Configuring Endpoint Control

[traghunath]

Hi,

Can I configure EMS via my fortigate (300D) or do I need to install the EMS server software?  I am trying to avoid installing the server software.

Thanks

[Yurisk · Accepted solution]

Up to FortiOS 6.2 you could register Forticlients to the Fortigate and create some basic profiles on the Fortigate to be pushed to the PCs, like compliance check, av/vuln scan. But starting with 6.2 you cannot - only via EMS server.

If you have older than 6.2 version, see in the FortiOS reference commands  https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/362768/endpoint-control (configurable in CLI only anyway):

config endpoint-control settings

config endpoint-control profile

[SecurityPlus]

I would like to know the answer to this question too.

[Yurisk · Accepted solution]

Up to FortiOS 6.2 you could register Forticlients to the Fortigate and create some basic profiles on the Fortigate to be pushed to the PCs, like compliance check, av/vuln scan. But starting with 6.2 you cannot - only via EMS server.

If you have older than 6.2 version, see in the FortiOS reference commands  https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/362768/endpoint-control (configurable in CLI only anyway):

config endpoint-control settings

config endpoint-control profile

[traghunath]

But do I still need to install the EMS server software or can I configure and register the clients using the fortigate?  This is what I am trying to understand.

[Yurisk · Accepted solution]

IF you have FortiOS 6.0.x you don't need EMS and you can register Forticlients on PC stations directly with Fortigate, up to 10 Forticlients without buying additional licenses. 

[traghunath]

thank you