Technical Tip: FortiClient EMS with Multitenancy enabled
Description
This article describes how to enable FortiClient EMS with multi-tenancy.
Scope
FortiClient.
Solution
With FortiClient EMS multitenancy, it is possible to create multiple sites to provide granular access to different sites for different administrators and separate endpoint data and configuration into different sites.
The site are completely separate from each other and cannot share data between them. For example, if an administrator only has access to Site A, the data is not possible from any other site.Â
To enable this option, go to the EMS setting and enable 'Manage Multiple Customer Sites'. See Enabling and configuring multitenancy.
To configure EMS multitenancy, it is necessary to use a third-level FQDN like in this example below (Global panel) and make sure the option 'use FQDN' is enabled. (e.g. ems.somedomain.it).
To point the FortiGate to the 'Default' site, use the name 'default.ems.somedomain.it'.
The name of the site necessary to access from the FortiGate and created on the FortiClient EMS must reflect the FQDN on the DNS.
To establish the Fabric Connector from the FortiGate side, see Multitenancy.
Â
FQDN needs to be used instead of IP address.
The 'site.fqdn' format needs to be used in the FortiGate configuration to integrate FortiGate to specific Multitenant sites on FortiClient EMS (for example, 'site1.ems.example.com') or 'default.ems.example.com' to access the default site.
Note: When connecting a FortiGate to MultiTenancy FortiClient EMS, ensure that it is always connecting to the specific multitenant site and not the Global site. In a multi-VDOM FortiGate, the connection from FortiGate is set up on the Global VDOM to the specific multitenant site.
FortiGate side example:
It is possible to create a DNS entry:
config system dns-database
  edit "EMS_Entry"
    set domain "site1.ems.example.com"
      config dns-entry
        edit 2
          set hostname "@"
          set ip X.X.X.X
        next
      end
  next
end
