Description | This article describes a troubleshooting guideline when identifying issues between FortiGate and EMS. |
Scope | FortiGate ZNTA telemetry, tags, and policy enforcement. |
Solution |
Connectivity testing Between FortiGate and EMS:
diagnose endpoint fctems test-connectivity <EMS>
Verify FortiGate to FortiClient EMS connectivity.
execute fctems verify <EMS>
Verify EMS server is reachable from the Firewall. In the case when the EMS server is connected to the Firewall using a VPN tunnel source IP needs to be configured under EMS configuration using the command.
config endpoint-control fctems edit 1 set server "10.10.10.1" set source-ip "192.168.1.1"
Verify the FortiClient EMS’s certificate:
diagnose test application fcnacd 2
Dump the EMS connectivity information.
The diagnose endpoint fctems test-connectivity command shows that the connection between FortiGate and Forticlient EMS is successful. The execute fctems verify command shows that the server certificate is verified with FortiGate and the diagnose test application fcnacd 2 command dumps the FortiClient EMS connectivity information.
If fcnacd does not report the correct status, run real-time fcnacd debugs:
diagnose debug app fcnacd -1 diagnose endpoint filter show-large-data yes <- diagnose debug enable
Run real-time FortiClient NAC daemon debugs.
EMS communicates to FortiGate on port 8015:
diagnose sniffer packet any 'port 8015' 4 0 l
Checking dynamic tagging. EMS pushes dynamic tag profiles to FortiClient and sends the dynamic endpoint groups to the FortiGate.
On the EMS GUI: Go to Zero Trust Tags -> Zero Trust Tag Monitor. This will show the FortiClient Endpoint Tag together with the client IP addresses. This dynamic endpoint group should be sent to the FortiGate.
On FortiGate: To check the users authenticated in FortiGate:
diagnose firewall auth list
diagnose endpoint record-list
List EMS ZTNA tags and all dynamic IP and MAC addresses.
diagnose endpoint record list
As of v7.4.2, the 'diagnose endpoint record list' has been changed to 'diagnose endpoint ec-shm list'.
Show the endpoint record list. Optionally, filter by the endpoint IP address.
diagnose test application fcnacd 7 diagnose test application fcnacd 8
Check the FortiClient NAC daemon ZTNA and route cache.
Additional fcnacd options.
diag test application fcnacd =====================================================
Additional debug commands for SSL-VPN/ZTNA Access proxy:
diag debug application sslvpn -1 diag debug ena
Run real-time WAD debugs.
diagnose wad debug enable category all diagnose wad debug enable level verbose diagnose debug enable
diagnose endpoint wad-comm find-by uid <uid>
Query endpoints by client UID.
diagnose endpoint wad-comm find-by ip-vdom <ip> <vdom>
Query endpoints by the client IP-VDOM pair.
The WAD daemon handles the proxy. The FortiClient NAC daemon handles connectivity between FortiGate and EMS.
Related documents: Services and Ports | EMS Administration Guide ZTNA configuration examples - FortiGate documentation. |