Configuring a profile to allow or block endpoint from VPN tunnel connection based on the applied Zero Trust tag

You can configure a profile to allow or block an endpoint from connecting to a VPN tunnel based on its applied Zero Trust tag. This feature is only available for Windows endpoints. This example describes configuring an endpoint profile to prohibit Windows endpoints with critical vulnerabilities from connecting to VPN.

To configure an endpoint profile to prohibit endpoints with critical vulnerabilities from connecting to VPN:

1. Create a Zero Trust tagging rule set that tags endpoints with critical vulnerabilities with the "Vulnerable Devices" tag:
   1. Go to Zero Trust Tags > Zero Trust Tagging Rules.
   2. Click Add.
   3. In the Tag Endpoint As field, create a new "Vulnerable Devices" tag.
   4. Toggle Enabled to on.
   5. Click Add Rule.
   6. For Windows devices, from the Rule Type dropdown list, select Vulnerable Devices.
   7. From the Severity Level dropdown list, select Critical.
   8. Click Save.
   9. Click Save again.

      

2. Configure the options on the endpoint profile:
   1. Go to Endpoint Profiles > Manage Profiles.
   2. Edit the desired profile, or create a new one.
   3. On the VPN tab, enable Enable Secure Remote Access.
   4. Select an existing VPN tunnel, or create a new one by clicking Add Tunnel.
   5. In Advanced Settings, for Host Tag, select Prohibit.
   6. From the Select a Tag dropdown list, select Vulnerable Devices.
   7. Enable Customize Host Check Fail Warning.
   8. Enter a message to display to users when their connection to the VPN tunnel is prohibited due to critical vulnerabilities on their device.
   9. Configure other fields as desired.
   10. Save the configuration.

       

After the next communication between EMS and FortiClient, endpoints with this profile applied will be unable to connect to this VPN tunnel if they have critical vulnerabilities. The following shows the notification that the end user sees when their connection to the VPN tunnel is prohibited due to critical vulnerabilities on their device. After the end user fixes the vulnerabilities, they will be allowed to establish the VPN connection.