Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ArtSyk
New Contributor II

ZTNA Tags are not synchronized with Fortigate

Hello,

 

we are facing with a problem with synchronization ZTNA Tags between EMS and Fortigate.

Tags created on EMS are apply on clients, EMS is resolving hosts and IPs appropriately but new tags are not visible on Fortigate. Also if client has changed IP address (in tag there is rule searching users in AD groups) he's not being resolved appropriately.

 

In my example there is a problem with tag "secure_devops" (tag not visible on FG) and "secure_admins" (user has changed IP address and he's not availble under this tag).

 

FortiGate 600E v. 7.2.3 b. 1262

EMS v. 7.0.7 b. 0398

 

How can i fix this bug/problem?

 

ArtSyk_0-1672215609058.png

 

ArtSyk_1-1672215478268.png

 

 

5 REPLIES 5
dsrivastava
Staff
Staff

Hello,

Please check if you have enabled Synchronize firewall addresses under Security Fabric > Fabric Connectors on Fortigate.
Reference link:
https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/335228/synchronizing-forticl...

ArtSyk
New Contributor II

@dsrivastavathanks for reply.

 

Yes, I have it enabled.

ArtSyk_0-1672218461389.png

 

ArtSyk
New Contributor II

@dsrivastavaany further solutions? ;) This one is not resolving my problem :(

dbernal917

I was able to fix it by disabling EMS then re-authorizing it. 

Bjay_Prakash_Ghising
Contributor

Hi @ArtSyk 

 

Please execute the following commands in FortiGate CLI to force sync (restart) the ZTNA tags between FortiGate and Forticlient EMS.

 

diagnose test application fcnacd 99

 

Before that, run the following command to see the log in real-time and identify the issue. You can also share the logs with us.

 

diagnose debug application fcnacd -1 
diagnose endpoint filter show-large-data yes
diagnose debug enable

 

Hope that helps

 

Kind Regards, 

Bijay Prakash Ghising

Ghising
Ghising
Labels
Top Kudoed Authors