ZTNA IP/MAC filtering issue

[fortiuser_new00]

Hello,

I had been struggling for a while with ZTNA. At this moment we only want to use it to control access by IP. Users will be tagged regarding AD groups and then Tags will be allowed or denied on FortiGate.  I have three FortiGate's (on-premises, Azure and OCI)

I finally managed to get that working on-premises, but then even when I'm receiving the tags on my OCI FortiGate, traffic doesn't match the policy.

I asked (through chat option) to Fortinet if have the Security Fabric configured on every FortiGate was a requirement, and they said that I don't need it for my simple setup. As long as I have connector working it should work.

Does any one have a setup like this? has any one connected one EMS to several FortiGate's ?

That could be a version problem also because FortiEMS is at version 7.0.7, on-Prem FGT is at 7.0.11 but the other 2 FortiGate's are at 7.0.5.

I'm planning upgrading them, but on I'm not sure if that will solve my problem.

Thanks in advance :)

#ZTNA

FortiClient 

FortiGate 

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Anthony_E]

Hello,

Did you already have a look into this document:

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/477578/ztna-ip-mac-filtering-example

Tell me if it is helping. Otherwise, we will continue to look for an answer.

Regards,

[fortiuser_new00]

Hello Anthony,

Thanks for taking the time to search a solution for me. Yes, i followed that configuration and It worked on my 1500D (on-prem) on 7.0.12 but it doesn't work with those on 7.0.5 version. I think is a version problem, even when they said versions are compatibles. 

Thanks again.

Laura

[Anthony_E]

Hello Laura,

Thank you for sharing this information. It will help I am sure.

Regards,