Configuring FortiClient EMS

The FortiGate Security Fabric root device can link to FortiClient Endpoint Management System (EMS) and FortiClient EMS Cloud (a cloud-based EMS solution) for endpoint connectors and automation. Up to seven EMS servers can be added to the Security Fabric, including a FortiClient EMS Cloud server. EMS settings are synchronized between all Fabric members.

To enable cloud-based EMS services, the FortiGate must be registered to FortiCloud with an appropriate user account. The following examples presume that the EMS certificate has already been configured.

To add an on-premise FortiClient EMS server to the Security Fabric in the GUI:

1. On the root FortiGate, go to System > Feature Visibility and enable Endpoint Control.

2. Go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS card.

3. Enable an EMS, and set Type to FortiClient EMS.

4. Enter a name and IP address or FQDN.

   When connecting to a multitenancy-enabled EMS, Fabric connectors must use an FQDN to connect to EMS, where the FQDN hostname matches a site name in EMS (including "Default"). The following are examples of FQDNs to provide when configuring the connector to connect to the default site and to a site named SiteA, respectively: default.ems.yourcompany.com, sitea.ems.yourcompany.com. See Multitenancy.

5. Optionally, enable EMS Threat Feed. See Malware threat feed from EMS for more information about using this setting in an AV profile.

6. Click OK.

   A window appears to verify the EMS server certificate:

   

7. Click Accept.

8. Click Accept.

   The Connection status is now Connected:

   

9. If the device is not authorized, log in to the FortiClient EMS to authorize the FortiGate under Administration > Fabric Devices.

To add a FortiClient EMS Cloud server to the Security Fabric in the GUI:

FortiClient EMS Cloud can only be configured when the FortiGate is registered to FortiCloud and the EMS Cloud entitlement is verified. If the FortiCloud account does not pass the FortiClient EMS Cloud entitlement check, the option is not selectable in the FortiClient EMS connector settings.

1. Go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS card.

2. Set the Type to FortiClient EMS Cloud.

3. Enter a name.

4. Click OK.

   A window appears to verify the EMS server certificate.

5. Click Accept.

   The Connection status is now Connected.

To test connectivity with the EMS server:

1. Go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS card.

2. In the Connection status section, click Refresh.

To add an on-premise FortiClient EMS server to the Security Fabric in the CLI:

config endpoint-control fctems
    edit {1 | 2 | 3 | 4 | 5}
        set status {enable | disable}
        set name <string>
        set server <ip_address>
        set certificate <string>
        set https-port <integer>
        set source-ip <ip_address>
    next
end

The https-port is the EMS HTTPS access port number, and the source-ip is the REST API call source IP address.

To add a FortiClient EMS Cloud server to the Security Fabric in the CLI:

config endpoint-control fctems
    edit {1 | 2 | 3 | 4 | 5}
        set status {enable | disable}
        set name <string>
        set fortinetone-cloud-authentication enable
        set certificate <string>
    next
end

To verify the EMS Cloud entitlement in the CLI:

# diagnose test update info 

To verify an EMS certificate in the CLI:

# execute fctems verify ems137

        Subject:     C = CA, ST = bc, L = burnaby, O = devqa, OU = top3, CN = sys169.qa.fortinet.cm, emailAddress = xxxx@xxxxxxxx.xxx
        Issuer:      CN = 155-sub1.fortinet.com
        Valid from:  2017-12-05 00:37:57  GMT
        Valid to:    2027-12-02 18:08:13  GMT
        Fingerprint: D3:7A:1B:84:CC:B7:5C:F0:A5:73:3D:BB:ED:21:F2:E0
        Root CA:     No
        Version:     3
        Serial Num:
                01:86:a2
        Extensions:
                Name:     X509v3 Basic Constraints
                Critical: yes
                Content:
                CA:FALSE

                Name:     X509v3 Subject Key Identifier
                Critical: no
                Content:
                35:B0:E2:62:AF:9A:7A:E6:A6:8E:AD:CB:A4:CF:4D:7A:DE:27:39:A4

