This article focuses on live debug log collection due to its superior effectiveness and level of detail compared to historical log collection. Note the requirements for versions of FortiClientEMS (v7.4.5+), FortiGate (v7.6.4+), and FortiClient (macOS v7.4.4+, Linux v7.4.5+). The scenario that this article will focus on is a user attempting to access an internal resource over a VPN tunnel with ZTNA Posture Tag installed on a firewall policy (IP/MAC Filtering). Example of the policy below:
The live troubleshooting tool will collect diagnostics from FortiClient, FortiClientEMS, and FortiGate CLI. It is best to have Debug log level enabled on both FortiClient and FortiClientEMS before running the tool.
The troubleshooting workflow: Add FortiGate acting as a VPN gateway, and FortiClient having access issues over VPN. Reproduce the issue by connecting FortiClient to the VPN tunnel and attempting to access the resource in question. Wait for 1-2 extra upload intervals to make sure all the required logs have been collected and uploaded.
The next section will discuss the most relevant logs the troubleshooting tool collects when it comes to IP/MAC filtering.
FortiClientEMS Troubleshooting tool log reference.
FortiClient: The tool executes and uploads FortiClient diagnostics, which is the most complete troubleshooting package one can collect. Make sure the log level was set to Debug prior to running the tool for more detailed troubleshooting data. FortiClientEMS: The tool collects server-side diagnostics, which may include logs revealing details like posture tag exchange between FortiClientEMS and FortiGate. FortiGate: The tool runs multiple FortiOS CLI commands related to Zero Trust tags as well as communication between FortiGate and FortiClientEMS.
The troubleshooting tool executes multiple CLI commands on FortiGate the most interesting of which are presented below:
diagnose firewall dynamic list
diagnose debug application fcnacd -1
diagnose endpoint filter show-large-data yes
Here:
diagnose firewall dynamic list - shows 'posture tag - IP' mappings; FortiGate updates FortiClientEMS with FortiClient's VPN IP-address and, in return, receives a list of posture tags the endpoint is matched with. diagnose debug application fcnacd -1 - live diagnostics capturing posture tag data exchange between FortiGate and FortiClientEMS. diagnose endpoint filter show-large-data yes - used as a supplement for the above command and enables better readability of the output (unzips text with tag information).
Reading FortiGate diagnostic output. Typically, FortiClient and FortiClientEMS are easier to troubleshoot when it comes to issues with endpoint matching a posture tag. Refer to Troubleshooting Tip: Troubleshooting of common posture tagging rules in FortiClient EMS. The most complex issues usually 'hide' themselves within the FortiGate CLI output.
Below are FortiGate's CLI log highlights collected by the troubleshooting tool that may be used as a reference for successful IP/MAC Filtering.Â
[fcems_cache_gateway_vpn_act:296] connect 2665C39D4EE1467383FB49594AF45B38: 192.168.120.2/root.
Above line represents FortiClient UID and its VPN tunnel IP-address allocated by FortiGate upon VPN connection.
[ec_ez_worker_prep_data_url:191] Full URL: https://emsha.vpdocs.net/api/v1/report/fct/uid_tags?sn_list[]=FGVM02TMXXXXXXXXX&updated_after=2026-06-22%2017%3A51%3A17%2E426036&uid_offset=2665C39D4EE1467383FB49594AF45B38
[ec_ems_context_submit_work:666] Call submitted successfully.
desc: REST API to get updates of tags associated with FCT UID., entry: api/v1/report/fct/uid_tags.
[ec_ez_worker_process:420] reply:
"""
{"result":{"retval":1,"message":"Returned FCT incremental uid_tags information"},"data":{"uid_offset":"2665C39D4EE1467383FB49594AF45B38","updated_after":"2026-06-22 17:53:01.608523","is_final":false,"is_zipped":false,"unzipped_size":1,"is_share_all":false,"data":{"uid_tag_lists":{"2665C39D4EE1467383FB49594AF45B38":{"members":[{"tag_uid":"8656e600-2904-4551-b27b-5fe946f5c875","tag_name":"all_registered_clients","tag_properties":{"type":"zero_trust"}},{"tag_uid":"6a687606-b732-4f61-b68a-3cdc7d57e514","tag_name":"Remote Workers User Group","tag_properties":{"type":"zero_trust"}},{"tag_uid":"459e5d3e-87f2-4a00-a245-63b604f70364","tag_name":"AV installed and running","tag_properties":{"type":"zero_trust"}}],"host_tag_update_time":"2026-06-22 17:53:01.608523"}}}}}
"""
The above log demonstrates FortiGate making an API call to retrieve posture tags associated with FortiClient connecting to VPN from FortiClientEMS ('desc: REST API to get updates of tags associated with FCT UID'). In response to this call, FortiClientEMS returns a list of tags belonging to the FortiClient in question.
Tip: Filter and search for FortiClient's UID keyword in the log file to identify the interesting logs.
[_add_one_tag:449] Hit tag all_registered_clients, idx 0.
[_add_one_tag:449] Hit tag Remote Workers User Group, idx 1.
[_add_one_tag:449] Hit tag AV installed and running, idx 2.
[ec_shm_tag_update:1139] UID 2665C39D4EE1467383FB49594AF45B38 (FCTEMS8826003790:00000000000000000000000000000000) updated
Then, based on the received data, FortiGate updates existing FortiClient-Tag mappings in its database which results in the output of the command below:
diagnose firewall dynamic list
The command will show posture tags and IP-addresses associated with them (including FortiClient's VPN IP-address:
diagnose firewall dynamic address
CMDB name: EMS1_ZTNA_Remote Workers User Group
TAG name: Remote Workers User Group
EMS1_ZTNA_Remote Workers User Group: ID(137)
ADDR(10.10.11.3)
ADDR(192.168.120.2)
Total IP dynamic range blocks: 0.
Total IP dynamic addresses: 2.
CMDB name: EMS1_ZTNA_AV installed and running
TAG name: AV installed and running
EMS1_ZTNA_AV installed and running: ID(185)
ADDR(10.10.11.3)
ADDR(192.168.120.2)
Total IP dynamic range blocks: 0.
Total IP dynamic addresses: 2
If a log reference above does not help in troubleshooting IP/MAC Filtering, it is recommended to engage Support and share the output from the FortiClientEMS troubleshooting tool.
| 
