FortiEMS: Is changing FQDN Name affecting current invitations/registrations?

[michael2406]

Hello. 

We want to change our EMS-Server to be reachable from Public and not only from internal network. 

At the moment users connect to an internal FQDN-Name while on internal network or connected via VPN. 

When changing the FQDN name of EMS-Server to a public reachable name, is this affecting the current connected users? 

The current users are connected through an invitation code and registered via LDAP to EMS-Server. Do they need a new invitation code after changing the FQDN Name? 

Thank you. 

[funkylicious · Accepted solution]

hi,

i did a test in my lab but be careful in production.

when changing the EMS FQDN (in EMS Settings > Use FQDN) for which the invitation code was created, you would get a This invitation code is disabled as EMS stopped listening to address ems.company.local under the invitations already generated, but my endpoint would still remain connected using the old FQDN, assuming that the old FQDN would still exist/resolve to the IP of EMS.

also, in Configure EMS Server List the old FQDN would disappear and the new one would be available for choosing, a newly created invitation you could choose the new one and then select/mark the endpoints ( in bulk i think also works ) Action > Switch EMS > Switch by invitation and then insert the newly generated bulk one with the new FQDN.

a idea would be to have a FQDN resolvable from the Internet in the public IP and internally in the private IP

[michael2406]

Yes that is exactly the way I wanted to do, to create the same FQDN which resolves internal to an internal ip and external to an external ip. 

If I understand you correct - the best way to do this is: 

1) Change FQDN Name in EMS Settings

2) EMS Clients will still connected through old Invitation

3) Create a new Invitation with new FQDN

4) In "Endpoints" mark the affected endpoints and change to the new Invitation?

[funkylicious]

long story short, yes.

remember to also add/select the new FQDN in the Configure EMS Server List.

[michael2406]

One question to "EMS Server List":

At the moment I have disabled "Configure EMS Server List". Does it mean clients can only connect to the current FQDN which is in "Use FQDN"?

Activating this option will give me the opotunity to connect to more than one FQDN to the EMS Server?

[funkylicious]

my bad, I might of forgotten to turn it off while testing connecting to EMS via IP and not invitation/verification.

when enabling it it says:

Current EMS IP is configurable via System Settings > EMS Settings > Listen on IP .

 If a server included in the list has user verification enforced, endpoints will not be able to connect using IP/FQDN.

So I assume that setting Listen on IP and enabling Use FQDN would be enough.