Forticlient EMS Integrated Deployment

[lokean13]

Hello, I'm working on deploying EMS into an existing Forticlient environment.  First, I have a question on deployment.  With my current Forticlient deployment, I have several profiles that are assigned depending on AD group, but when I import these profiles into EMS, it wants to assign them using OU.  What's the best practice on this?  Do I need to create OUs for the different profiles?  

Second, I did create one test OU and put my machine in there that already had Forticlient 5.4.1 installed on it, and I followed the cookbook on how to push out an uninstall and install.  I noticed the Windows notification saying I had no AV turned on but then never saw the system reboot to complete the uninstall or reinstall and Forticlient just stayed like it was with EMS stuck on saying it was installing.  I manually uninstalled Forticlient then did the remote install again, and even though it did install on the machine, and register it to the Fortigate, on EMS, it still says not installed on one column and still says installing on another.  Has anyone come across this?  

[SteveG]

I see the same stuff with PC's being listed as unregistered or not installed when EMS has pushed the install. EMS has lots of potential but it's real buggy at the moment. Usually after 24 hours and a reboot of EMS and the client PC the client status is listed correctly.

[lokean13]

OK, It's been since Friday and I've rebooted both.  I may try uninstalling and pushing the install again.  

Any idea about the imported profiles? 

[SteveG]

We've performed a clean install so haven't migrated anything, in the process of moving from Sophos to Forticlient.

[lokean13]

Dang...ok I guess I'll have to open a support ticket.  I just uninstalled again and reinstalled.  The install goes just fine, it installs and registers and everything but ems always says installing which makes it pretty useless.  It wasn't cheap enough to be useless. 

[SteveG]

Is there a firewall between the PC and EMS server as there are a few ports which need opening?

[lokean13]

They are on seperate VLANs that the Fortigate manages but there is an ANY/ANY Allow rule between them. 

[SteveG]

OK support call it is then! :(

I have a number of calls open with Fortinet EMS at the moment, it takes them quite a while to respond so guess the support team isn't massive for this product.

[lokean13]

Yeah, I already have it open.  I'll post what they say. 

[SteveG]

I'll be interested to hear what they say, sounds like we're both on similar EMS journeys right now!