                Name:     X509v3 Authority Key Identifier
                Critical: no
                Content:
                keyid:66:54:0F:78:78:91:F2:E4:08:BB:80:2C:F6:BC:01:8E:3F:47:43:B1
DirName:/C=CA/ST=bc/L=burnaby/O=devqa/OU=top3/CN=fac155.fortinet.com/emailAddress=xyguo@fortinet.com
serial:01:86:A4

                Name:     X509v3 Subject Alternative Name
                Critical: no
                Content:
                DNS:sys169.qa.fortinet.cm

                Name:     X509v3 Key Usage
                Critical: no
                Content:
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only

                Name:     X509v3 Extended Key Usage
                Critical: no
                Content:
                TLS Web Server Authentication, TLS Web Client Authentication

EMS configuration needs user to confirm server certificate.
Do you wish to add the above certificate to trusted remote certificates? (y/n)y

Configuring FortiClient EMS and FortiClient EMS Cloud on a per-VDOM basis

FortiClient EMS and FortiClient EMS Cloud can be added on a per-VDOM basis. Override must be configured for each VDOM that connects to an EMS server. If override is enabled for a VDOM, the global configuration will not affect the VDOM.

This feature requires FortiClient EMS 7.2.1 and later. With this override configuration, the FortiGate can connect to multiple on-premise FortiClient EMS instances per VDOM. However, with this same configuration, only one FortiClient EMS Cloud instance can be connected per FortiGate. Each VDOM supports up to seven EMS servers, plus an additional seven in the global configuration. With override enabled on all ten VDOMs, a 10-VDOM contract would have up to 77 EMS servers. If override is enabled on only one VDOM, a 10-VDOM contract would have up to 14 EMS servers.

This functionality can be applied to MSSP (managed security service provider) configurations, and each VDOM has its own FortiClient EMS card for the EMS server or instance. For example:

• Separate on-premise FortiClient EMS instances

  

• Single FortiClient EMS multi-tenant instance based on FQDN type

  

• Separate FortiClient EMS Cloud instances

  

To configure a FortiClient EMS server per VDOM in the GUI:

1. Enable override in the FortiOS CLI on the required VDOMs:

   config endpoint-control settings
       set override enable
   end

2. Navigate to the desired VDOM, then go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS card.

3. Configure the EMS server settings as needed (see the preceding examples for detailed steps).

To configure a FortiClient EMS server per VDOM in the CLI:

1. Enable override on the required VDOMs:

   config endpoint-control settings
       set override enable
   end

2. Configure the EMS server on the desired VDOM:

   (root) config endpoint-control fctems-override
       edit 1
           set status enable
           set name "ems140_root"
           set server "172.16.200.140"
           set serial-number "FCTEMS8821******"
           set tenant-id "00000000000000000000000000000000"
           set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id single-vdom-connector
       next
       edit 2
           set name "ems133_root"
           set server "172.16.200.133"
       next
   end

Troubleshooting

Certificate not trusted

When configuring a new connection to an EMS server, the certificate might not be trusted.

When you click Authorize, a warning displays: The server certificate cannot be authenticated with installed CA certificates. Please install its CA certificates on this FortiGate.

In the CLI, an error message displays when you try to verify the certificate:

# execute fctems verify Win2K16-EMS
certificate not configured/verified: 2
Could not verify server certificate based on current certificate authorities.
Error 1--92-60-0 in get SN call: EMS Certificate is not signed by a known CA.

The default FortiClient EMS certificate that is used for the SDN connection is signed by the CA certificate that is saved on the Windows server when FortiClient EMS is first installed. You can manually export and install it on the FortiGate.

To manually export and install the certificate on to the FortiGate:

1. Export the EMS certificate on the server that EMS is installed on:

   1. On the Windows server that EMS is installed on, go to Settings > Manage computer certificates.

   2. In the certificate management module, go to Trusted Root Certification Authorities > Certificates.

   3. Right click on the certificate issued by FortiClient Enterprise Management Server and select All Tasks > Export.

   4. The Certificate Export Wizard opens. Click Next.

   5. Select Base-64 encoded X.509, then click Next.

      

   6. Enter a file name for the certificate and click Browse to select the folder where it will be located, then click Next.

