Adding a FortiClient deployment package
After you add a FortiClient deployment package to FortiClient EMS, you cannot edit it. You can delete the deployment package from FortiClient EMS, and edit the deployment package outside of FortiClient EMS. You can then add the edited deployment package to FortiClient EMS.
To add a deployment package:
- Go to Manage Installers > Deployment Packages.
- Click Add.
- On the Version tab, set the following options:
Use an official or custom FortiClient installer. See FortiClient installers.
Select the FortiClient release version to install.
Select the specific FortiClient patch version to install.
Keep updated to the latest patch
Enable FortiClient to automatically update to the latest patch release when FortiClient is installed on an endpoint.
- Click Next. On the General tab, set the following options:
Enter the FortiClient deployment package name.
(Optional) Enter notes about the FortiClient deployment package.
- Click Next. On the Features tab, set the following options:
Available options may differ depending on the features you have enabled or disabled in Feature Select.
See Feature Select.
Enabled by default and cannot be disabled. Installs FortiClient with Telemetry enabled.
Enabled by default and cannot be disabled. Installs FortiClient with Vulnerability Scan enabled.
Secure Access Architecture Components
Install FortiClient with SSL and IPsec VPN enabled. Disable to omit SSL and IPsec VPN support from the FortiClient deployment package.
If you enable this feature for a deployment package and include a preconfigured VPN tunnel in the included endpoint profile, users who use this deployment package to install FortiClient can connect to this preconfigured VPN tunnel for three days after their initial FortiClient installation. This is useful for remote users, as it allows them to connect to the corporate network to activate their FortiClient license. If the user does not activate their FortiClient license within the three days, all FortiClient features, including VPN, stop working on their device.
See VPN for details on configuring a VPN tunnel.
Advanced Persistent Threat (APT) Components
Install FortiClient with APT components enabled. Disable to omit APT components from the FortiClient deployment package. Includes FortiSandbox detection and quarantine features.
Additional Security Features
Enable any of the following features:
- Web Filtering
- Application Firewall
- Single Sign-On mobility agent
- Cloud Based Malware Outbreak Detection. This feature is available for FortiClient 6.2.0 and later versions.
Disable to exclude features from the FortiClient deployment package.
If you enable a feature in the deployment package that is disabled in Feature Select, the feature is installed on the endpoint, but is disabled and does not appear in the FortiClient GUI. For example, when Web Filter is disabled in Feature Select, if you enable Web Filtering in a deployment package, the deployment package installs Web Filter on the endpoint. However, the Web Filter feature is disabled on the endpoint and does not appear in the FortiClient GUI.
- Click Next. On the Advanced tab, set the following options:
Enable automatic registration
Configure FortiClient to automatically connect Telemetry to FortiClient EMS after FortiClient installs on the endpoint. Disable to turn off this feature and require endpoint users to manually connect Telemetry to FortiClient EMS.
Enable desktop shortcut
Configure the FortiClient deployment package to create a desktop shortcut on the endpoint.
Enable start menu shortcut
Configure the FortiClient deployment package to create a Start menu shortcut on the endpoint.
Enable Installer ID
Configure an installer ID. Select an existing installer ID or enter a new installer ID. If creating an installer ID, select a group path or create a new group in the Group Path field. FortiClient EMS automatically groups endpoints according to installer ID group assignment rules.
If you manually move the endpoint to another group after EMS places it into the group defined by the installer ID group assignment rule, EMS returns the endpoint to the group defined by the installer ID group assignment rule.
In an environment with a large number of endpoints, since you can configure each deployment package with only one installer ID, it may be inefficient to create a deployment package for each installer ID. See Deploying different installer IDs to endpoints using the same deployment package.
Enable Endpoint Profile
Select an endpoint profile to include in the installer. EMS applies the profile to the endpoint once it has installed FortiClient. This option is necessary if it is required to have certain security features enabled prior to contact with EMS, or if users require VPN connection to connect to EMS.
- Click Next. The Telemetry tab displays the hostname and IP address of the FortiClient EMS server, which will manage FortiClient once it is installed on the endpoint. Also configure the following option:
Enable telemetry connection to Security Fabric (FortiGate)
Enable this option, and select the name of the gateway list to use. The gateway list defines the IP address for the FortiGate.
If you have not created a gateway list, this option is not available.
- Click Finish. The FortiClient deployment package is added to FortiClient EMS and displays on the Manage Installers > Deployment Packages pane. The deployment package may include .exe (32-bit and 64-bit), .msi, and .dmg files depending on the configuration.
The following shows an example of a deployment package that includes .exe, .msi, and .dmg files. The end user can download these files to install FortiClient on their machine with the desired configuration.
If the Sign software packages option is enabled in System Settings > Server, Windows deployment packages display as being from the publisher specified in the certificate file. See