FortiGate global header policy not enforcing EMS tag match

[jloureiro]

Hi,

I have FortiClient EMS, FortiManager, and several FortiGates in my environment.

• EMS is connected to each FortiGate and showing "connected" in the Fabric Connectors;

• In EMS I configured classification tags to some users;

• In FortiManager, I have a Global Header Policy applied to all FortiGates;

• This policy has an EMS classification tag as part of the source match condition.

Problem is devices without the EMS tag are still matching the policy.

Only troubleshoot I was able to do is running <diag user device list> only to find that there are no tags showing up.

Forticlient EMS  v7.4.3

Fortimanager v7.4.6

Fortigate(s) v7.4.7

I would appreciate some help on how to further troubleshoot the issue.

Thanks in advance.

[AEK]

Hi Joao

When you open the policy from FortiGate WebUI (not FMG) do you see the tags are set up properly?

[jloureiro]

Hi, actually I can't see the tags anywhere inside the policy.

Thanks.

[AEK]

If you can't see it then you may need to enable Zero Trust Network Access in feature visibility.

[jloureiro]

Thanks for your reply.

Just to make sure we are on the same page, the tags I am trying to enable are ForticlientEMS Classification Tags (like the ones in the image below), and not the Security Posture Tags

Other issue is I am not able to enable the feature Zero Trust Network Access, as the instructions says that it must be enabled via CLI with two commands, however I dont have the set proxy-and-explicit-proxy enable under config system global.

As I said in the first post, this is a firewall header policy created on Fortimanager and pushed to the fortigates, and the tag is correctly presented on the Fortimanager side, my doubt now is if it should be presented in the individual firewalls policy as well.

Thanks again for your support.

[funkylicious]

hi,

in EMS you would need to ensure that in Fabric&Connectors > Fabric Devices > you have in Tag Types Being Shared , Classification Tags enabled to send to the FortiGates ( in Policy&Objects > ZTNA > Security Posture Tags you should see the CLASS IP tags [ Category: Classification ] from EMS ) and under the FortiGate > Fabric Connectors > EMS , CLI configuration you have pull-tags enabled ( which should be enabled by default if you didnt changed it )

[jloureiro]

Hi, thanks for your reply.

I could not find the Tag Types Being Shared option in the EMS, however that Tags are working in some Fortigates from the Fabric, from what I could see, the ones that does not work are the ones where I can not enable the ZTNA feature in the feature visibility.

[funkylicious]

can you share the FortiGate model and FortiOS running on those were the tags are no visible and cannot enable the ZTNA feature ?

https://docs.fortinet.com/document/fortiedr/7.0.0/forticlient-ems-integration/463964/configuring-for... 

[jloureiro]

Hi,

Fortigate 60F FortiOS 7.4.7

[jloureiro]

Hello,

I noticed that the problem seems to be related to the FortiGate not connecting properly to the fabric.

I am still having some trouble establishing the connection, but I believe that once this issue is resolved, the tags will appear correctly.

Thank you for your support.