   7. Review the settings, then click Finish. The certificate is downloaded to the specified folder.

2. On the FortiGate, import the certificate:

   1. Go to System > Certificate. By default, the Certificate option is not visible, see Feature visibility for information.

   2. Click Import > CA Certificate.

   3. Set Type to File, and click Upload to import the certificate from the management computer.

   4. Click OK. The imported certificate is shown in the Remote CA Certificate section of the certificate table.

3. Try to authorize the certificate on the FortiGate:

   1. Go to Security Fabric > Fabric Connectors and edit the FortiClient EMS connector. The connection status should now say that the certificate is not authorized.

   2. Click Authorize. The following warning is shown:

      

      The warning can also be seen in the CLI:

      # execute fctems verify Win2K16-EMS
      failure in certificate configuration/verification: -4
      Could not verify EMS. Error 1--94-0-401 in get SN call: Authentication denied.
      

4. Authorize the FortiGate on EMS:

   1. Log in to the EMS server console and go to Administration > Fabric Devices.

   2. Select the serial number of the FortiGate device, then click Authorize.

5. Try to authorize the certificate on the FortiGate again:

   1. On the FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiClient EMS card.

   2. Click Refresh.

   3. When presented with the EMS server certificate, click Accept to accept the certificate.

      Your connection should now be successful and authorized.

   4. Click OK.

Using EMS silent approval in the Security Fabric

FortiClient EMS with Fabric authorization and silent approval capabilities can approve the root FortiGate in a Security Fabric once, and then silently approve remaining downstream FortiGates in the Fabric. Similarly in an HA scenario, an approval only needs to be made once to the HA primary unit. The remaining cluster members are approved silently.

To use EMS silent approval:

1. Configure the EMS entry on the root FortiGate or HA primary:

   config endpoint-control fctems
       edit "ems139"
           set fortinetone-cloud-authentication disable
           set server "172.16.200.139"
           set https-port 443
           set source-ip 0.0.0.0
           set pull-sysinfo enable
           set pull-vulnerabilities enable
           set pull-avatars enable
           set pull-tags enable
           set pull-malware-hash enable
           unset capabilities
           set call-timeout 30
           set websocket-override disable
       next
   end

   When the entry is created, the capabilities are unset by default.

2. Authenticate the FortiGate with EMS:

   # execute fctems verify ems_139
   ...

   The FortiGate will enable the Fabric authorization and silent approval based on the EMS supported capabilities.

   config endpoint-control fctems
       edit "ems139"
           set server "172.18.62.12"
           set capabilities fabric-auth silent-approval websocket
       next
   end

3. Configure a downstream device in the Security Fabric (see Configuring the root FortiGate and downstream FortiGates for more details). The downstream device will be silently approved.
4. Configure a secondary device in an HA system (see HA active-passive cluster setup and HA active-active cluster setup for more details). The secondary device will be silently approved.

Allowing deep inspection certificates to be synchronized to EMS and distributed to FortiClient

On FortiClient EMS versions that support push CA certs capability, the FortiGate will push CA certificates used in SSL deep inspection (see Deep inspection for more details) to the EMS server. On the EMS server, the CA certificates can be selected in the managed endpoint profiles so they can be installed on managed endpoints. FortiClient EMS 7.0.1 and later is required to use this feature.

