Endpoint protection activation

[kinmun]

I have installed forticlient on my desktop and would like to enable the anti-virus portion to be managed by my fortigate 300D.

from the firewall, it shows that I have 10 forticlient licenses available.

where do I get the forticlient license ?

[Christopher_McMullan]

On-net/off-net detection requires:

-5.2.3

-the FortiGate to act as DHCP server for your clients; otherwise, define option 224 on your DHCP scope (on whichever server you use) to be the S/N of the FortiGate in regular text (Windows Server 2012) or hex (2008).

If you define a non-default profile for a specific (batch of) FortiClient(s), it needs to match based on device or device group primarily. "Detect and Identify Devices" needs to be enabled on the interface facing clients. Be aware, iOS devices can be differentiated from Windows or Mac devices, but not among themselves (i.e., iPhone vs. iPad). The limitation here is in the MAC address and OS identifying information not being clear enough what product it is.

[kinmun]

I already have detect & Identify devices enabled on my LAN interface and have created a new policy with my computer IP and devices to test the rule for the realtime protection.

but it still shows default profile

[Christopher_McMullan]

I would run the NAC daemon debug when the FortiClient registers to the FortiGate, and see what profile is chosen there.

diag debug reset

diag debug enable

diag debug application fcnacd -1

<initiate a registration, then...>

diag debug reset

diag debug disable

I'd suggest opening a ticket with TAC to help interpret the output.