Each matched security filter generates its own security event. Since the trigger is configured to match any one filter within the defined time limit, multiple matched filters will generate multiple events, but only one security alarm is created when the security rule condition is satisfied.

The DHCP scope for guest onboarding must use the default gateway of the guest VLAN. In the diagram, the guest network is associated with the interface labeled 10.20.1.250, which serves as the gateway for that subnet.

DHCP must be allowed so endpoints in the isolation network can obtain an IP address. DNS must be permitted so isolated hosts can resolve the FortiNAC-F hostname or required resources.
HTTP/HTTPS must be allowed to enable redirection and communication with the FortiNAC-F captive portal for registration and authentication.

The Guest-VLAN value is defined within the switch Model configuration, where VLAN mappings and enforcement actions are configured. The network access policy references this configuration to apply the appropriate VLAN when the policy conditions are met.

In FortiNAC-F, the Network Sessions view provides a real-time and historical log of traffic flows, including source/destination IP addresses, ports, and protocols. This data is essential for building Device Profiling Rules that rely on "Traffic Patterns" or "Network Footprints" to identify devices (e.g., an IP camera communicating with its specific NVR). If the network session view is empty, the system is not receiving the necessary flow or session data from the network infrastructure.
According to the FortiNAC-F Administration Guide, there are two primary methods to populate this view:
NetFlow/sFlow/IPFIX (C): FortiNAC-F can act as a flow collector. By enabling NetFlow settings on the FortiNAC-F service interface (port2/eth1) and configuring your switches or routers to export flow data to the FortiNAC IP, the system can parse these packets and record sessions.
Firewall Session Polling (B): For environments with FortiGate firewalls, FortiNAC-F can proactively poll the FortiGate via the REST API to retrieve its current session table. This is particularly useful as it provides session visibility without requiring the overhead of configuring NetFlow on every access layer switch.