The User/Host Profile is the primary mechanism in FortiNAC-F for identifying and categorizing endpoints to determine their level of network access. According to the FortiNAC-F Administration Guide, a profile is built using a combination of criteria that define "Who" is connecting, "What" device they are using, and "Where" they are located on the network.
The three main categories of criteria available in the configuration are:
Host or User Attributes (B): This includes specific details such as the host's operating system, the user's role (e.g., Employee, Contractor), or custom attributes assigned to the record.
Host or User Group Memberships (A): Profiles can be configured to match endpoints that are members of specific internal FortiNAC groups or synchronized directory groups (like LDAP or Active Directory groups). This allows for broad policy application based on organizational structure.
Location (E): The "Where" component allows administrators to restrict a profile match to specific physical or logical areas of the network, such as a particular switch, a group of ports, or a specific SSID.

In a 1+1 High Availability (HA) deployment, FortiNAC-F supports two primary methods for management access: individual IP addresses or a Shared IP Address (also known as a Virtual IP or VIP). The Shared IP option is part of a Layer 2 HA design, which simplifies administration by providing a single URL or IP that always points to whichever appliance is currently in the "Active" or "In Control" state.
For a Shared IP configuration to function correctly, the Primary and Secondary administrative interfaces (port1) must be on the same subnet. This requirement exists because the Shared IP is a logical address that is dynamically assigned to the physical interface of the active unit. Since only one unit can own the IP at a time, both units must reside on the same broadcast domain (Layer 2) to ensure that ARP requests for the Shared IP are correctly answered and that the gateway remains reachable regardless of which unit is active. If the appliances were on different subnets (a Layer 3 HA design), a shared IP could not be used because it cannot "float" across different network segments; instead, administrators would need to manage each unit via its unique physical IP or use a FortiNAC Manager.
"For L2 HA configurations, click the Use Shared IP Address checkbox and enter the Shared IP Address information... If your Primary and Secondary Servers are not in the same subnet, do not use a shared IP address. The shared IP address moves between appliances during a failover and recovery and requires both units to reside on the same network."

MAC notification traps must be enabled on all ports of a supported switch so FortiNAC-F can receive MAC address learning and movement events regardless of where endpoints connect.
This comprehensive coverage ensures accurate device discovery, tracking, and enforcement across the entire switch.

In FortiNAC-F, the expiration of a guest or contractor account is determined by the configuration settings within the Account Creation Wizard and the associated Guest/Contractor Template.
While a template can define a default "Account Duration" (as seen in the 12-hour setting in the second exhibit), the Account Creation Wizard allows an administrator to manually specify or override the start and end parameters for a specific user session.
According to the FortiNAC-F Administration Guide regarding guest management, the Account End Date field in the creation wizard is the definitive timestamp for when the account object will be disabled or deleted from the system. In the provided exhibit (Account Creation Wizard), the administrator has explicitly set the Account Start Date to 2025/09/12 08:00:00 and the Account End Date to 2025/09/13 17:00:00.
Even though the template indicates an "Account Duration" of 12 hours, this value typically serves as a pre-populated default. When a manual date and time are entered into the wizard, those specific values take precedence for that individual account. The account will remain active and valid until 5:00 PM (17:00:00) on the following day, 2025/09/13. It is also important to note the
"Login Availability" from the template (8:00 AM - 7:00 PM); while the account exists until the 13th at 17:00:00, the user would only be able to authenticate during the active hours defined by the login schedule on both days.
"When creating an account, the administrator can select a template to provide default settings.
However, specific values such as the Account End Date can be modified within the Account Creation Wizard. The date and time specified in the 'Account End Date' field determines the absolute expiration of the account. Once this time is reached, the account is moved to an expired state and the user's network access is revoked."

Each matched security filter generates its own security event. Since the trigger is configured to match any one filter within the defined time limit, multiple matched filters will generate multiple events, but only one security alarm is created when the security rule condition is satisfied.