FortiClient VPN Deployment via SOTI MDM on iOS Devices

Hello FIB-DB, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Regards,

Regards,

Hello again ,

I found this answer, can you tell us if it helps, please?

Summary

Yes: FortiClient VPN on iOS can be deployed with MDM-managed VPN profiles, but the iOS approach is different from Android. Fortinet’s iOS documentation shows that FortiClient can consume MDM-pushed VPN profiles and display them under MDM VPN Gateway in the app [6][9][12]. However, the retrieved Fortinet documentation is written for Microsoft Intune, not SOTI MobiControl, so there is no Fortinet source here that explicitly validates SOTI-specific steps or templates [6][9][12].

What is supported on iOS

1. Automatic deployment of VPN configuration

Fortinet documents two iOS deployment methods that are MDM-friendly:

• Create a VPN profile in the MDM using Custom VPN with FortiClient’s VPN identifier com.fortinet.forticlient.fabricagent [12][14].
• Create an Apple mobileconfig profile and push it from the MDM; FortiClient then lists it under MDM VPN Gateway [9][11].

This indicates that automatic deployment of FortiClient VPN configuration on iOS is supported in principle through an MDM-delivered VPN profile [9][12].

2. Certificate-based authentication can be preconfigured

Fortinet explicitly documents preconfiguring certificate authentication for FortiClient on iOS by pushing:

• a VPN profile
• and an associated PKCS or SCEP certificate [6][7][8]

For this model, FortiClient receives the certificate from MDM, and the certificate appears in the tunnel details as MDM Managed [6].

3. Username/password profile deployment is possible, but credential prefill is limited

Fortinet also documents creating an iOS VPN profile with Username and password authentication [12][14].
However, an important limitation is documented: Intune does not have fields to pass username and password credentials when using that authentication type. The workaround is to have the user connect once manually in FortiClient and enable Save Password [12][13][14].

While this statement is specifically about Intune, it strongly suggests that on iOS, credential handling is more constrained than on Android. Whether SOTI can pass credentials differently could not be verified from the retrieved Fortinet documents.

Recommended approach for iOS

Best-supported Fortinet approach: MDM-delivered profile + certificate auth

The clearest Fortinet-documented iOS deployment path is:

1. Push the FortiClient app to iOS devices via MDM.
2. Push a VPN profile using Custom VPN [6][12].
3. Set VPN Identifier to com.fortinet.forticlient.fabricagent [12][14].
4. If using certificate auth, assign a PKCS or SCEP certificate to the VPN profile [6][7].
5. After sync, FortiClient should show the tunnel under MDM VPN Gateway [6][9][12].

This is the most complete documented enterprise deployment pattern in the retrieved sources [6][9][12].

Alternative: mobileconfig-based deployment

Fortinet also documents creating the VPN profile in Apple Configurator and then pushing the resulting mobileconfig through MDM [9][10][11].
For this method, the profile uses:

• Identifier: com.fortinet.forticlient.fabricagent
• Provider Bundle Identifier: com.fortinet.forticlient.fabricagent.packettunnel [9][11]

This is useful if your MDM can import or deploy Apple configuration profiles more easily than building a custom VPN payload natively [9][11].

Native iOS IKEv2 as another option

Fortinet also documents that for iOS remote IPsec VPN, IKEv2 is the supported approach for current FortiClient releases [1].
Separately, Fortinet documents use of the Apple native VPN client with IKEv2, including MDM-style configuration fields such as:

• Server
• Remote Identifier
• Local Identifier
• Shared Secret / authentication settings
• Always-on VPN (supervised only) [3]

So if your goal is simply VPN connectivity on iPhone/iPad, and not specifically use of FortiClient-managed SSL VPN profiles, the native iOS IKEv2 VPN may also be a viable deployment model through MDM [3].
What could not be verified from the provided documents is whether this native-client route is preferred over FortiClient app deployment specifically for SOTI.

iOS limitations and differences vs Android

The retrieved Fortinet docs show several iOS-specific constraints:

User interaction is still likely in some scenarios

Fortinet notes that after installing FortiClient on iOS and opening it for the first time, users must accept several pop-up notifications before proceeding [1].
This implies that a fully zero-touch experience may be harder on iOS than Android.

Username/password prepopulation is limited

For iOS MDM-deployed FortiClient VPN profiles using username/password auth, Fortinet documents that Intune cannot pass those credentials directly, requiring manual first connection and optionally saving the password [12][13][14].
This is a notable usability gap compared with Android-style app configuration workflows.

Limited documented custom attributes on iOS

For iOS managed FortiClient VPN profiles, Fortinet documents only a small set of key-value pairs in the certificate-authentication guide:

• SingleSignOn = True/False
• ShowSavePassword = True/False [6][7][8]

That suggests iOS app/VPN profile customization is narrower than on Android.
A separate Intune example screenshot shows attributes such as SSO, AlwaysUp, and SavePassword [12][14], but the retrieved text does not fully standardize or explain those for SOTI use. So the full supported attribute set for iOS could not be conclusively verified from these documents.

Formatting sensitivity

For the certificate-based Intune deployment, Fortinet states the VPN server address format is strict and the port is mandatory; if the profile is not parsed correctly, it will not appear in FortiClient [6][7][8].
This is important for any MDM implementation, including SOTI, if it builds an equivalent custom VPN payload.

What Fortinet documentation exists for SOTI specifically

No SOTI-specific Fortinet deployment guide was retrieved.

