Skip to main content
Rsoufiane
Rsoufiane
New Member
July 2, 2021
Question

Failed to apply On-fabrci rules

  • July 2, 2021
  • 1 reply
  • 2322 views

Hi, We have aroud 3k Forticlients used to establish a SSL/IPSec VPN with a fortigate.They are managed by a FortiEMS

On FortiEMS, we configured "on-fabric detection rules" with a LocalIP/subnet rule type so that the forticlient detects when the user is off fabric (when his IP changes) and shows him a list of VPN that he can connect to. The problem (i think) is when the user is at home, the FC doens't detect the change in the IP adress and consider him still "on fabric" so he doesn't show him the VPN list.

We tried ipconfig/release and renew and reload the computer but the problem persist. Versions : FC : 6.4.4.1655 and FEMS 6.4.4 build 1658

Thank you.

1 reply

fcb
fcb
Visitor III
July 21, 2021

that's exactly right.... If you are "off-net" but cannot reach EMS, you'll not be able to talk to the server and get the other policy for "off-net". We setup split DNS so that our EMS server is accessible from the inside or outside. (ie: ems.yourdomain.com = 12.13.14.15 or your WAN IP block and ems.yourdomain.com on the inside = 10.11.12.13) All you need is a VIP on your gate to allow TCP.8013 into the EMS from the WAN

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!