Details for "Host Check Failed"?

[Cythraul]

Clients failing host-checks is a perennial problem for us.  Once a machine starts failing the host check, it can take hours of fiddling to right the situation.

Part of the problem is the message is so opaque.  There's no detail as to why the client failed.  Is FortiClient not detecting a local A/V client?  What A/V client does it detect, if any?  Are the virus defs out of date?  Is the scan engine out of date?  Has it been too long since there was a local scan?  Is the FortiClient version itself out of date?  Something else I haven't thought of?

Even the logs on the firewall just say "A user has logged into the system, but host checked failed", which isn't real useful.

Is there any way we can get more detail out of the host-check results, to help us better troubleshoot?

[vdc · Accepted solution]

Check out the "Host check" section of the Handbook for your device/OS. Mine is:

http://help.fortinet.com/fos50hlp/52data/index.htm#FortiOS/fortigate-sslvpn-52/SSLVPN_Basic_Configur...

As far as figuring out what the GUID is for my specific AV software is... no idea. So, I just removed the check. The message was also intermittent for my users. Some hosts worked and some didn't, even with only the unlisted AV installed.

[Cythraul]

Thanks for the link; that's helpful.  I may do some fiddling with our specific host-check settings.

Did you remove the A/V requirement outright, then? That's kind of terrifying to me.  There's nothing stopping a user with a little know-how from installing the client on their home machines, where anything goes.

[vdc]

Cythraul wrote:

Did you remove the A/V requirement outright, then? That's kind of terrifying to me.  There's nothing stopping a user with a little know-how from installing the client on their home machines, where anything goes.

I did. All of our laptops are fully managed so there's only the typical risk there. For home PCs... how to install the VPN client isn't totally obvious to users. I feel if anyone figured out where to download it, how to install it, setup the VPN connection, and actually use it, they're probably savvy enough to know they need updated A/V. But this is an assumption.

One of the things I'm planning on implementing is to import all the VPN client certificates and then requiring that for a successful tunnel. For us that would weed out any unmanaged machines.

And frankly at the moment I don't really have any idea what the Fortigate client is truly checking. A GUID and a version that proves an application is installed? Okay, but then theoretically the A/V software could still be turned off, malicious software could be impersonating the valid software, etc.

Anyway, certainly there are lots of things to be terrified about. I'm not sure I'm losing sleep over this particular vector.