FCSS_LED_AR-7.6 Exam Preparation Material | Fortinet NSE 6 - LAN Edge 7.6 Architect

Explanation:
In this design, FortiAuthenticator receivesRADIUS accounting (RSSO) messages, looks up the user in LDAP to get group information, theninjects FSSO logon eventstoward all FortiGate devices.
From the exhibits we know:
FortiAuthenticatoris receiving RADIUS accountingfrom the RADIUS server.
LDAP queries are successful and return group membership.
But FortiGatedoes not receive FSSO logons, so identity-based policies are not applied.
For FortiAuthenticator to create an FSSO logon, the RADIUS accounting record must be correctlyparsed into at least:
Username
Client IP address
These are mapped from the RADIUS attributes in theRADIUS Accounting SSO clientconfiguration (for example, User-Name and Framed-IP-Address). If these are not defined or mapped incorrectly, FortiAuthenticator can see the accounting packet butcannot build a valid FSSO session, so no update is sent to FortiGate.
Thus the most likely root cause is:
✔ The RADIUS Username and Client IPv4 attributes are not correctly definedfor that RADIUS Accounting SSO client (optionA).
Other options conflict with the scenario:
BC LDAP is already successfully returning groups.
CC FSSO user group attribute is separate; even without it, FSSO logons would still be created (just without group mapping).
DC The interfaceisreceiving RADIUS accounting, so it is clearly enabled.

Explanation:
Context: You’re troubleshootingSyslog-based SSOonFortiAuthenticator:
Devices (typically firewalls, WLAN controllers, VPN gateways) sendsyslog messagescontaining usernames, IPs, login/logout events.
FortiAuthenticator parses those logs usingSyslog SSO rulesand injects logon sessions intoFSSOfor FortiGate.
When users are not mapping correctly, you need to see:
Did the syslog message arrive?
Which matching rule (if any) caught it?
What username and IP were extracted?
Why was a message ignored or rejected?
FortiAuthenticator has a dedicated debug area for this:
Debug logs → Single Sign-On → Syslog SSO
This view shows:
Raw syslog lines received
Thematching ruleapplied (or “no match”)
Parsed fields (username, IP, group)
Any parsing errors
This is exactly the tool designed totroubleshoot and diagnose Syslog SSO issues.
Why the other options are not the best for this issue
A. Debug logs > Remote Servers > Syslog Viewer
Lets you see syslog traffic in general, but doesnotshow how SSO rules are applied or why they fail.
Good for connectivity checks, not SSO logic.
B. Parsing Test Tool
Useful totestpatterns and rules manually by pasting sample log lines, but it doesn’t show live traffic or running SSO sessions.
C. Debug logs > SSO Sessions page
Shows existing SSO sessions (who is logged in), but notwhya particular syslog message did not create a session.

Explanation:
From the exhibits:
FortiSwitch Ports viewshows:
port2
Mode: Static
Native VLAN: Students
Allowed VLANs: quarantine.fortilink (quarantine)
NAC policy “Training”:
Switch FortiLink: fortilink
Category:Device
Matching criteria:
MAC Address: 70:88:6b:8c:4b:0e (enabled)
Operating System:Linux(enabled)
Switch Controller Action:
Assign VLAN = Students
Bounce Port = enabled
Design intent:
Device with that MAC + OS Linux, when plugged intoport2, should be dynamically moved to VLANStudentsby the NAC policy.
Why it doesn’t work now
On FortiLink NAC,dynamic NAC decisions only apply on ports whose “Access Mode” is set to NAC:
NAC mode = FortiGate controls theonboarding VLAN, evaluates NAC policies, and then dynamically reassigns the switch port VLAN (access, quarantine, etc.).
Static mode(what we see on port2) means the port just uses its configurednative/allowed VLANs, andno NAC classificationhappens.
Right now:
port2 is astatic access portwith Native VLAN = Students.
The NAC policy exists, butFortiSwitch is not in NAC enforcement mode on that port, so the policy is never evaluated for traffic on port2.
Therefore, themissing configurationis:
Setport2toNAC mode(sometimes called “Access mode: NAC” or “NAC LAN edge port”).
Once port2 is changed to NAC mode:
Device initially lands in the onboarding/quarantine VLAN.
FortiGate collects device info (MAC, OS, etc.).
NAC policy “Training” matches MAC + Linux.
Switch controller actionAssign VLAN = Studentsis applied.
Port is bounced (if configured), bringing the device back up in VLAN Students.
Why the other options are wrong
B. MAC or OS misconfigured
Possible in general, but the question asks forwhich configuration is missing, and the exhibits clearly focus on port mode. Also, even with wrong MAC/OS, the port would still be in NAC mode; here NAC isn’t even active.
C. Port Policy mode
Port policy (edge/trunk) is separate from NAC; NAC requires the specificNAC access mode.
D. Students VLAN should be Allowed VLANs instead of Native VLAN
For an access port, having Students as thenative VLANis correct. NAC policy’s Assign VLAN will set that as access VLAN; no need to make it an allowed trunk VLAN.

Explanation:
On FortiLink, FortiGate’s built-in DHCP server is what gives FortiSwitch its IP so it can come under management.
For automatic FortiSwitch onboarding, the DHCP server is usually set with:
set vci-match enable
set vci-string "FortiSwitch" "FortiExtender"
In the exhibit, the DHCP server for fortilink has:
set vci-match enable
set vci-string "FortiExtender"
Because theVCI string doesn’t include “FortiSwitch”, DHCP offers are only sent to clients whose Vendor Class Identifier matchesFortiExtender. The FortiSwitch never receives an IP, so it staysOffline.
OptionBis wrong: member "port4" matches the physical cabling in the topology.
OptionCis fine: FortiLink can be anaggregateinterface, not only physical.
OptionA(ip-managed-by-fortiipam) is unrelated; FortiIPAM isn’t required here.