Confused about Forticlient EMS server and Fortigate relationship.

[jbrashear]

Hi all,

I'm setting up the SSL VPN for my company and, I'm confused about how the VPN is licensed.  In my previous experience with Fortinet products, you had to have a license for the number of VPN clients you were going to have.  When we bought 4 new 300D's my sales person told me that the licensing is handled by the EMS server now.  I have installed the EMS server and it's licensed for 150 clients.  Where I get confused is how does the Fortigate know about the EMS server, or does it need to?  Honestly, I'm not at the point where I need full enterprise management outside of what the Fortigate can do itself, and all I want is to ensure that I can have more than the 10 users connect.  

Do I point the forticlients at the EMS server for telemetry, or the fortigate itself?  If the Fortigate is doing he telemetry, how does it integrate with the EMS?  The only thing I found in the cookbook was for implementing an EMS to manage internal devices on the LAN (ISFW).  Again, all I'm interested in at this point is making sure that more than the default 10 clients can connect to the SSL VPN.  I hope this makes sense.....

JB

[SteveG · Accepted solution]

We use EMS to manage our FortiClient installs. Unfortunately our supplier has no idea what licensing is required! They reckon, despite having 1500 EMS licenses we also need licensees on the FortiGates too (we want to enable the FortiClient enforcement on the LAN), although I don't see why. Before we had EMS the FortiClients would register to the FortiGates but we only had the default 10 licenses on each FortiGate so users would end up with an error message once they VPN'd in. Now the FortiClients are registered to EMS the FortiGate registration attempts have stopped. We've been pushing our supplier for a definitive answer for months now, I'm assuming the lack of understanding is on their part as I can't believe FortiNet don't know, it's their product!

We've not configured the telemetry feature yet, although all the FortiClients are sending logs to our FAZ. I may be wrong here but it feels to me that FortiNet are trying to remove the reliance on FortiGates when using EMS. We've have no config tie in between EMS and the FortiGates we have. I may be completely wrong though!

Confused? I certainly am :o

FYI, We have a number of support calls open at the moment as EMS is very buggy. We bravely rolled out FortiClient as the desktop AV here. Once the bugs are fixed it will be a great tool.

[RobertReynolds · Accepted solution]

There are two parts of FortiClient now, Endpoint Management, and Endpoint Telemetry and Compliance. Endpoint management is for configuration management and provisioning of FortiClient profiles (what you used to be able to do on the FortiGate), this is a separate piece of software that runs on a windows server as a member of the domain (The EMS). You get 10 free licenses, and from then on it’s a paid feature. The Telemetry and compliance part is licenses on the FortiGate, this allows you to do some network access control. This also comes with 10 free. Management == EMSManagement and compliance == EMS + Telemetry. To use the FortiClient in standalone SSL VPN mode only, there is no extra licensing required.

[MikePruett · Accepted solution]

I just deployed EMS for a client. They paid the $7 per license and were on their way. We are able to configure and set everything we wanted based on that. Compliance etc included because it will use the EMS for the compliance settings etc.

[Holy]

from forticlient admin guide:

Purchased license Each purchased license allows management of one FortiClient endpoint. You will need to purchase a minimum of 100 endpoints and you have an option to have this EMS license for a maximum three year term. You can specify the number of endpoints and the duration of term at the time of purchase. You can use a licensed FortiClient EMS to deploy, provision, and manage FortiClient endpoints. However, if have a FortiGate in your network, you can buy an Add-On FortiGate Endpoint license to enforce Endpoint Compliance on the Firewall while endpoints are being managed by EMS. Using FortiGate with EMS is optional.

so looks like you do have to buy 2 licenses