Technical Tip: Identity Management integration Use case for remote users

[rduggal_FTNT]

Description	This article describes how to configure User access integration between FortiEDR and FortiClient EMS to identify and restrict access from Remote users over VPN and ZTNA when a malicious activity is detected on an Endpoint.
Scope	FortiEDR 6.0+, FortiEMS 7.2+ and FGT 7.2+
Solution	This article includes 2 scenarios where business critical applications are allowed for remote access over VPN and ZTNA. Based on Classification tags when a malicious activity is detected on any Endpoint with FortiEDR Collector agent and FortiClient deployed, access to business critical applications is going to be blocked. This article assumes following Prerequisites are met: FortiEDR deployment includes a Jumpbox that has connectivity to the identity management server. The FortiEDR Central Manager has connectivity to the Fortinet Cloud Services (FCS). VPN and ZTNA Server Configuration on FortiGate For demonstration, we are running FortiEDR Central Manager 6.2.0.0451, Core/Jump Box 6.0.1.0646, FortiClient EMS 7.4, Fortigate 7.4.4 and FortiClient 7.2.4 Steps 1: Adding Identity Management Connection to FortiEDR as below: Note: A custom Zero Trust device tagging can be added however FortiClient EMS 7.2 or later has predefined tags for FortiEDR which is FortiEDR_Malicious, FortiEDR_Suspicious, FortiEDR_PUP, FortiEDR_Likely_Safe and FortiEDR_Probably_Good. Step 2: Assign Identity Management Connector to Playbook by following below steps to assign classification tag when Malicious and Suspicious Activity is detected. Security Settings -> Playbooks -> Select playbook -> Zero Trust device tagging -> From drop down select Identity Management Collector -> Select Malicious Classification -> Assign required collector group to it. Scenario1: We have a SSL VPN tunnel on FGT which allows access to Prod Servers as below and block access if FortiEDR_Malicious classification tag is assigned to an Endpoint.     A user is connected to a VPN and can access Prod Servers successfully. Now on same endpoint a Malicious activity is detected On EMS as per playbook configuration in above steps, a FortiEDR_Malicious classification tag is assigned to an Endpoint: User after Malicious classification tag cannot access the Prod Servers anymore Scenario 2: We have a  ZTNA Server configured on FGT which allows corporate users to access File Server in the Prod Network On FortiClient we have a ZTNA destination Rule as below: From the below logs it can be seen that user is able to successfully access File Share over ZTNA. A malicious activity is detected on the same Endpoint by FortiEDR. A FortiEDR_Malicious classification tag is assigned to an Endpoint. User from affected endpoint cannot access File Share anymore. If there are still any issues with Integrations, open a new technical support ticket for further assistance: Support Fortinet