Security fabric FortiGates not being able to finish authorization to EMS Cloud

Hello Cajuntank, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Hello again Cajuntank,

I found this answer, can you tell us if it helps, please?

To address the issue of downstream FortiGates in a Security Fabric not being able to complete authorization to the FortiClient EMS Cloud, follow these steps:

Troubleshooting Steps

1. Verify Certificate Synchronization:

   • Ensure that the CA certificate is synchronized through the Security Fabric. This is crucial for downstream FortiGates to validate the EMS certificate.
   • On the root FortiGate, enable the remote CA synchronization with the command:
     
     

     config vpn certificate ca edit "<Certificate Name>" set fabric-ca enable next end 

2. Check Certificate Names: Verify that the Remote CA Certificate names on downstream FortiGates match the root FortiGate's certificate name. Any mismatch can cause authorization issues.
   
   

3. Ensure DNS Resolution: Confirm that the DNS server is reachable and that FortiGate can resolve forticlient-emsproxy.forticloud.com. This is necessary for proper communication with the EMS Cloud.
   
   

4. Debugging:

   • Use the following commands to gather more information on the issue:
     
     

     diagnose debug application fcnacd -1 diagnose debug enable 

   • Replicate the issue and check for any timeout or certificate errors in the debug output.
     
     

5. Update and Configure Source IP:

   • Run an update to ensure all components are up-to-date:
     
     

     diagnose debug application update -1 diagnose debug enable execute update-now 

   • If the issue persists, specify the source IP for EMS communication:
     
     

     config endpoint-control fctems edit <EMS ID> set source-ip <any_ip> end 

Follow-ups and Clarification Questions

• Have you verified that the CA certificate is synchronized across all FortiGates in the Security Fabric?
• Is the DNS server reachable from all FortiGates, and can they resolve the EMS Cloud address?
• Have you checked the debug logs for any specific errors or timeouts during the authorization process?
• Did you ensure that the Remote CA Certificate names are consistent across all FortiGates?

These steps should help in diagnosing and resolving the issue with the downstream FortiGates not completing authorization to the EMS Cloud. If the problem persists, consider reaching out to Fortinet TAC Support for further assistance.