Technical Tip: Correct procedure to create FortiClient EMS connector when FortiGates are in Security Fabric

[btan]

Description	This article explains why certain FortiGates in the same Security Fabric show 'EMS certificate not authorized', despite already being authorized in EMS -> Administration -> Fabric Devices.
Scope	FortiClient EMS versions are 7.0.x and 7.2.x. FortiGate FortiOS versions are 7.0.x, 7.2.x and 7.4.x.
Solution	It is important to understand that when FortiGates are in the Security Fabric, all FortiGates must be in the Fabric first, before creating the EMS Connector in the root FortiGate. Meaning: When there is a new FortiGate required to join to existing Fabric, as well as needs EMS tag functionality, it is compulsory to delete existing FortiGates in EMS first. Once all FortiGates are ready in Security Fabric (including the new FortiGate), then only proceed to create an EMS Connector in the root FortiGate. In the case where root FortiGate is authorized with EMS, but downstream FortiGates fails to authorize the EMS certificates, follow the below verification steps: Check if the Remote CA Certificate in downstream FortiGates is named the same as the root FortiGate. In the below example, the downstream FortiGate's remote EMS CA certificate is different from the root FortiGate's remote EMS CA certificate. Root FortiGate, the EMS CA certificate is named 'csf_CA_Cert_1'. Downstream FortiGate, the EMS CA certificate is named 'CA_Cert_1'.   The different naming in the certificate causes downstream FortiGate to be unable to verify the EMS certificate. The solution is to delete the existing 'CA_Cert_1' in downstream FortiGate so that it can import the correct 'csf_CA_Cert_1' from the root FortiGate again. Follow the below steps: Delete 'CA_Cert_1' in affected downstream FortiGates: System -> Certificates -> select 'CA_Cert_1' -> Delete -> OK. In affected downstream FortiGates, remove them from the Security Fabric, and disable the EMS connector. In EMS, Administration -> Fabric Devices -> select the root FortiGate -> Delete. In the root FortiGate, temporarily disable the EMS connector: Security Fabric -> Fabric Connector > FortiClient EMS -> Disable -> OK. In affected downstream FortiGates, rejoin to the root FortiGate's Security Fabric. In the root FortiGate, re-enable the EMS connector: Security Fabric -> Fabric Connector > FortiClient EMS -> Enable -> OK. In EMS, Administration -> Fabric Devices -> select the root FortiGate -> Authorize. Wait for 2 minutes. In downstream FortiGates, check the certificate is correctly imported as 'csf_CA_Cert_1: System -> Certificates. Now, go to Security Fabric -> Fabric Connectors -> FortiClient EMS. It should be showing 'Connected' and green now. For v7.4.4 and newer versions, if the downstream FortiGate is still not able to validate the EMS certificate, refer to Technical Tip: EMS certificate verification fails on downstream FortiGate in Security Fabric.