Technical Tip: FortiNAC unable to communicate with FortiClient EMS

Description

This article describes how to address communication issues between FortiClient EMS and FortiNAC.
 

Scope

FortiNAC and FortiClient EMS.

Solution

There are some cases where FortiNAC cannot communicate with FortiClient EMS.

1. This can happen if the Root certificate that signs the EMS certificate is not imported to FortiNAC. In this case, a certificate warning is expected on the logs.

2. If the FortiNAC source IP (usually port1) is not added to the Trusted Hosts list under Administration -> Administrators pane configured on FortiClient EMS, this will prevent FortiNAC from communicating with FortiClient EMS and will result in the following error in the output.master:

2026-04-21 12:16:08.477 +0200 [https-jsse-nio-192.168.0.1-8443-exec-31] DEBUG yams.FortinetEMSServer - message = Your host is not trusted. Please log in via a trusted host.

2026-04-21 12:16:08.478 +0200 [https-jsse-nio-192.168.0.1-8443-exec-31] DEBUG yams.FortinetEMSServer - auth response is null, authentication likely failed

2026-04-21 12:16:08.478 +0200 [https-jsse-nio-192.168.0.1-8443-exec-31] DEBUG yams.FortinetEMSServer - testConnection() retval = Failed to read Fortinet EMS device : authentication failed.

These messages may only be visible with the FortinetEMSServer debug module enabled.

diagnose debug plugin enable FortinetEMSServer
diagnose debug plugin list-debug-enabled

          Loader          |            Name              |          Debug
__________________________|______________________________|_____________________
141 MasterLoader          |FortinetEMSServer             |true

Reproduce the connection attempt, download the logs, and verify the behavior. For more on log downloading, see Technical Tip: How to get a debug log report from FortiNAC-CA or FortiNAC-Manager.

Disable the module after verifying the logs.

diagnose debug plugin disable FortinetEMSServer
diagnose debug plugin list-debug-enabled

          Loader          |            Name              |          Debug
__________________________|______________________________|_____________________

Related article:

Technical Tip: Integration between FortiClient EMS and FortiNAC