To configure deep inspection certificate synchronization to EMS:

1. Configure the EMS Fabric connector:

   config endpoint-control fctems
       edit "ems138"
           set fortinetone-cloud-authentication disable
           set server "172.16.200.138"
           set https-port 443
           set source-ip 0.0.0.0
           set pull-sysinfo enable
           set pull-vulnerabilities enable
           set pull-avatars enable
           set pull-tags enable
           set pull-malware-hash enable
           set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs
           set call-timeout 30
           set websocket-override disable
           set preserve-ssl-session disable
       next
   end

2. Apply the certificate to an SSL/SSH profile for deep inspection:

   config firewall ssl-ssh-profile
       edit "deep-inspection"
           set comment "Read-only deep inspection profile."
           config https
               set ports 443
               set status deep-inspection
           end
           ...
           set server-cert-mode re-sign
           set caname "Fortinet_CA_SSL"
           set untrusted-caname "Fortinet_CA_Untrusted"
       next
   end

   The default deep inspection profile, CA certificate, and untrusted CA certificates are used in this example.

3. Configure the firewall policy:

   config firewall policy
       edit 1
           set name "deep-inspection"
           set srcintf "port14"
           set dstintf "port13"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set av-profile "default"
           set nat enable
       next
   end

4. In EMS, verify that the CA certificate was pushed to EMS:

   1. Go to Endpoint Policy & Components > CA Certificates.

      

   2. Verify the certificate table to see that the EMS server received the CA certification from the different FortiGates.

5. Select the CA certificate in the endpoint profile:

   1. Go to Endpoint Profiles > System Settings and edit a profile. The default profile is used in this example.

   2. In the Other section, enable Install CA Certificate on Client and select the Fortinet_CA_SSL certificate for the desired endpoint.

      

   3. Click Save.

   After the FortiClient endpoint is registered, it receives the CA certificate. When the FortiClient endpoint tries to access the internet through the FortiGate with the firewall policy that has deep inspection, no warning message is displayed. The server certificate is trusted with the installed CA certificate to complete the certificate chain.

Verification

Before configuring deep inspection certificate synchronization, a warning message is displayed when a FortiClient endpoint accesses the internet through the FortiGate with the firewall policy that has deep inspection. The FortiClient certificate store does not have the FortiGate's CA that is used in the deep inspection SSL/SSH profile.

For example, accessing https://www.facebook.com in Chrome shows a warning. In the address bar, clicking Not secure > Certificate opens the Certificate dialog, which indicates that Windows does not have enough information to verify the certificate.

After the EMS profile is pushed to FortiClient endpoint, the expected FortiGate's certificate is shown in its certificate store.

To verify the deep inspection certificate synchronization:

1. In Chrome, go to Settings > Privacy and security and open Manage certificates.
2. Click the Trusted Root Certification Authorities tab. The FortiGate's certificate appears in the list.

   

3. On the FortiClient endpoint using Chrome, go to https://www.facebook.com. The website is displayed.
4. In the address bar, click the padlock, then click Certificate. The dialog displays the valid certificate information.

   

Diagnostics

Use the diagnose endpoint fctems json deep-inspect-cert-sync command in FortiOS to verify the certificate information. In the following example, there are multiple VDOMs with FortiGates in HA mode.

To verify the primary FortiGate:

FGT_EC_Primary (global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""

To verify the secondary FortiGate:

FGT_EC_Secondary(global) # diagnose endpoint fctems json deep-inspect-cert-sync 
JSON:
"""
{
  "fortigates":[
    "FG2K5E39169*****",
    "FG2K5E39169*****"
  ],
  "vdoms":[
    {
      "vdom":"root",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    },
    {
      "vdom":"vdom1",
      "certs":[
        {
          "name":"Fortinet_CA_SSL",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID5jCCAs6g...Sfu+Q8zE8Crmt6L1X\/bv+q\\n-----END CERTIFICATE-----\\n"
        },
        {
          "name":"Fortinet_CA_Untrusted",
          "cert":"-----BEGIN CERTIFICATE-----\\nMIID8DCCAtig...3zBbfzP+nVUpC\\nZDPRZA==\\n-----END CERTIFICATE-----"
        }
      ]
    }
  ]
}
"""

Allowing FortiClient EMS connectors to trust EMS server certificate renewals based on the CN field

