New Member

Solved

Assistance Required with EMS Tag and Firewall policy

Forum|Forum|1 year ago
July 16, 2025
17 replies
2536 views

Hi Team,
We have integrated the FortiGate firewall with FortiClient EMS and are currently in the process of applying posture checks, specifically focusing on enforcing Antivirus (AV) software compliance on vendor laptops.

The tags created within FortiClient EMS are being correctly pushed to both the FortiGate firewall and the FortiClient. These tags have been referenced in a firewall policy associated with remote VPN access. However, we are encountering an issue: when the VPN connection is established and the EMS tag is active, the destination resources become unreachable, despite the antivirus being installed and running properly on the vendor's workgroup laptop.

We are testing on Azure IdP user and create a separate user for the vendor.

Conversely, when the EMS tag is not applied, the destinations are reachable without any issues.

Could you please advise what might be causing this behavior and suggest possible steps to resolve it?

Thank you for your support.

Best answer by muhammadsaad

The issue has been resolved. Essentially, in a remote access setup, the same tag must be applied to both the remote access profile on the EMS and the corresponding firewall policy.

funkylicious

SuperUser

hi,

in the firewall rule in question for access, do you have it created as standard with source vpn group and vpn address object and also using IP/MAC Based Access Control w/ the tag ?

upon executing diagnose firewall dynamic list, for the tag you use do you see the clients vpn address assigned to him ?

"jack of all trades, master of none"

muhammadsaadAuthor

New Member

Hi, Thanks for your reply.
Yes, standard firewall rule is created with source vpn group and vpn address object along with IP/MAC Based Access Control w/ the tag

Please let us know do I need to run the below command after connecting to the remote VPN?
execute diagnose firewall dynamic list

Moreover, please advise the work around for this

funkylicious

SuperUser

yes, the command shoukd be executed after the user connects to the VPN.

forticlient will send via telemetry to EMS the info about the device and EMS will/should pass the info to FGT.

i am not aware of any workarounds atm

"jack of all trades, master of none"

muhammadsaadAuthor

New Member

I will be glad if someone else can help out on this EMS tag posture (Antivirus) software compliance.

sharmar

Staff & Editor

Hello @muhammadsaad,

Very first, AV security posture tag is for Forticlient AV only, if you are testing with 3rd party AV, it will not work,

Secondly, when you the issue, are you able to the tag is question on the fct and EMS ?

muhammadsaadAuthor

New Member

Hi, Thanks for your reply and helping out.

The tag i created on EMS gets directly from firewall towards forticlient.

Moreover, please let me know from where I can get Forticlient AV only in order to check and run the posture compliance part.

muhammadsaadAuthor

New Member

I am trying to implement the Antivirus software using the security posture tag on windows based devices but its not working. Refer below document link as well as snap in which its mentioned that 3rd party AV applications are supported

https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/342488/security-posture-tagging-rule-types

Can some one help out what could be the issue.

FortiDor

Explorer II

Hello @muhammadsaad

You have some specific options if you are using the FortiClient AV directly or if you are running a 3rd party AV. The "AntiVirus Software" tag is working with the Windows Security Center to provide the information.

If you need more debug log, please specify the Debug level of the FCT in "debug" and check the logs at "C:\Program Files\Fortinet\FortiClient\logs\trace\FortiESNAC_1.log"
You will have the information if the AV tag is not working

On my side, I prefer create a regedit tag and check some specific value from the AV
Example : status is up / working and some specific values

Occasionally, the AV tag may generate some instability due to its adherence to Windows

muhammadsaadAuthor

New Member

Hi, Thanks for your reply.

What I need to do for regedit tag creation in forticlient EMS. We have download the forticlient from support portal and trying to implement this AV Software feature.

What i understand is that, after the tag is called on the firewall policy, there is no destination reachable.

So I am struggling to find the way to come out of this problem.

FortiDor

Explorer II

Hi,

Here is the documentation to setup the registry tag in the FortiClient EMS :

Capture d'écran 2025-07-21 084058.png

You can find the installation source of your FortiClient directly in your EMS and not only in the support portal.

Once the tag is evaluated by the EMS, the IP Range used by your FortiClient is shared with the FortiGate and the traffic policy allow the traffic untill the destination.

You need to check that everything is connected between your FortiClient EMS and your FortiGate with the Security Fabric to be able to work.

muhammadsaadAuthor

New Member

Hi @FortiDor
The connectivity between fortigate, forticlient and EMS is working fine as we have created a remote access vpn policies on the EMS that are getting pushed and VPN is getting connected.

As far as the regedit tag, they are related to the specific browser where as my ultimate goal is to apply the AV Software feature on all type of windows based laptop devices.

Below is the EMS tag created:

muhammadsaadAuthor

New Member

Anyone can guide?

FortiDor

Explorer II

Seems good for me @muhammadsaad

What’s the issue with the AV Tag for the Windows devices ?

I don’t understand your request

muhammadsaadAuthorAnswer

New Member

The issue has been resolved. Essentially, in a remote access setup, the same tag must be applied to both the remote access profile on the EMS and the corresponding firewall policy.

Sign up

Login with SSO

Login to the community

Login with SSO