Before production rollout, define monitoring and escalation. Include server health, integration status, authentication failures, unidentified-device trends, policy exceptions, response actions and capacity or license usage. Also document a change process for critical network integrations. This reduces the risk that a switch upgrade, directory change or security-tool update unexpectedly weakens visibility or enforcement.
Questions to resolve before you request a bill of materials
Separate current count from expected growth and include headless IoT or operational devices that may not appear in user-license estimates.
Provide switch, wireless and firewall models where possible because enforcement capability can vary by platform and software.
This distinction helps determine the workflow design and whether PLUS or PRO should be evaluated.
Assess 802.1X, certificates, RADIUS, MAB, captive portal and registration needs by device class rather than forcing one method everywhere.
Decide whether it should be observed, registered, placed in restricted access, denied, or routed to an exception process.
If automated response is required, identify SIEM, endpoint, firewall or other event sources and the intended network action.
Procurement checklist for a FortiNAC project
✓ Confirm the exact FortiNAC-F architecture and server roles.
✓ Record concurrent endpoint estimates and planned growth.
✓ List sites, WAN constraints and resilience requirements.
✓ Identify switch, access-point, controller and firewall models.
✓ Confirm identity, RADIUS, directory and certificate dependencies.
✓ Choose PLUS or PRO based on required workflows.
✓ Confirm perpetual versus subscription licensing expectations.
✓ Decide whether hardware or virtual deployment is preferred.
✓ Validate hypervisor or cloud support for any VM design.
✓ Define guest, BYOD, contractor and unmanaged-device handling.
✓ Identify critical devices that require cautious enforcement.
✓ Include installation, configuration and pilot scope where needed.
✓ Confirm support coverage and renewal expectations.
✓ Reconfirm UAE availability and lead time before purchase.
What buyers commonly need to understand before choosing FortiNAC
A network access control purchase is often researched as if it were a single appliance, but FortiNAC is better understood as an architecture made from software functions, endpoint licensing, infrastructure integrations and operational policy. Buyers searching for a “Fortinet NAC price” therefore encounter numbers that can be misleading without context. A 100-endpoint license, a Control/Application appliance, a virtual server entitlement and a support contract are different commercial items. A realistic quotation should describe the whole design and show which components are one-time, subscription based, support related, or service related.
Does FortiNAC replace a firewall?
No. NAC and firewalling solve related but different control problems. FortiNAC focuses on understanding devices and users and influencing network access. Firewalls enforce traffic policy between networks and applications. In many designs, the two cooperate: the NAC system supplies identity or device context and helps place endpoints into the correct segment, while firewall policy controls the traffic allowed between those segments.
Is FortiNAC only useful in a Fortinet network?
Fortinet promotes FortiNAC as a multivendor platform and its current product page advertises interaction with network devices from more than 150 vendors. That makes mixed estates a legitimate use case. The important qualification is that “supported” is not a single universal capability. Discovery, authentication, VLAN changes, wireless control and other actions can differ by device family and software version, so integration must be checked against the proposed release.
Can it control devices that do not support an agent?
Yes, agentless discovery and profiling are important to NAC because many connected assets—printers, cameras, sensors, phones, OT devices and medical equipment—cannot run a conventional endpoint agent. The enforcement method still depends on the network and device type. For a headless asset, the design may rely on profiling, MAC-related methods, switch or wireless controls and segmentation rather than an installed software agent.
Should an organisation start with 802.1X everywhere?
Not necessarily. 802.1X can provide strong authenticated access, but a mixed enterprise often contains endpoints that cannot participate in the same way. A practical design groups endpoints by capability and risk. Managed user devices may use certificate-backed 802.1X, while headless or legacy systems use other controlled methods. A phased deployment can reduce disruption and expose exceptions before strict enforcement is expanded.
Another common research question is whether FortiNAC is “cloud” or “on-premises.” Current Fortinet materials include physical appliances and virtual-machine options, and the current product page lists a Control/Application VM for VMware, Hyper-V, AWS, Azure and KVM. The data sheet lists additional virtualisation and cloud-provider support. Because platform support can change, the buyer should confirm the exact target—such as a specific hypervisor, cloud region, or private-cloud environment—against the software release being quoted. The choice is not just about where the server runs. It affects resilience, network reachability, operational ownership, backup design, and the ability to observe and control remote sites.
Buyers also ask how much endpoint count matters. It matters greatly for licensing and sizing, but “endpoint” should be estimated carefully. The scope may include devices that are not assigned to individual users, such as phones, printers, cameras, badge readers, sensors, robots, controllers and medical systems. Temporary guests and contractors may also affect concurrent use. A useful estimate separates normal daily concurrency, peak concurrency, device growth, and site expansion. The final bill of materials should then be tested against Fortinet’s current capacity rules for the selected server architecture.
For organisations comparing FortiNAC with another NAC platform, the most valuable comparison is not a generic feature checklist. Compare device profiling for your actual estate, supported enforcement on your switching and wireless platforms, guest and BYOD workflow, identity integration, reporting, automation, multi-site operations, virtualisation fit, administrative model, supportability and total license structure. A proof of concept can be especially useful where the environment is heterogeneous or where the planned policy will affect critical operational devices.
