Troubleshooting Tip: FortiEDR Collector is in disconnected state in the Central Manager with FortiSASE

In a typical scenario, the FortiEDR Collector registers with the Central Manager and displays a 'Running' state. However, when a machine operates with the FortiSASE SIA agent in deep inspection mode, the Collector machines enter a 'Disconnecte' state.

1. FortiClient establishes the SSL VPN connection to FortiSASE SIA:

2. Once the SSL VPN is established, the Collector cannot connect to the Central Manager:

3. In the Central Manager, confirm the Collector is in a Disconnected state

4. In the FortiSASE portal, go to Configuration -> TRAFFIC -> Security to check deep inspection is enabled
5. If deep inspection is enabled, create the entry for FortiEDR Aggregator IP/FQDN and assign it to Exemption in the SSL Inspection profile

6. Confirm the FortiEDR Collector status is Connected to the machine and Running in the Central Manager.

Another solution is to set up a split tunneling in FortiSASE. Visit the guide for more information about the settings.