EMS Restriction Implementation

[muhammadsaad]

Hi,

We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully.

We are having a scenario.

In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.

Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict.

We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier.

I request the seniors to please help out on this.

Thanks

[funkylicious]

hi,

if i understand correctly your situation, you say that when a client connects to the IP of EMS, it doesnt get the VPN Connection Profile? have you tried any tshoot/debug on the client? when you created the installer did you assign it the VPN Profile ? is the connection via invite code or anyone that knows the IP/hostname of the EMS can connect ?

also, you want to restrict the creation of manual vpn connection after the client connects to EMS. this can be done by disabling Allow Personal VPN as @AEK described below.

if you want to only allow EMS registered endpoints to connect, then you should have a look at https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/710480/enhancing-vpn-securit... , which requires FortiOS >= 7.4.2 

[muhammadsaad]

- Basically, for vendor we will manually allow them the profile once they connect to the EMS.

- EMS will be connected via IP.

- Moreover, by disabling Allow Personal VPN the manually created profiles are not removed from the forticlient.

Our pain point is the one which I had mentioned earlier.

Thanks

[funkylicious]

indeed, if a existing VPN Profile is already configured it won't be deleted when disabling Allow Personal VPN, it would just disable the ability of the user to create any other ones after.

[muhammadsaad]

Right, so is there any work around of our pain point mentioned earlier?
Once again thanks for the help and support

[funkylicious]

if you are refering to the point where the VPN Connection would be available once you connect to EMS, you can have a look at the i've provided above in regards to a vpn security feature.

with that enabled, if FortiClient isnt registered to EMS it wont connect.

another option would be to create a Tag for FortiClient connected to EMS is compliant and those who don't have this tag to Prohibit access to the VPN in Remote Access Profile > Advanced Settings > Tags 

[muhammadsaad]

We have already implemented a scenario like VPN will only be connected once EMS gets connected.

By applying the above suggestions, the issue will still be pending because what we wanted to do is only company based laptops will be able to get logged in.

What's happening right now is on any other laptop except the company provided, if we download the FortiClient, connect the EMS through its IP and manually configure the SSL VPN, we will be able to get connected, whereas we want to restrict it to only company provided laptops.

[AEK]

his should help as well.

https://community.fortinet.com/t5/FortiClient/Technical-Tip-Secure-remote-access-configuration-guide...

What's happening right now is on any other laptop except the company provided, if we download the FortiClient, connect the EMS through its IP and manually configure the SSL VPN, we will be able to get connected

-> Once again this cannot happen if you don't open registration to anyone having FortiClient. You have to register only company provided laptops. So anyone else downloads FCT and tries to connect to EMS will not be able to register, and then when you setup the above tech tip the rogue client will not be able to connect to VPN.

[muhammadsaad]

We are practicing in this way as you said.

We have a use case that an employee belongs to an IT department and he knows the IP and other details for both EMS and SSL VPN, if he used his personal laptop, download the forticlient then he will be able to get connected.

We just want to restrict this user that he will not be able to use his personal laptop, please suggest how can we restrict the user.

That's my simple point.

[AEK]

As suggested before, you can still use tags at firewall level in the VPN related policy, so any non-compliant host that can connect to VPN will not be able to access any resource.

[muhammadsaad · Accepted solution]

Team,

The issue has been resolved. Please find the summary below:

1. When FortiClient connects to the EMS, it automatically receives the default policy. If any profiles are associated with these default policies, they will also be applied, overwriting any manually configured policies. Required tags will be pushed as well. Endpoints that meet the tag requirements will be able to connect successfully.

2. Once this is in place, we can enforce the restriction that endpoints must be connected to the EMS for services to function properly.