Finally, prepare the quotation request as a design brief rather than a price request. Include endpoint count, site count, network vendors and models, key identity systems, desired onboarding flows, segmentation goals, automatic response requirements, preferred appliance or VM direction, high-availability expectations, implementation scope and target schedule. FourTeck can review these details and coordinate the appropriate Fortinet NAC architecture, current licensing and UAE quotation rather than relying on a standalone internet price that represents only one component.
Decision questions that shape the right FortiNAC design
How do we know whether we need PLUS or PRO without overbuying?
Start from the action you expect after a device is identified. If the programme is centred on visibility, onboarding, authentication, network-access policy, segmentation and reporting, PLUS may align with the core requirement. If security events must drive automated triage and network response, evaluate PRO. Document two or three real workflows and map them to current license capabilities before selecting the tier.
What should we do if our switches are from several vendors?
Treat compatibility as a matrix, not a yes-or-no statement. List each significant switch and wireless family, its software version, and the function FortiNAC must perform on it. One device may be fully suitable for RADIUS authentication but have different capabilities for dynamic configuration or telemetry. Validate the intended action on representative hardware before enterprise-wide enforcement.
How should we approach IoT or OT devices that cannot tolerate aggressive scanning?
Begin with passive or low-impact visibility techniques and involve the operational owner. Device classification should not automatically lead to active interrogation or immediate blocking. Define which assets are safety, production or clinically critical, document vendor constraints, and introduce enforcement only after their behaviour and dependencies are understood.
What information makes a FortiNAC quotation accurate?
The highest-value inputs are concurrent endpoint count, device growth, number of sites, network-device inventory, identity systems, required license outcomes, server or VM preference, resilience requirement and implementation scope. Add any special guest, BYOD, OT, healthcare, contractor or automated-response scenarios. With this information, FourTeck can reduce assumptions in the bill of materials.
Can we deploy visibility first and enforcement later?
That is often a sensible operating approach. Visibility-first deployment helps establish a device baseline, uncover exceptions and improve classification before access changes are introduced. The commercial architecture should still anticipate the eventual control requirement so that server sizing, license choice and integration work do not need to be redesigned unnecessarily.
When is a proof of concept worth the effort?
A pilot is valuable when the network is highly heterogeneous, critical devices are difficult to classify, the planned enforcement is operationally sensitive, or third-party integrations are central to the business case. Define success criteria before the pilot: specific device identification, authentication, segmentation and response workflows should be demonstrated rather than simply confirming that the software installs.
FourTeck consultation, sizing and configuration support
FourTeck can assist with the practical steps that turn a Fortinet NAC requirement into a defined procurement and deployment scope. That can include reviewing endpoint and site counts, identifying the expected FortiNAC server roles, comparing hardware and virtual deployment approaches, clarifying PLUS versus PRO licensing, reviewing network integration requirements, and preparing a bill of materials for quotation. Where implementation assistance is required, the scope can also cover planning for discovery, authentication, onboarding, segmentation, policy rollout and operational handover.
For environments already using Fortinet security products, the project can be reviewed in the context of the wider security architecture rather than as an isolated NAC purchase. Businesses planning broader network-security changes can also review Fortinet firewall options, while general technology requirements can be explored through the FourTeck product portfolio and implementation and support services.
A quotation should clearly state the selected server or VM components, endpoint licenses, support items, required services, assumptions and any customer responsibilities. This gives procurement, network and security teams a common reference before the order is placed.
UAE availability and project coordination
Contact FourTeck to confirm current UAE availability for the proposed FortiNAC-F appliances, virtual components, endpoint licenses and support items. Availability can depend on the exact model, license type, quantity, software generation, region and vendor lead time. A broad “FortiNAC available” answer is therefore less useful than checking the bill of materials that matches the project.
For projects in Dubai, Abu Dhabi, Sharjah and Ajman, FourTeck can coordinate requirement review, quotation preparation, delivery planning and implementation discussions from one project scope. Installation or configuration should be included in the quotation when required rather than assumed to be part of the product price. Use the FourTeck contact team to share the endpoint count, deployment locations, required license tier, infrastructure summary and expected project window.
GCC Availability
Organisations planning Fortinet Network Access Control across the GCC can ask FourTeck to review the requirement at project level rather than treating every site as an unrelated purchase. For deployments involving the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain or Oman, the review can cover endpoint estimates, architecture, license level, virtual or appliance preference, integration requirements, implementation scope, renewal planning and delivery coordination. Availability, licensing, service visits, vendor lead time and project scheduling can vary by country, model, quantity and requirement. Buyers should provide the destination country, required FortiNAC components, approximate concurrent endpoints, number of sites, preferred license model, deployment environment and target timeline. Regional projects can also discuss standardised policy design while allowing site-specific network and operational constraints. For Kuwait-related technology coordination, see the FourTeck Kuwait resource. Any country-specific certification, import, support or installation requirement should be confirmed for the final bill of materials and service scope.
