Support for FortiGate per-VDOM connection and Fabric Devices enhancements 7.2.1

In EMS 7.2.1, each FortiOS virtual domain (VDOM) can connect to a separate EMS or EMS multitenancy site. This provides EMS with the ability to only send FortiClient and tagging information to a single FortiOS VDOM.

The Fabric Devices page has been enhanced to display the relationships between FortiGates if they are part of a cooperative Security Fabric (CSF) or high availability (HA) cluster. The following shows the Fabric Devices page showing two FortiGates that are part of a CSF tree:

The following shows the Fabric Devices page showing two FortiGates that are part of an HA cluster:

This feature requires FortiOS 7.4.

To configure EMS support for FortiGate per-VDOM connection:

1. In FortiOS, enable the VDOM feature by doing one of the following:
   1. Go to System > VDOM and create a new site.
   2. Run the following commands:

      config system global
         set vdom-mode multi-vdom
      end

   

2. In EMS, enable multitenancy. Create a new multitenancy site.
3. Configure a Fortinet Security Fabric connection from the FortiGate root VDOM to the EMS default site. Once connected, the EMS default site shows the FortiGate root VDOM in Administration > Fabric Devices in <FortiGate serial number> - <VDOM name> format:

   config vdom
   edit root
   config endpoint-control settings
       set override enable
   end
   config endpoint-control fctems-override
       edit 1
           set status enable
           set name "ems_default"
           set server "default.ems1.fortitest.ca"
       next
   end

   

4. Configure a Fabric connection from the FortiGate non-root VDOM to the EMS non-default site. Once connected, the EMS non-default site shows the FortiGate non-root VDOM in Administration > Fabric Devices in <FortiGate serial number> - <VDOM name> format:

   config vdom
   edit site1
   config endpoint-control settings
       set override enable
   end
   config endpoint-control fctems-override
       edit 1
           set status enable
           set name "ems_site1"
           set server "site1.ems1.fortitest.ca"
       next
   end

   

5. Tagging information from an EMS site is only shared with the FortiGate VDOM that the EMS site has established a Fabric connection with. In this example, the ems_connected_default site is a tag configured on the EMS default site.

   

   ems_connected_site1 is a tag configured on the EMS non-default site.

   

   You can hover over the FortiGate in EMS and select Edit to update tag and FortiClient endpoint sharing information. You can also configure an alias for easier FortiGate identification. EMS shows one of the following authorization states for the Fabric connection: authorized, deauthorized, or pending.