Differences between UTM and Enterprise Fortigate subscriptions

[SteveGrant]

Hi there,

I'm in the process of looking at our subscription renewals for Fortigate and noticed that there's now a level above UTM called Enterprise. In the past I've bought UTM but the Enterprise subscription includes these additional options:

[ul]

Botnet IP/Domain

FortiClient Management license

FortiSandbox Cloud

Mobile Security Services[/ul]

I can roughly figure out what each one of these does but I've not found a single document that clearly defines each service. Also I thought that "Botnet IP/Domain" was part of the UTM subscription anyhow?!

Please help me figure this one out. I've asked my supplier but I guessing I'll get a copy+paste response.

Thanks,

Steve

[pcraponi]

Enterprise does not include "FortiClient Management license". Fortinet has launched a errata about it.

[tanr]

Could you please post a link to the errata?  I haven't be able to locate it.

I thought all the Fortigate licensing options included at least free management and licensing of 10 FortiClients.  This is no longer the case?

[pcraponi]

Are you a Partner? On partner website has a file: 01_READ-ME-Q2PricelistUpdate-05-06-2016.pdf

The brief:

--

We would like to inform you of an error in the Description field of our “Enterprise Bundle” SKUs in the Q2 price lists. The FortiClient Management Licenses should NOT be listed in the part description and are not part of the Enterprise Bundles for any FortiGate or FortiGate VM model............

--

[tanr]

I'm not a partner, but have a few Fortigates with Enterprise Bundles on order.

I checked with Fortinet sales and was told that every FortiGate comes with 10 free FortiClient licenses.

They said (I think) that the “FortiClient Management License” as mentioned here is part of the separate product called EMS Enterprise Management Server).

[CyberNorris]

Yes, with 5.4.1, there is no longer any option to manage FortiClient licenses from the FortiGate. The Enterprise Management Server will be required to manage FortiClient.

You are still welcome to use FortiClient for free in the standalone mode.

I've noticed that FortiClient at home is now giving me a popup stating something like the FortiGate is either denying or blocking the registration of the FortiClient.

The Enterprise is definitely worth it to easily add the FortiSandbox Cloud and if you have any mobile devices, the mobile services will help protect them while on your network as well as your other systems.

[tanr]

FortiGates with FortiOS 5.4.1 still show 10 possible client licenses, FortiClient profiles are still there, and FortiTelemetry (what had been FortiHeartbeat) is still on the interfaces, so I'm pretty sure the FortiGates can still manage FortiClients.  What is no longer supported (except with the new FortiClientEMS) is the advanced configurations.

Per other posts, FortiClient 5.4.0 can't register with a 5.4.1 FortiGate because the FortiGate denies it due to the version not being 5.4.1.  I don't like that -- A 5.4.1 FGT should really be able to work with a 5.4.0 FortiClient, which is only back 0.0.1 version.  But the 5.4.1 release notes do show that 5.4.0 FortiClients aren't supported by 5.4.1 FortiGates.  

The "Cooperative Security Fabric 5.4.1 Upgrade Guide" lists out the version dependency, and gives a detailed sequence for upgrading.  It says to upgrade FortiClients to 5.4.1 before upgrading FortiGates to 5.4.1 (a little difficult to do since the 5.4.1 FortiClient version isn't out yet).

Note that the Cooperative Security Fabric 5.4.1 Upgrade Guide PDF is not under the Release Notes tab of the Firmware, it's under the Download tab for 5.4.1 instead...