FortiNAC-F relies on correctly configured MAC notification (link) traps to detect hosts connecting or moving between ports in real time. If these traps are misconfigured, the system will not receive port-level MAC change events, so newly connected or moved hosts will not be detected as expected.

The template is configured to use a unique role based on the template name. Therefore, when the account is created, the Role field is automatically set to the template name, which is Engineer-Contractor.

In a FortiNAC-F manager and CA architecture, endpoint information is synchronized to the manager in real time as host status changes occur on the managed CAs. This ensures the manager database reflects current endpoint state without requiring manual or scheduled synchronization.

MAC notification traps provide immediate notification when a MAC address is learned or removed on a port, resulting in faster and more accurate visibility updates compared to relying only on link state changes. They also allow FortiNAC-F to learn multiple hosts connected behind downstream unmanaged hubs or switches because each MAC address event is reported individually.

Compliance monitors require the persistent agent to continuously evaluate endpoint conditions such as registry keys and service status. A custom scan must be defined to specify the exact registry key and security service checks that the monitor will assess on the endpoint.