|
Check that the FortiClient EMS and FortiOS are compatible via the following link: FortiClient Windows, macOS, Linux Compatibility with FortiClient EMS.
Below is the error shown in the CLI:
diagnose test application fcnacd 2
EMS context status:
FortiClient EMS number 1:
name(id): EMS(1) confirmed: yes
is global: true
interface vdom: root
fetched-serial-number: FCTEMSxxxxxxxxxx
fetched-tenant-id: 00000000000000000000000000000000
user-data:
verified capabilities: true
verified identity: true
interface-selection-method: 0
verify-peer-method: 3
ztna-public-key:0x7f97b692b2e0
Websocket status: connected, oif: 0
execute fctems verify 1
Error in requesting EMS fabric connection: -5
issue in getting capabilities. EMS server connection failed because the server is not compatible. received https code 500
Error (-1@_get_capabilities:461).
Run the fcnacd debug:
diagnose debug application fcnacd -1.
diagnose debug enable
.......................
2025-11-25 13:00:13 [ec_ez_worker_process:400] Processing call for obj-id: 0, entry: "api/v1/system/serial_number"
2025-11-25 13:00:13 [_update_obj_stats:365] Storing (0, EMS, 17)
2025-11-25 13:00:13 [ec_ez_worker_process:458] Call completed with failure.
obj-id: 0, desc: "REST API to get EMS Serial Number.", entry: "api/v1/system/serial_number".
error info: Error (-1@__generic_process_result_ex:205). Error: http code 500
The reason for this issue is related to the 'preserve-ssl-session' option in the EMS configuration. This option determines whether fcnacd reuses an SSL session for communication with EMS. Currently, reusing the SSL session cache causes fcnacd to send a PSK instead of a certificate chain for verification, while EMS does not support PSK for most of its APIs. Therefore, a connection issue occurs when a client enables "preserve-ssl-session".
To solve the issue, first attempt:
config endpoint-control fctems
edit <id>
set preserve-ssl-session disable
end
end
If the problem persists, remove the Fabric EMS connector and reconfigure a new entry that includes the above command.
To test the connectivity, run the command below:
diagnose endpoint fctems test-connectivity 1
|
