ZTNA Tags are not synchronized with Fortigate

[ArtSyk]

Hello,

we are facing with a problem with synchronization ZTNA Tags between EMS and Fortigate.

Tags created on EMS are apply on clients, EMS is resolving hosts and IPs appropriately but new tags are not visible on Fortigate. Also if client has changed IP address (in tag there is rule searching users in AD groups) he's not being resolved appropriately.

In my example there is a problem with tag "secure_devops" (tag not visible on FG) and "secure_admins" (user has changed IP address and he's not availble under this tag).

FortiGate 600E v. 7.2.3 b. 1262

EMS v. 7.0.7 b. 0398

How can i fix this bug/problem?

[dsrivastava]

Hello,

Please check if you have enabled Synchronize firewall addresses under Security Fabric > Fabric Connectors on Fortigate.
Reference link:
https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/335228/synchronizing-forticl...

[ArtSyk]

@dsrivastavathanks for reply.

Yes, I have it enabled.

[ArtSyk]

@dsrivastavaany further solutions? ;) This one is not resolving my problem :(

[dbernal917]

I was able to fix it by disabling EMS then re-authorizing it. 

[Bjay_Prakash_Ghising]

Hi @ArtSyk 

Please execute the following commands in FortiGate CLI to force sync (restart) the ZTNA tags between FortiGate and Forticlient EMS.

diagnose test application fcnacd 99

Before that, run the following command to see the log in real-time and identify the issue. You can also share the logs with us.

diagnose debug application fcnacd -1 
diagnose endpoint filter show-large-data yes
diagnose debug enable

Hope that helps

Kind Regards, 

Bijay Prakash Ghising