The available official Fortinet documentation covers:

• FortiClient iOS VPN profile deployment with Intune [6][9][12]
• FortiClient manual configuration on iOS for IPsec/IKEv2 [1]
• Apple native iOS IKEv2 VPN to FortiGate [3]

So the following could not be verified from the provided documents:

• A Fortinet official guide specifically for SOTI MobiControl
• Whether SOTI Managed App Configuration for FortiClient iOS is officially supported
• Whether SOTI can prepopulate username/password for FortiClient iOS in a supported way
• A Fortinet-published list of SOTI-specific payload keys for FortiClient on iOS

Practical guidance for your environment

Given the retrieved Fortinet documentation, the safest iOS approach is:

Option A: Use SOTI to push a FortiClient-compatible iOS VPN profile

Replicate the Fortinet Intune model in SOTI if SOTI supports:

• Custom VPN payloads
• iOS app-specific VPN identifiers
• certificate assignment via PKCS/SCEP
• custom key/value attributes

Use these FortiClient identifiers from Fortinet docs:

• com.fortinet.forticlient.fabricagent
• com.fortinet.forticlient.fabricagent.packettunnel [9][12]

Option B: Use Apple mobileconfig via SOTI

If SOTI can deploy .mobileconfig files, this aligns closely with Fortinet’s documented Apple Configurator workflow [9][11].

Option C: Use native iOS IKEv2 instead of FortiClient-managed profile

If your requirement is remote access VPN and not specifically SSL VPN in FortiClient, Fortinet documents native iOS IKEv2 deployment and recommends IKEv2 for new iOS VPN deployments [1][3][4].

Bottom line

• Yes, FortiClient VPN configuration on iOS can be deployed automatically through MDM in principle; Fortinet documents this for Intune and Apple mobileconfig workflows [6][9][12].
• Yes, certificate-based authentication can be preconfigured and is the most clearly documented managed deployment model for iOS [6][7][8].
• Username/password deployments on iOS are more limited; Fortinet documents a manual-user step/workaround in the Intune case [12][13][14].
• iOS is more restrictive than Android in the retrieved docs, especially around credentials, first-run prompts, and narrower documented configuration keys [1][6][12].
• No Fortinet SOTI-specific deployment guide was provided in the retrieved material, so SOTI-specific support and exact payload mapping could not be verified.

Hi There,

On our android devices we can push the EMS server key down through soti which helps user connect automatically. 

Is it possible to create it so we can do same with apple?

Hello again FIB-DB,

I found this answer, does it help you?

Pushing EMS Server Key to FortiClient on iOS via SOTI MobiControl

Overview

On Android, you can use SOTI MobiControl’s Managed App Configuration to push the ems_server key (and related settings) to FortiClient, enabling automatic EMS registration. You are asking if the same is possible for Apple iOS devices.

iOS Support for Managed App Configuration

Yes, FortiClient (iOS) supports Managed App Configuration via MDM, including SOTI MobiControl, for certain keys—including ems_server.

Supported Keys for iOS (via Managed App Configuration)

• ems_server: EMS server IP address or FQDN
• ems_port: EMS port number
• mac_address: iOS device MAC address (can use {DeviceWLANMac} placeholder)
• udid: iOS device UDID (can use {DeviceUid} placeholder)
• group_tag: EMS group assignment
• ems_key: Telemetry connection key (if required)
• invitation_code: For FortiClient Cloud or on-prem EMS (FortiClient 7.2.3+)
• cloud_invite_code: For FortiClient Cloud (legacy)

Reference:
See the context above for the full list of supported keys.

How to Configure in SOTI MobiControl

1. Select the FortiClient app in your SOTI MobiControl console.
2. Go to Managed App Configuration (or Application Configuration).
3. Add the required keys (e.g., ems_server, ems_port, etc.) and their values.
   • Example:
     • ems_server: 172.17.81.98
     • ems_port: 8013
     • mac_address: {DeviceWLANMac}
     • udid: {DeviceUid}
4. Save and deploy the configuration to your iOS devices.

When the FortiClient app is installed on the iOS device, it will read these keys and attempt to connect to the specified EMS server automatically, just like on Android.

Limitations and Notes

• User Interaction: The first time FortiClient is launched on iOS, users may still need to accept some permissions or prompts due to iOS security restrictions.
• Key Support: Ensure you are using a FortiClient (iOS) version that supports these keys (7.2.x and later recommended).
• SOTI UI: The exact steps and field names may vary slightly depending on your SOTI MobiControl version.

Official Documentation

While Fortinet provides documentation for Managed App Configuration (primarily referencing Intune and Workspace ONE), the same key/value approach applies to any MDM that supports Managed App Configuration, including SOTI.

• FortiClient EMS Administration Guide – Group Assignment Rule Types
• FortiClient (iOS) Administration Guide

Summary Table

| Key | Example Value | Description | |-------------|-------------------|------------------------------------| | ems_server | 172.17.81.98 | EMS server IP/FQDN | | ems_port | 8013 | EMS port | | mac_address | {DeviceWLANMac} | Device MAC address (placeholder) | | udid | {DeviceUid} | Device UDID (placeholder) | | group_tag | sales | EMS group assignment (optional) |

Follow-up & Clarification

• Are you using the latest FortiClient (iOS) version (7.2.3 or later)?
• Do you need to push additional keys (e.g., group_tag, ems_key)?
• Are you seeing any issues when deploying the configuration to iOS devices?
• Would you like step-by-step SOTI MobiControl UI instructions or a sample XML?

Let me know if you need further details or troubleshooting steps!

iOS is more restrictive than Android for VPN deployment. SOTI can push the FortiClient app and supported managed configurations, but VPN profiles and authentication options depend on FortiClient’s iOS support and may still require some user interaction. I’d check the latest Fortinet and SOTI documentation for supported iOS configuration keys and MDM payloads.