Technical Tip: Preventing automatic installation of FortiClient EMS Fabric connector on specific FortiGates in FortiManager ADOM

[vrajendran]

Description	This article describes how to prevent a FortiClient EMS connector from being applied to all FortiGates in an ADOM.
Scope	FortiManager.
Solution	In FortiManager, once a FortiClient EMS fabric connector is defined within an ADOM, it is automatically pushed to all FortiGate devices managed under that ADOM. To prevent the EMS connector from being applied to FortiGate devices where it is not required, a custom CLI template can be used. This template will override the EMS connector configuration, effectively disabling it on specific FortiGates. Workaround Steps: Create a CLI Template: Go to Device Manager -> Provisioning Templates -> CLI Templates. Create a new CLI template with the necessary commands to remove or disable the EMS connector from the FortiGate configuration. Example CLI commands: config endpoint-control fctems     edit "1"         unset name         unset server         set status disable     next end Assign the CLI Template: Assign this template to the FortiGate devices that should not have the EMS connector configured.  Go to Device Manager -> Provisioning Templates -> CLI Templates -> Assign to Device/Group. Ensure the CLI template is pushed to the relevant FortiGate devices. Verification: Log in to the FortiGate CLI or GUI and confirm that the EMS connector configuration has been removed or disabled. Monitor ongoing configuration syncs from FortiManager to ensure that the CLI template continues to suppress the EMS connector settings. While FortiManager currently does not provide a built-in option to limit EMS connector deployment to selected FortiGates within an ADOM, this can be effectively managed through the use of CLI templates. This method ensures that only the required devices maintain the EMS connector configuration, maintaining proper segmentation and reducing unnecessary configurations on non-participating FortiGates.