Skip to main content
AEK
SuperUser
AEK
SuperUser
November 25, 2024
Question

Router between EMS and FGT

  • November 25, 2024
  • 1 reply
  • 657 views

Hello EMS admins

EMS 7.4.1 and FOS 7.2.10.

When I put EMS VM in a VLAN attached to FGT, the clients' tags are updated correctly, and we can see the tags of each connected client under Policy & Objects > ZTNA > ZTNA Tags.

However when I put a firewall between my FG and the EMS, the fabric connector connects successfully and we can see the shared tags, but we can't see the tags of the connected clients anymore.

Note that I opened the required ports from the FGT to EMS, like 8013, 8015 and 443.

Does it mean it is a requirement to put EMS in a VLAN directly connected to FG, or did I miss something?

1 reply

pminarik
Staff
pminarik
Staff
November 25, 2024

The FGT<--->EMS path shouldn't matter, the FGT<--->FCT should. Any chance you're accidentally(?) also adding the router in-between the FGT and FCTs? As far as I know EMS by default only shares info about FortiClients whose gateway MAC matches any of the FGT's interfaces.

AEK
SuperUser
AEKAuthor
SuperUser
November 25, 2024

Thanks for your response, Minarik.

This is not the case. It seems the issue occurs only when I add a firewall between EMS & FGT.

AEK
Terms & ConditionsAccessibility statement