Fortinet black logo

EMS Administration Guide

FortiClient EMS integrated with FortiGate

FortiClient EMS integrated with FortiGate

The diagram below shows the topology when using FortiClient EMS integrated with FortiGate.

In this scenario, FortiClient EMS provides FortiClient endpoint provisioning, while the FortiGate provides compliance rules to the endpoint. FortiClient endpoints connect FortiClient Telemetry to FortiClient EMS to receive configuration information from FortiClient EMS and receive compliance rules from the FortiGate. Profiles can also be imported from the FortiGate to FortiClient EMS, then pushed to the endpoints. Also see Using EMS integrated with FortiGate.

When viewing the endpoint in the FortiClient EMS GUI, the endpoint's connection is shown as FortiTelemetry to FGT<number> and Managed by EMS.

Label

Description

A

This shows the endpoint is connected to the specified FortiGate and is compliant to security policy rules defined under FortiClient profiles on that FortiGate.

B

This shows the endpoint is connected to and receiving compliance rules from the specified FortiGate. Click the menu icon to view the FortiGate's IP address, hostname, and serial number.

C

When FortiClient Telemetry is connected to FortiGate, you can view the compliance rules from FortiGate. The compliance rules communicate the configuration required for FortiClient Console and the endpoint to remain compliant. When the endpoint has a non-compliant status, an exclamation mark indicates which compliance rules are not met. See below for an example of the FortiClient Console GUI when the endpoint is not compliant.

D

View the FortiClient EMS server's name. This indicates FortiClient EMS is managing and provisioning configuration to the endpoint. Click the menu icon to view the FortiClient EMS server's IP address, hostname, and serial number.

The below shows an example of the FortiClient Console when the endpoint is not compliant with FortiGate compliance rules and may be blocked from accessing the network.

You have some time to fix the non-compliant issues before FortiGate blocks network access. When an endpoint has a non-compliant (blocked) status, you can identify which compliance rules are causing the non-compliant status under Compliance Policy as seen above.

You can fix non-compliant settings by clicking Fix Non-compliant Settings. For details, see the FortiClient Administration Guide.

The image below shows the FortiOS GUI. In this situation, frank-PC and LHWin7A represent two endpoints connected to the FortiGate. frank-PC is also managed by FortiClient EMS. There is no flag to identify between the scenarios.

FortiClient EMS integrated with FortiGate

The diagram below shows the topology when using FortiClient EMS integrated with FortiGate.

In this scenario, FortiClient EMS provides FortiClient endpoint provisioning, while the FortiGate provides compliance rules to the endpoint. FortiClient endpoints connect FortiClient Telemetry to FortiClient EMS to receive configuration information from FortiClient EMS and receive compliance rules from the FortiGate. Profiles can also be imported from the FortiGate to FortiClient EMS, then pushed to the endpoints. Also see Using EMS integrated with FortiGate.

When viewing the endpoint in the FortiClient EMS GUI, the endpoint's connection is shown as FortiTelemetry to FGT<number> and Managed by EMS.

Label

Description

A

This shows the endpoint is connected to the specified FortiGate and is compliant to security policy rules defined under FortiClient profiles on that FortiGate.

B

This shows the endpoint is connected to and receiving compliance rules from the specified FortiGate. Click the menu icon to view the FortiGate's IP address, hostname, and serial number.

C

When FortiClient Telemetry is connected to FortiGate, you can view the compliance rules from FortiGate. The compliance rules communicate the configuration required for FortiClient Console and the endpoint to remain compliant. When the endpoint has a non-compliant status, an exclamation mark indicates which compliance rules are not met. See below for an example of the FortiClient Console GUI when the endpoint is not compliant.

D

View the FortiClient EMS server's name. This indicates FortiClient EMS is managing and provisioning configuration to the endpoint. Click the menu icon to view the FortiClient EMS server's IP address, hostname, and serial number.

The below shows an example of the FortiClient Console when the endpoint is not compliant with FortiGate compliance rules and may be blocked from accessing the network.

You have some time to fix the non-compliant issues before FortiGate blocks network access. When an endpoint has a non-compliant (blocked) status, you can identify which compliance rules are causing the non-compliant status under Compliance Policy as seen above.

You can fix non-compliant settings by clicking Fix Non-compliant Settings. For details, see the FortiClient Administration Guide.

The image below shows the FortiOS GUI. In this situation, frank-PC and LHWin7A represent two endpoints connected to the FortiGate. frank-PC is also managed by FortiClient EMS. There is no flag to identify between the scenarios.