Assistance Required with EMS Tag and Firewall policy

[muhammadsaad]

Hi Team,
We have integrated the FortiGate firewall with FortiClient EMS and are currently in the process of applying posture checks, specifically focusing on enforcing Antivirus (AV) software compliance on vendor laptops.

The tags created within FortiClient EMS are being correctly pushed to both the FortiGate firewall and the FortiClient. These tags have been referenced in a firewall policy associated with remote VPN access. However, we are encountering an issue: when the VPN connection is established and the EMS tag is active, the destination resources become unreachable, despite the antivirus being installed and running properly on the vendor's workgroup laptop.

We are testing on Azure IdP user and create a separate user for the vendor.

Conversely, when the EMS tag is not applied, the destinations are reachable without any issues.

Could you please advise what might be causing this behavior and suggest possible steps to resolve it?

Thank you for your support.

[funkylicious]

hi,

in the firewall rule in question for access, do you have it created as standard with source vpn group and vpn address object and also using IP/MAC Based Access Control w/ the tag ?

upon executing diagnose firewall dynamic list, for the tag you use do you see the clients vpn address assigned to him ?

[muhammadsaad]

Hi, Thanks for your reply.
Yes, standard firewall rule is created with source vpn group and vpn address object along with IP/MAC Based Access Control w/ the tag

Please let us know do I need to run the below command after connecting to the remote VPN?
execute diagnose firewall dynamic list

Moreover, please advise the work around for this

[funkylicious]

yes, the command shoukd be executed after the user connects to the VPN.

forticlient will send via telemetry to EMS the info about the device and EMS will/should pass the info to FGT.

i am not aware of any workarounds atm

[muhammadsaad]

I will be glad if someone else can help out on this EMS tag posture (Antivirus) software compliance.

[sharmar]

Hello @muhammadsaad, 

Very first, AV security posture tag is for Forticlient AV only, if you are testing with 3rd party AV, it will not work,

Secondly, when you the issue, are you able to the tag is question on the fct and EMS ?

[muhammadsaad]

Hi, Thanks for your reply and helping out.

The tag i created on EMS gets directly from firewall towards forticlient.

Moreover, please let me know from where I can get Forticlient AV only in order to check and run the posture compliance part.

[muhammadsaad]

I am trying to implement the Antivirus software using the security posture tag on windows based devices but its not working. Refer below document link as well as snap in which its mentioned that 3rd party AV applications are supported

https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/342488/security-postur...

Can some one help out what could be the issue.

[FortiDor]

Hello @muhammadsaad 

You have some specific options if you are using the FortiClient AV directly or if you are running a 3rd party AV. The "AntiVirus Software" tag is working with the Windows Security Center to provide the information.

If you need more debug log, please specify the Debug level of the FCT in "debug" and check the logs at "C:\Program Files\Fortinet\FortiClient\logs\trace\FortiESNAC_1.log"
You will have the information if the AV tag is not working

On my side, I prefer create a regedit tag and check some specific value from the AV
Example : status is up / working and some specific values

Occasionally, the AV tag may generate some instability due to its adherence to Windows

[muhammadsaad]

Hi, Thanks for your reply.

What I need to do for regedit tag creation in forticlient EMS. We have download the forticlient from support portal and trying to implement this AV Software feature.

What i understand is that, after the tag is called on the firewall policy, there is no destination reachable.

So I am struggling to find the way to come out of this problem.