When a FortiGate establishes a Fabric connection with FortiClient EMS, the FortiGate must trust the CA that signed the server certificate. Upon the approval of the EMS certificate, the FortiGate saves the CN field and will trust future certificates that are signed by the same CA and have the same CN field. This allows EMS servers to update their certificates at regular intervals without requiring re-authorization on the FortiGate side, as long as the CN field matches. This prevents interruptions to the EMS Fabric connection when a certificate is updated. Previously, upon the user's approval of the certificate, the certificate fingerprint was saved on the FortiGate, and this required the FortiGate to re-authorize the EMS connection each time the server certificate is updated.

config endpoint-control fctems
    edit <id>
        set trust-ca-cn {enable | disable}
    next
end

This feature is supported for EMS on-premise and cloud connections, and is the default setting. To authorize based on the certificate fingerprint, disable the trust-ca-cn setting. If the setting is changed back to be enabled at a later time, the user will have to re-approve the EMS certificate.

To configure the EMS Fabric connector to trust EMS server certificate renewals based on the CN field:

config endpoint-control fctems
    edit 1
        set status enable
        set name "ems133"
        set dirty-reason none
        set fortinetone-cloud-authentication disable
        set server "172.18.62.35"
        set https-port 443
        set serial-number "FCTEMS8822000000"
        set tenant-id "00000000000000000000000000000000"
        set source-ip 0.0.0.0
        set pull-sysinfo enable
        set pull-vulnerabilities enable
        set pull-avatars enable
        set pull-tags enable
        set pull-malware-hash enable
        set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id
        set call-timeout 30
        set out-of-sync-threshold 180
        set websocket-override disable
        set preserve-ssl-session disable
        set interface-select-method auto
        set trust-ca-cn enable
    next
end

To verify the configuration:

1. Download the FortiGate configuration file.

2. Verify the ca-cn-info entry, which lists the trusted CA certificate information. In this example, ems133 connector has trust-ca-cn enabled and ems138 connector has trust-ca-cn disabled. For ems138, the ca-cn-info entry does not appear, and there is a certificate-fingerprint field instead:

   config endpoint-control fctems
       edit 1
           set status enable
           set name "ems133"
           set server "172.18.62.35"
           set serial-number "FCTEMS8822000000"
           set tenant-id "00000000000000000000000000000000"
           set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id
           set ca-cn-info "C = CA, ST = BC, L = VANCOUVER, O = FTNT, OU = ReleaseQA, CN = Release_QA, emailAddress = ********@fortinet.comRelease_QA"
       next
       edit 2
           set status enable
           set name "ems138"
           set server "172.18.62.18"
           set serial-number "FCTEMS8821000000"
           set tenant-id "00000000000000000000000000000000"
           set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api tenant-id
           set certificate-fingerprint "18:51:76:67:EB:4C:31:A1:51:3F:74:F7:8E:1D:47:5C:18:0F:FE:45:DF:52:91:52:37:0B:27:E7:F1:85:5B:01:8C:7D:FB:2D:C7:D2:CC:FE:4A:E3:0E:A9:2A:1C:27:4D:D2:A6:C5:87:B8:97:98:57:75:10:15:28:EF:A2:23:7C"
           set trust-ca-cn disable
       next
       ...
   end

3. Run diagnostics to view the certificate information:

   # diagnose test application fcnacd 96
   ems_id 1, certificate authority and common name: C = CA, ST = BC, L = VANCOUVER, O = FTNT, OU = ReleaseQA, CN = Release_QA, emailAddress = ********@fortinet.comRelease_QA
   ems_id 1, fingerprint_sha512: 
   ems_id 2, certificate authority and common name: 
   ems_id 2, fingerprint_sha512: 18:51:76:67:EB:4C:31:A1:51:3F:74:F7:8E:1D:47:5C:18:0F:FE:45:DF:52:91:52:37:0B:27:E7:F1:85:5B:01:8C:7D:FB:2D:C7:D2:CC:FE:4A:E3:0E:A9:2A:1C:27:4D:D2:A6:C5:87:B8:97:98:57:75:10:15:28:EF:A2:23:7C