"Enforce User Verification" won't work when FortiClient connect/register using FQDN

[Happii]

Hi everyone,

The ZNTA on my FortiClient EMS working well with SAML verification user and invitation codes. However, we got problem on connecting using the FQDN.

- With unchecked "Enforce User Verification", the FortiClient using FQDN connect to EMS successfully without any SAML login (insecure as we adopt off-net workstation).

- With checked "Enforce User Verification", the FortiClient using FQDN doesn't connect to EMS. The error message is about the connection require invitation code.

if you made FQDN connection with user verification successfully, please kindly advise what is wrong or missing in my configuration setup.

Thanks so much.

[AEK]

Hi Happii

It was successful for me, FCT EMS 7.4.x.

When you create the invitation you specify the FQDN in "EMS Listen Address", not the IP address. Then you re-send the invitation so the client uses the invitation code that was created based on FQDN.

[Happii]

Hi AEK, thanks for your sharing. we did configuration the same but won't work. have no idea what's wrong.

[AEK]

Hi Happii

You enter the invitation code instead of hostname:port.

Did you generate an invitation? (EMS > invitation menu at top-right).

[Happii]

Hi EAK, invitation was working well with me. But wonder why it was working with hostname:port (the FQDN) with my configuration. Fortinet's document wrote it would work both cases. That was my wonder and seeking for help.

[AEK]

As far as I remember if you want hostname:port works, I think the host must be pre-registered. It means in EMS you import it first from your AD.

Last time I used EMS was about one year ago, so hope I'm not wrong.

[Happii]

Thanks AEK, the endpoint has registered using the invitation code successfully. After that disconnect, then reconnect using FQDN but failed if we keep the User Verification option activated.

Could you please elaborate pre-register host you have done year ago? thanks.

[AEK]

Pre-register is just my way to say "import endpoints from the domain".

This should helps:

https://docs.fortinet.com/document/forticlient/7.4.1/ems-administration-guide/123277/adding-endpoint...