For 30 days after initial FortiClient installation, you can configure and establish a VPN connection to a FortiGate, allowing the endpoint to reach an EMS behind a FortiGate. This is especially useful for remote users, as it allows them to connect to the corporate network to activate their FortiClient license.
The following shows the GUI in this scenario. You can see that the user can access the VPN feature until July 8, 2019, meaning that they initially installed FortiClient 30 days earlier, on June 8, 2019. If the user does not use a VPN tunnel to activate their FortiClient license by 5:29 PM on July 8, as shown, FortiClient revokes the VPN access and all FortiClient features, including VPN, stop working.
Following successful registration to EMS, FortiClient receives a full license if available from EMS. EMS enables all FortiClient features configured on the assigned endpoint profile.
If FortiClient was registered to EMS and licensed for VPN, then becomes unregistered, the free 30-day VPN access becomes available again.
If FortiClient goes offline after registering to EMS, FortiClient features remain enabled for 30 days. You can still establish a VPN connection to the FortiGate in this scenario.