Description
This article describes how to configure and enforce Zero Trust Network Access (ZTNA) tagging rules in FortiSASE to ensure endpoint compliance. Specifically, it covers posture checks for FortiClient version, if antivirus is running, and operating system version.
Scope
FortiSASE.
Solution
Go to Endpoint Management -> Security Posture tags.
Create a tag first:
Create tagging rules:
Since this compliance tag is intended only for Windows systems, make sure to disable the options for other operating systems.
In the FortiSASE Feature Release, an AND/OR logical operator option is available, which allows administrators to build more granular rules by combining multiple compliance conditions.
For this tag to match on an endpoint, the following conditions must be met:
- The antivirus must be running.
- The operating system must be Windows 11.
- The FortiClient version must be 7.2.10 or higher.
Since the endpoint matches all the conditions, the tag appears.
