Deploy forticlient VPN with config (No EMS)

[fmco]

Hello,

Our company is using an old version of FortiClient (5.6.6.1167). We want to migrate approximately 200 laptops to the latest version (7.0.7.0.345).

Actually, the VPN config is set by Windows registry entries. Is it possible to keep the VPN configuration from the windows registry ?

Otherwise, is it possible to deploy the latest version with a conf file ?

For your information, we don't have a Forticlient EMS.

Thanks for your support !

[Anthony_E]

Hello,

I have found a document that can help you:

https://docs.fortinet.com/document/forticlient/6.0.1/ems-administration-guide/994871/deploying-forti...

Could you please tell me if it helped?

Regards,

[MercyV]

Good day,

I can't seem to access this document

[Debbie_FTNT]

Hey fmco,

given that you're using a fairly old FortiClient version, I'm not sure if the registry settings can be retained, and deploying a FortiClient installation from scratch with a configuration file requires a modified installation file, which in turn relies on EMS.

However, you can technically just do a regular FortiClient installation, and prepare a config backup (.xml file), and then restore that config file to the installed FortiClient(s).

I'm really not sure if this can be done in bulk though, or if a prepared FortiClient configuration backup would need to be restored individually on each client; any guides we have for bulk deployment/configuration/upgrade of FortiClient usually relies on EMS.

[AEK]

Hi

This should be doable this way:

1. Install FortiClient VPN 7 on a Windows machine
2. Configure FCT VPN 7 as required
3. Run regedit and find the registry key for FortiClient (should be somewhere in HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient)
4. Export the reg key
5. Use GPO to deploy your new FCT 7 + reg key file on your 200 hosts

[WSSE_IT]

Unfortunately, this key from the HKLM registry... will not contain the correct Pre-shared key because it is encrypted and has a different form on each computer.
Any other ideas besides EMS?

[AEK]

This is actually good news. It would have been very insecure if we can duplicate the VPN password via such simple copy operation.

You'll need to find another way to set the password. Otherwise if you use IPsec VPN then you may try with certificate authentication method, I think it can be more suitable for such massive deployments.

[Mr_Grumpy]

We've done this for a about thousand endpoints on v7 with a 3rd party deployment tool and powershell (uninstall  / re-install / import config as all that can be done from the CLI.

Helps that its sslvpn and doesn't need to store anything except the destination, but maybe you can follow a similar principle?

[tmoyer]

Mr Grumpy, could you please elaborate on how you got the config pushed with your third party deploy tool? We use PDQ, I can do the install just fine, but then have to configure each end point by hand. Sure would help if I can push the config with PDQ as well. 

[ps-support]

@Mr_Grumpy - I have the same question as @tmoyer. Would you mind sharing the name of the packaging tool you used and/or process followed?