EMS Restriction Implementation

[muhammadsaad]

Hi,

We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully.

We are having a scenario.

In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.

Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict.

We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier.

I request the seniors to please help out on this.

Thanks

[dunalfu2]

When you use the Fabric connector for EMS, it feeds a dynamic address group for your registered / connected clients. Keep in mind that you need to open up your EMS vip, so the client can send telemetry before they get into this address group.

[AEK]

Hi Muhammad

You can do that by disabling the "Allow Personal VPN" in the profile. Once it is pushed then the user will not be able to create a personal VPN config anymore.

Another method I usually adopt, is to use tags at firewall level in the VPN related policy, so any non-compliant host that can connect will not be able to access any resource.

[muhammadsaad]

Hi,

Thanks for the reply. How this scenario will be implemented since before pushing the profile from the EMS, the user gets connected when we connect the EMS and configure the VPN manually?

The scenario you are referring to is after the profile gets pushed from EMS towards the forticlient.

Please confirm if we disable the "Allow Personal VPN" in the profile, the what will happen?
(The manually created VPN's will be automatically removed or something else)

[AEK]

When you create the installer you can push the VPN profile that denies configuring personal VPN. This way the user can't create any VPN from the moment he installs FortiClient, end even before it connects to EMS.

Please confirm if we disable the "Allow Personal VPN" in the profile, the what will happen?

-> I didn't test it but I guess once the profile is pushed the user will not see his personal VPN config anymore (but you can double-check by testing).

[muhammadsaad]

Alright, thanks for the help and support. Right now we are using EMS version 7.4.1 and there is an installer creation error on this version.
I will cross check that again.

By the way, any other works arounds?

[muhammadsaad]

@AEK ,

By applying the above two suggestions, the issue will still be pending because what we wanted to do is only company based laptops will be able to get logged in.

In current scenario, we have integrated Azure IdP for MFA authentication, if there is any vendor based laptop, it gets also connected through company provided Azure IdP credentials just because the users are authenticated via Azure IdP and their UPN contains that domain which causes the tag to match even though the machine itself is not domain joined and this behavior is expected due to FortiClient interpret the logged in user domain.

What's happening right now is on any other laptop except the company provided, if we download the FortiClient, connect the EMS and manually configure the SSL VPN, we will be able to get connected, whereas we want to restrict it to only company provided laptops.

[AEK]

How the external laptops can register to EMS? Are you using bulk invitation?

You should register only company laptops (integrate EMS with your Azure AD server), or by single invitation with AD user authentication for example, or with manual registration only.

[muhammadsaad]

We have a scenario like vendors have there own laptops, who work through connecting remote VPNs and we have created a separate user on Azure AD for them to connect and access the company's resources.

And since the EMS is allowed via Public IP, so its our Security Department compliance that if someone knows about the EMS IP and Remote GW of VPN, then they will get connected on this by simply downloading the FortiClient on any device.

I hope you got the point now.

[muhammadsaad]

Hello,

Anyone can guide/help on this.

Thanks