Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Failed to apply On-fabrci rules

Hi, We have aroud 3k Forticlients used to establish a SSL/IPSec VPN with a fortigate.They are managed by a FortiEMS

On FortiEMS, we configured "on-fabric detection rules" with a LocalIP/subnet rule type so that the forticlient detects when the user is off fabric (when his IP changes) and shows him a list of VPN that he can connect to. The problem (i think) is when the user is at home, the FC doens't detect the change in the IP adress and consider him still "on fabric" so he doesn't show him the VPN list.

We tried ipconfig/release and renew and reload the computer but the problem persist. Versions : FC : and FEMS 6.4.4 build 1658

Thank you.


that's exactly right.... If you are "off-net" but cannot reach EMS, you'll not be able to talk to the server and get the other policy for "off-net". We setup split DNS so that our EMS server is accessible from the inside or outside. (ie: = or your WAN IP block and on the inside = All you need is a VIP on your gate to allow TCP.8013 into the EMS from the WAN


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors