Skip to main content
Selim_mannai
Selim_mannai
New Member
May 15, 2024
Question

Quarantine Hosts that don't have forticlient installed on a network behind a FortiGate + EMS

  • May 15, 2024
  • 1 reply
  • 1226 views

Hi Community,

 

Using an EMS, Fortigate and fortianalyzer if needed , I m trying to see how I can quarantine users that don't have a fortiClient installed and have the last signature from the EMS.

 

Thank you,

 

 

1 reply

atakannatak
atakannatak
Explorer
May 17, 2024

Hi @Selim_mannai ,

 

To quarantine users who don't have FortiClient installed and do not have the latest signature from EMS, you can leverage FortiGate’s integration with EMS and FortiAnalyzer. Here's a step-by-step approach and the related document:


1-FortiClient EMS Configuration: Ensure that your FortiClient EMS is properly configured and managing your endpoints. This includes deploying the FortiClient with the necessary configuration profiles.

2-FortiGate Configuration: Integrate FortiGate with FortiClient EMS. Go to Security Fabric > Settings and configure the EMS server settings.

3-FortiClient Compliance Profile: Create a compliance profile in EMS to ensure endpoints have the latest signature and FortiClient installed.

4-Assign Compliance Profile: Assign the compliance profile to the endpoints.

5-Automation Stitch: Create an automation stitch to handle non-compliance actions. Go to Security Fabric > Automation and create a stitch with a trigger based on endpoint non-compliance and an action to add the user to the quarantine group.

 

https://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/952100/quarantining-an-endpoint-from-fortios-using-ems

 

BR.

 

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

    Terms & ConditionsAccessibility statement