Technical Note: Create a VPN only FortiClient Installer with FortiClient Configurator

mforbes · ‎05-17-2018

Description
This article describes how to create a VPN only FortiClient installer.

Solution

There is no VPN only FortiClient available since FortiClient is a suite that comprises various Components. (AntiVirus, Web Filtering, Application Firewall, Remote Access (VPN), Vulnerability Scanning)

A standalone FortiClient VPN installer can be created using the FortiClient Configurator tool.

Version 5.4.x requires a license and can be downloaded from the support site: https://support.fortinet.com/ Path: Download > Firmware Images > Image Path > FortiClient > Windows > v5.00 > 5.4 > 5.4.5 > FortiClientTools_5.4.5.0891> FortiClientConfigurator

If the FortiGate is licensed with a "FortiClient Telemetry and Compliance License", then the FortiClient 5.4.x Configurator tool license is also included.

Version 5.6.x is a free tool but only available through the FNDN site. Access to the site requires two sponsor emails. (Please contact the Reseller for these)

"Please be noted, that Technical Support cannot provide access to FNDN or sponsors emails. To obtain sponsors emails please contact your Fortinet sales representative, or contact Fortinet sales department on one of the numbers or chat given at: https://www.fortinet.com/how-to-buy.html "

FNDN Registration

https://fndn.fortinet.net/index.php?/register/

About

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf

Unlicensed FortiClient Support

Technical support for FortiClient is only provided with a FortiClient license.

Support for unlicensed FortiClients is only provided via our support Forum. (https://forum.fortinet.com/)

Support for FortiClient Configurator 5.6 is on through the FNDN site. (https://fndn.fortinet.net/index.php?/register/)

Using the FortiClient Configurator Tool

Start the FortiClient Configurator tool.

The [Configuration File] page will ask if there is an xml configuration file to use.

To create a VPN only installation that includes pre-configured tunnel information, specify it on this page. (To get an xml configuration, first install FortiClient, setup all the VPN tunnels, specify the settings, test. Open the FortiClient Console, Go to File > Settings > System then click on Backup. Save. Use this xml.conf file in the above page.)

NOTE: If not specifying tunnel information, clicking Next will skip.

Click Next.

In the [Features to Install] page:

Select only the Secure Remote Access Module.

Deselect Security Fabric Agent. (Needed only when Endpoint is part of the Security Fabric)

Click Next.

In the [Page Signing] click Skip. (Packaging process starts)

Click Finish to save the output.

A new window will open up to display the installer packages located inside a new folder called "repackaged".

The FortiClient Configurator tool will create both x32 and x64-bit installers.

Inside each folder there will be two additional folders, an ActiveDirectory and a ManualDistribution folder.

The ActiveDirectory folder will contain two files, FortiClient.msi and FortiClient.mst. These are the files needed when installing using Windows AD SCCM. The .msi is the installer, the .mst is the configuration.

To use the .msi use the following command:

msiexec /qn /i "FortiClient.msi" TRANSFORMS=FortiClient.mst

NOTE: The .msi installer does not contain any settings and will install ALL modules.

The ManualDistribution folder contains a single .exe installer that should only be used for manual installations and will install the Modules specified by the Configurator tool, including settings that were specified with the xml configuration file. (ie. vpn tunnel settings)