Because two hosts were learned on the same switch port, FortiNAC-F must enforce access at the port level rather than per-host. With a single isolation VLAN configured, the port is placed into the isolation network to ensure the port's learned devices are restricted and can be forced through the registration/isolation workflow.

In an N+1 HA architecture managed by a FortiNAC-F Manager, if a primary CA fails, an available secondary CA is automatically promoted to primary. After CA-2 fails, CA-3 is promoted to a primary role, and the FortiNAC-F Manager load balances management and enforcement responsibilities between the remaining primary CAs, CA-1 and CA-3.

Modeling the endpoint as a device in the inventory allows FortiNAC-F to retain historical connection data for that device, providing visibility into past connectivity events and behavior over time.

The dissolvable agent is designed to be executed at user login and does not require permanent installation on the endpoint. This makes it suitable for deployment through domain login scripts, where it can run temporarily to collect endpoint posture and visibility information and then remove itself after execution.

RADIUS accounting must be enabled on FortiGate so it sends session start and stop records to FortiNAC-F. These accounting messages provide real-time VPN session status updates, allowing FortiNAC-F to track user connections and enforce appropriate network access policies.