Configuring the FortiClient Compliance Profile in FortiOS
You will configure a FortiClient Compliance Profile in FortiOS. FortiGate provides these compliance rules to the endpoint. In this example, you will configure the profile to do the following:
- Block the endpoint from accessing the network if it has critical or high vulnerabilities
- Warn the endpoint if forticlient.exe is not running. The user can acknowledge and proceed past the warning to access the network.
- In FortiOS, go to Security Profiles > FortiClient Compliance.
- Create a new profile by selecting the + icon in the upper right corner.
- In the Profile Name field, enter the desired profile name.
- In the Assign Profile To field, select the desired device groups, user groups, and users to assign the profile to. In this example, we are assigning the profile to all Android phones and Windows PCs.
- Configure the Vulnerability Scan compliance rule:
- Enable Endpoint Vulnerability Scan on FortiClient.
- From the Vulnerability level dropdown list, select High. This means the non-compliance action will apply to all endpoints with vulnerabilities detected as High or Critical (the only level greater than High).
- For the Non-compliance action, select Block.
- Configure the running application compliance rule:
- Enable System Compliance
- Enable Check Running Applications.
- Click Create New.
- In the Application Name field, enter FortiClient.
- Ensure that Application Check Rule is set to Present.
- In the Process Name 1 field, enter forticlient.exe.
- Click OK.
- Click Apply.
The compliance rule has been created. You can view it in Security Profiles > FortiClient Compliance.
