FortiClient EMS: prevent unknown devices from connecting?

[miciti]

Hello everyone,

I am new to FortiClient EMS and currently in a roll-out state.

How do I prevent unwanted computers from connecting to the EMS? (EMS on-prem, running in a DMZ and public available to the internet)

In theory someone can install FortiClient and connect to our EMS.

I do install FortiClient for our users because they do not have admin privileges - so I did not enable user verification.

Is there any other way to prevent unwanted devices from connecting to EMS?

[spoojary]

Enable 'Enforce User Verification' in the EMS settings. This will require end users to provide credentials to connect to EMS, adding an extra layer of security. Enable 'Enforce Invitation-Only Registration' to ensure that new devices can only join the EMS via an invitation code, rather than directly connecting using the EMS IP or FQDN.
https://docs.fortinet.com/document/forticlient/7.0.7/ems-administration-guide/002758/invitations

https://docs.fortinet.com/document/forticlient/7.0.7/ems-administration-guide/319002/configuring-ems...

[miciti]

I see, thanks for your reply.

Since my end users does not have admin privileges on their company devices they are not able to install FortiClient on their own.
The IT department uses a temporary local account with admin privileges to do so on company LAN... I want to connect "devices" to EMS and not users, does the user verification has to be done for all users of one PC or is it enough to do it once during installation?

[miciti]

Hello,

If I do change to "Enforce Invitation-Only Registration" to "all" does the current connected FortiClients stay connected?

If a new user logs into a computer that is already connected via an Invitation and without user verification does the FortiClient stays connected?

[Hartza]

Hi,

Did you find any solutions for your questions?  I have the same issue. After installing the client via SCCM the installation prompts the login since invitation verification type is SAML. Problem is that  when another user (the real end user) logged in the computer the Fortliclient is not connected to EMS Cloud anymore and verification code is needed. Is there a way to challenge the login to new users as well or some another way to autoregister host to EMS after another users logins to computer.

[miciti]

Hi,

I will probably go for the option "enforce invitation-only registration" but I was not able to test it. I will check on this the following week

[btan]

Hi Hartza,

If you have 'user verification' set to SAML, it is expected behavior that FCT telemetry will be disconnected when another user login to the same PC.

"Is there a way to challenge the login to new users as well or some another way to autoregister host to EMS after another users logins to computer."
-> To my knowledge, we do not have a way to implement it like this.

In my opinion, if this particular machine is frequently used by many (meaning it is somehow 'public'), you may just give it a code without any verification method (then it always connected to EMS regardless who login).  Your ultimate goal is for the 'public' machine to stay connected to EMS, you do not care who is logging in, then you do not have to set 'user verification', just my 2 cents.

[miciti]

Hello @btan,

when you are talking about "code without any verification method" you are talking about an inivitation code?

I saw it is possible in FortiClient EMS to switch EMS "switch by invitation". Does that mean If I switch my clients to an invitation with this function and enable afterwards "enforce invitation-only registration" my clients stay connected?

[btan · Accepted solution]

Hi miciti,

Yes correct, an invitation code.

Yes, you can use the 'switch by invitation' method.
Be careful when enabling 'enforce invitation-only registration'. If this option is enabled, if there is any endpoint who is currently joined to EMS using IP/FQDN, they all will be disconnected.

[miciti]

Hi @btan,

thank you very much for your input! I will switch all our devices to the an invitation code and afterwards activate the enforce invitiation-only registration afterwards.

Best regards,

Manuel