EMS Administration Guide

Introduction
- FortiClient EMS components
- Documentation
Getting started
- Getting started with managing Windows, macOS, and Linux endpoints
- Getting started with managing Chromebooks
Installation preparation
- System requirements
- License types
  - FortiClient EMS
  - Component applications
- Required services and ports
- Management capacity
- FortiClient Telemetry security features
- Server readiness checklist for installation
- Upgrading from an earlier FortiClient EMS version
- Install preparation for managing Chromebooks
Installation and licensing
- Downloading the installation file
- Installing FortiClient EMS
- Installing FortiClient EMS using the CLI
- Starting FortiClient EMS and logging in
- Accessing FortiClient EMS remotely
- Licensing FortiClient EMS
  - License status
  - Help with licensing
- Specifying different ports
- Upgrading Microsoft SQL Server Express to Microsoft SQL Server Standard or Enterprise
- Uninstalling FortiClient EMS
Chromebook-only setup
- Google Admin Console setup
- Service account credentials
  - Configuring default service account credentials
  - Configuring unique service account credentials
GUI
- Banner
- Left pane
- Content pane
Dashboard
- Viewing the FortiClient Status
- Viewing the Vulnerability Scan dashboard
- Viewing Chromebook Status
Endpoint management
- Windows, macOS, and Linux endpoints
- Google Domains
- Group assignment rules
Quarantine Management
- Files
- Whitelist
Software Inventory
- Applications
- Hosts
Endpoint Policy
- Adding an endpoint policy
- Editing an endpoint policy
- Deleting an endpoint policy
- Enabling/disabling an endpoint policy
- Managing endpoint policy priority levels
Chromebook Policy
Endpoint Profiles
- Configuring profiles
- Viewing profiles
- Managing profiles
- Profile references
Managing installers
- Deployment Packages
- FortiClient installers
  - Adding a custom FortiClient installer
  - Viewing installers
Policy Components
- CA Certificates
- On-net Detection Rules
Telemetry Gateway Lists
- Creating a Telemetry gateway list
- Exporting a Telemetry gateway list to XML
- Viewing Telemetry gateway lists
- Viewing assigned Telemetry gateway lists
Compliance Verification
- Compliance Verification Rules
- Host Tag Monitor
- Configuring FortiOS dynamic policies using EMS dynamic endpoint groups
- Fabric Device Monitor
Deployment
- Preparing the AD server for deployment
- Preparing Windows endpoints for FortiClient deployment
- Deploying FortiClient on endpoints
- Deploying initial installations of FortiClient (macOS)
- Deploying FortiClient upgrades from FortiClient EMS
Administration
- Administrators
- Admin roles
- User Servers
- Configuring User Settings
- Fabric Devices
- Database management
  - Backing up the database
  - Restoring the database
- Licenses
  - Logging into FortiCare
  - Uploading a license file for activation, upgrade, or renewal
- Logs
System Settings
- Configuring Server settings
- Adding an SSL certificate to FortiClient EMS for Chromebook endpoints
- Configuring Logs settings
- Configuring Fortinet Services settings
- Configuring Endpoints settings
- Configuring the login banner
- SAML SSO
- Alerts
- Custom Messages
  - Customizing the endpoint quarantine message
  - Customizing Web Filter messages
Creating a support package

Home FortiClient 6.2.2 EMS Administration Guide

6.2.2

Required services and ports

You must ensure required ports and services are enabled for use by FortiClient EMS and its associated applications on your server. The required ports and services enable FortiClient EMS to communicate with endpoints and servers running associated applications. You do not need to enable ports 8013 and 10443 as the FortiClient EMS installation opens these.

Communication	Usage	Protocol	Port	Incoming/Outgoing	How to customize
FortiClient Telemetry	FortiClient endpoint management	TCP	8013 (default)	Incoming	Installer/GUI
Samba (SMB) service	FortiClient EMS uses the SMB service during FortiClient initial deployment.	TCP	445	Outgoing	N/A
Distributed Computing Environment / Remote Procedure Calls (DCE/RPC)	The FortiClient EMS server connects to endpoints using RPC for FortiClient initial deployment.	TCP	135	Outgoing	N/A
AD server connection	Retrieving workstation and user information	TCP	389 (LDAP) or 636 (LDAPS)	Outgoing	GUI
FortiClient download	Downloading FortiClient deployment packages created by FortiClient EMS	TCP	10443 (default)	Incoming	Installer
Apache/HTTPS	Web access to FortiClient EMS	TCP	443	Incoming	Installer
FortiGuard	FortiGuard AV, vulnerability, and application version updates	TCP	80	Outgoing	N/A
SMTP server/email	Alerts for FortiClient EMS and endpoint events. When an alert is triggered, EMS sends an email notification.	TCP	25 (default)	Outgoing	GUI
FortiClient endpoint probing	FortiClient EMS uses ICMP for endpoint probing during FortiClient initial deployment.	ICMP	N/A	Outgoing	N/A
FSSO	Connection to FortiOS.	TCP	8000	Incoming	N/A

The following ports and services only apply when using FortiClient EMS to manage Chromebooks:

Communication	Usage	Protocol	Port	Incoming/Outgoing	How to customize
FortiClient on Chrome OS	Connecting to FortiClient EMS	TCP	8443 (default) You can customize this port.	Incoming	GUI
G suite API/Google domain directory	Retrieving Google domain information using API calls	TCP	443	Outgoing	N/A

Communication

Usage

Protocol

Port

Incoming/Outgoing

How to customize

FortiClient on Chrome OS

Connecting to FortiClient EMS

TCP

8443 (default)

You can customize this port.

Incoming

GUI

G suite API/Google domain directory

Retrieving Google domain information using API calls

TCP

443

Outgoing

N/A

The following ports and services should be enabled for use on Chromebooks when using FortiClient for Chromebooks:

Communication	Usage	Protocol	Port	Incoming/Outgoing	How to customize
FortiClient EMS	Connecting to the profile server	TCP	8443 (default)	Outgoing	Via Google Admin console when adding the profile
FortiGuard	Rating URLs	TCP	443, 3400	Outgoing	N/A
FortiAnalyzer	Sending logs to FortiAnalyzer	TCP	8443	Outgoing	N/A

For the list of required services and ports for FortiClient, see the FortiClient Administration Guide.