Africa Availability
For African deployments, FortiNAC procurement and design should account for both the central architecture and the conditions at each destination. FourTeck can help organisations evaluate endpoint licensing, hardware or VM requirements, network-device compatibility, subscriptions, implementation scope, support expectations and renewal planning for projects in East Africa and other regions. Availability and fulfilment may depend on destination, model, quantity, license region, local power or hosting conditions, shipping arrangements, vendor lead time and the availability of appropriate project resources. Buyers should share the destination country, exact requirement, approximate endpoint count, site structure, planned schedule and whether remote or on-site installation assistance is expected. Organisations with projects in Kenya or Uganda can also review regional information through the FourTeck Africa technology resource. Local inventory, customs outcomes, country-wide onsite coverage and fixed delivery dates should not be assumed until the project is reviewed and confirmed.
Related technology and project options
Fortinet firewall architecture
Review segmentation and security-policy enforcement where NAC context is expected to work with firewall controls.
Network implementation services
Include discovery, configuration, rollout planning or migration work in the project scope when internal teams need implementation assistance.
Fortinet UAE solutions
Consider complementary Fortinet security and networking components where the NAC project is part of a broader architecture.
Why businesses contact FourTeck for FortiNAC planning
The main value of a pre-sales conversation is reducing uncertainty before licensing and infrastructure are ordered. FourTeck can help clarify whether the requirement is primarily visibility, access control, segmentation, guest and BYOD onboarding, automated response, or a combination of these outcomes. That definition then supports a more accurate discussion about PLUS versus PRO, endpoint licensing, physical versus virtual servers, high availability, multi-site design and integration effort.
Buyers can also use the discussion to identify what still needs validation. Examples include a specific third-party switch family, an older wireless controller, a specialised OT device, a cloud-hosted virtualisation target, or a security-event workflow. Instead of treating these unknowns as assumptions in the purchase order, they can be called out for compatibility checking, pilot testing or scope clarification. This approach helps procurement teams receive a quotation that is easier to evaluate and helps technical teams understand what the proposed architecture is expected to do.
Frequently asked questions about Fortinet Network Access Control
What is FortiNAC-F?
FortiNAC-F is the current Fortinet documentation name used for the next-generation FortiNAC platform after the older FortiNAC 9.4 documentation line. It is Fortinet’s network access control platform for connected-device visibility, access policy, segmentation and response. The exact software release and architecture should be confirmed for a new deployment.
Does FortiNAC work only with Fortinet switches and wireless?
No. Fortinet promotes extensive multivendor support and currently advertises interaction with network devices from more than 150 vendors. However, the exact actions available depend on the device model, software version and integration, so compatibility must be checked for the proposed environment.
What is the difference between FortiNAC PLUS and PRO?
Current Fortinet material positions PLUS around visibility, advanced access controls, onboarding and reporting. PRO adds incident-response capabilities such as event correlation, triage-oriented functions and automated threat response. The right tier depends on the workflows the organisation actually needs.
Can FortiNAC be deployed as a virtual machine?
Yes. Fortinet publishes virtual Control/Application and Manager options in addition to physical appliances. Supported hypervisors and cloud platforms should be checked against the current FortiNAC-F release and the exact VM part number before ordering.
Is a subscription mandatory for FortiNAC?
Fortinet documentation currently includes perpetual and subscription endpoint licensing, and current deployment guidance describes the ability to combine perpetual and subscription license counts in supported designs. The appropriate commercial model and support items should be confirmed in the quotation.
How should FortiNAC be sized?
Sizing should consider concurrent endpoints, managed network ports, number of sites, server roles, resilience and the intended architecture. Fortinet publishes both port-based and endpoint-based capacity information in current materials, so the selected design should be validated against the current data sheet and ordering guidance.
Does FortiNAC support 802.1X?
Current Fortinet licensing material includes Full RADIUS with EAP as part of the network access control feature set. FortiNAC also supports other onboarding and access methods. Whether 802.1X is the best method for every device class depends on endpoint capability and network design.
Is FortiNAC suitable for IoT and OT environments?
Fortinet specifically positions FortiNAC for IT, IoT, OT/ICS and IoMT connected assets. In operationally sensitive environments, profiling, scanning and enforcement should still be planned with asset owners and tested so that security controls do not conflict with device availability or vendor requirements.
What does FourTeck need to prepare a UAE quotation?
Share the approximate concurrent endpoint count, number of sites, main network vendors and models, identity systems, required onboarding and segmentation flows, whether automated threat response is needed, preferred hardware or VM direction, resilience requirement and any installation or configuration scope. FourTeck can then confirm current UAE options and prepare a more accurate bill of materials.
Build the FortiNAC requirement before buying the license
Share your endpoint count, sites, network infrastructure, identity services and desired access-control or response workflows. FourTeck can help translate the requirement into a current FortiNAC-F architecture, license choice, implementation scope and UAE quotation.