Assistance Required with EMS Tag and Firewall policy

[muhammadsaad]

Hi Team,
We have integrated the FortiGate firewall with FortiClient EMS and are currently in the process of applying posture checks, specifically focusing on enforcing Antivirus (AV) software compliance on vendor laptops.

The tags created within FortiClient EMS are being correctly pushed to both the FortiGate firewall and the FortiClient. These tags have been referenced in a firewall policy associated with remote VPN access. However, we are encountering an issue: when the VPN connection is established and the EMS tag is active, the destination resources become unreachable, despite the antivirus being installed and running properly on the vendor's workgroup laptop.

We are testing on Azure IdP user and create a separate user for the vendor.

Conversely, when the EMS tag is not applied, the destinations are reachable without any issues.

Could you please advise what might be causing this behavior and suggest possible steps to resolve it?

Thank you for your support.

[FortiDor]

Hi,

Here is the documentation to setup the registry tag in the FortiClient EMS : 

You can find the installation source of your FortiClient directly in your EMS and not only in the support portal.

Once the tag is evaluated by the EMS, the IP Range used by your FortiClient is shared with the FortiGate and the traffic policy allow the traffic untill the destination.

You need to check that everything is connected between your FortiClient EMS and your FortiGate with the Security Fabric to be able to work.

[muhammadsaad]

Hi @FortiDor 
The connectivity between fortigate, forticlient and EMS is working fine as we have created a remote access vpn policies on the EMS that are getting pushed and VPN is getting connected. 

As far as the regedit tag, they are related to the specific browser where as my ultimate goal is to apply the AV Software feature on all type of windows based laptop devices.

Below is the EMS tag created:

[muhammadsaad]

Anyone can guide?

[FortiDor]

Seems good for me @muhammadsaad 

What’s the issue with the AV Tag for the Windows devices ?

I don’t understand your request 

[muhammadsaad]

I called this tag on the firewall policy and the destination gets unreachable and similarly without this tag the destinations are reachable. We have 3rd party Symantec Antivirus (AV) that is installed and running. 

So I failed to understand why the destinations are not reachable when we called this tag on the firewall policy.

[FortiDor]

Understood so you need to check if you seed the AV tag on your Endpoint meaning the FCT installed on your Windows device.

And please share the firewall policy used to better understand 

If the tag is not right evaluated that’s correct why the destination is unreachable meaning the traffic is not allow by the firewall policy 

[muhammadsaad]

The Forticlient is installed on the windows device and tag is also visible on it. 

Without this tag, the destinations mentioned on the firewall policies are reachable and with this tag , they are unreachable. Please note we are applying the tag on the remote VPN firewall policy.

Below is the sample policy.

[muhammadsaad · Accepted solution]

The issue has been resolved. Essentially, in a remote access setup, the same tag must be applied to both the remote access profile on the EMS and the corresponding firewall policy.