On-net Detection Rules
You can configure on-net detection rules for endpoints. EMS uses the rules to determine if the endpoint is on-net or off-net. Depending on the endpoint's on-net status, EMS may apply a different profile to the endpoint, as configured in the applied endpoint policy. See Adding an endpoint policy.
On-net detection rules do not apply to endpoints running FortiClient 6.2.1 and earlier versions. For endpoints running FortiClient 6.2.1 and earlier versions, the On-Net Subnets setting in the endpoint profile determines on-net/off-net status. See System Settings. |
To add an on-net detection rule:
- Go to Policy Components > On-net Detection Rules.
- Click Add.
- In the Name field, enter the desired name.
- Enable or disable the rule by toggling Enable Rule on or off.
- In the IP Addresses/Subnet Masks field, enter the desired values. You can enter multiple values by clicking the + button.
- (Optional) In the Gateway MAC Addresses field, enter the desired values. You can enter multiple values by clicking the + button.
- Click Save.
To edit an on-net detection rule:
- Go to Policy Components > On-net Detection Rules.
- Select the rule.
- Click Edit.
- Edit as desired.
- Click Save.
To delete an on-net detection rule:
- Go to Policy Components > On-net Detection Rules.
- Click the desired rule.
- Click Delete.
- In the confirmation dialog, click Yes.
To enable/disable an on-net detection rule:
- Go to Policy Components > On-net Detection Rules.
- Select or deselect the Enabled checkbox for the desired endpoint policy.
Determining on-net/off-net status
There are two settings in EMS that affect FortiClient on-net/off-net status:
- DHCP on-net/off-net
- On-net detection rules configured for the endpoint's assigned policy
The table below shows how the DHCP on-net/off-net setting, on-net detection rules, and Option 224 serial number affect the endpoint's on-net/off-net status. DHCP on-net/off-net only applies when the endpoint is connected to EMS. You can configure Option 224 with any Fortinet device's serial number. EMS assumes that FortiClient is behind a FortiGate and on-net with that FortiGate.
DHCP on-net/off-net |
On-net detection rules |
Option 224 serial number |
Resulting endpoint status |
---|---|---|---|
Disabled |
Not configured |
N/A |
Endpoint is on-net when registered to EMS. |
Enabled |
Not configured |
Not configured |
Endpoint is off-net when registered to EMS. |
Enabled |
Not configured |
Configured |
On-net Since Option 224 is configured with a Fortinet device's serial number, EMS assumes FortiClient is on-net with that FortiGate. |
N/A |
Enabled, with subnet configured. |
N/A |
On-net The endpoint is inside the on-net networks configured in the applied endpoint policy's on-net detection rules. |
N/A |
Enabled, with subnet configured. Endpoint IP address is not in the configured subnet. |
N/A |
Off-net The endpoint is outside the on-net networks configured in the applied endpoint policy's on-net detection rules. |
An endpoint has an offline off-net status when it cannot connect FortiClient Telemetry to EMS and is outside any of the on-net networks.
An endpoint has an offline on-net status when it cannot connect FortiClient Telemetry to EMS but is inside one of the on-net networks, or if no on-net rules are configured within the assigned policy.