Basic FortiClient EMS questions

[damianhlozano]

Hello team!!

I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.

1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")

2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point this?

3) For on-fabric endpoints, I can create on Fortigate, a rule to allow certain application, which are the diffences, between allow this traffic on Fortigate, and create a ZTNA application on FortiClient EMS?

4) Is there a way to chose sub-categories on web filter profiles in FortiClient EMS?  (When I create a new profile, I just can select categories, not sub-categories)

5) What is "Deployment & Installers -> Manage Deployments" for?  In the study guide, I learned that FortiClient could be deployed through GPOs, SCCM, and third party applications as in tune

Thanks in advance.

Regards

Damián

[AEK · Accepted solution]

Hi Damian

1. EMS does not apply group assignment rules to a domain-joined endpoint if it belongs to an imported Active Directory (AD) domain in EMS...
   https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/353734
2. Why do you create ZTNA apps for on-fabric endpoints. You just need it for off-fabric endpoints. On-fabric endpoints should access the app via a regular firewall rule where you can use ZTNA tags if you want.
3. I think after reading response 2 above you understand better the difference.
4. Yes you can. Just click the plus (+) sign in front of the category and you will see its sub-categories.
5. From 7.4.0 you need GPO because it is not possible to do initial deployment from EMS anymore. From 7.4.0, manage deployments is for updates/upgrades only.

[damianhlozano]

AEK, thanks a lot!!!

1) Ok, I didn't know. 

2 & 3) I though I read this in the study guide, that you can use ZTNA apps for on-fabric too

4) Sorry, dumb question. I dont even try with the plus sign, hehehehe

5) It doesnt make sense to me, that FortiClient EMS could do the initial deploy of Forticlient to endpoints in any way.  I though maybe this is for updates but didnt know.

You answered to me all my questions and many questions about Fortigate in the past, I think you know a lot about fortinet products.

Thanks again!

Regards,

Damián

[AEK]

Hi Damian

2&3) Yes technically you can us ZTNA app for on-fabric, but I think it doens'nt make sense because ZTNA app is intended for secure remote access and intended to replace SSL VPN.

Happy to help. Actually I work a lot on integrating security solutions, especially Fortinet. That could be the reason.

[damianhlozano]

Great!!

That's most probably the reason, hehehehehe.

Thank you a lot!

Regards,

Damián

[damianhlozano]

Hello,

Sorry, I just add 2 new questions.

1) Is this possible to authenticate AD users with 2FA without any other appliance than Fortigate and FortiClient EMS?

https://docs.fortinet.com/document/forticlient/6.2.8/ems-administration-guide/357909/logging-into-em...

I found this article, but I dont have "Security Fabric > Settings", I think this is because we dont have security fabric (we does not have FortiManager or FortiAnalyzer)

2) In this case, when will the credentials be authenticated?  When FortiClient connects to EMS?

Thanks in advance.

Regards,

Damián