Fabric Devices

You can view all FortiGates that the EMS has authorized in Administration > Fabric Devices. You can also deny or authorize a FortiGate. These FortiGates receive endpoint data from EMS. FortiClient does not directly connect to FortiGates listed on this page.

Fabric Devices displays the relationships between FortiGates if they are part of a cooperative Security Fabric (CSF) or high availability (HA) cluster. The following shows the Fabric Devices page showing two FortiGates that are part of a CSF tree:

The following shows Fabric Devices showing two FortiGates that are part of an HA cluster:

Fabric connection for non-root devices expires after 15 minutes, unless the root device (the device that manages the non-root device) calls an EMS API to keep it alive.

FortiOS versions 7.0.2 to 7.0.6 only support zero trust tags and does not support other tag types when used with EMS. FortiClient endpoints connected via zero trust network access do not provide IP addresses to FortiOS.

For connection to FortiAnalyzer, see Incoming ports.

To edit the Fabric device tag sharing settings:

1. Go to Administration > Fabric Devices.
2. Select the desired device, then select Edit.
3. From the FortiClient Endpoint Sharing dropdown list, select one of the following:

   Option	Description
   Share all FortiClients	Selected FortiGate receives all endpoints' resolved IP or MAC addresses (hereafter referred to as "host tag"), regardless of whether the gateways point to the selected FortiGate.
   Only share FortiClients connected to this fabric device (Recommended)	Default setting. Selected FortiGate only receives the host tags for endpoints whose gateways point to the selected FortiGate.
   Share FortiClients connected to selected fabric devices	The selected FortiGate receives host tags for endpoints whose gateways point to the following: The selected FortiGate Configured additional FortiGates. You can configure up to four additional FortiGates.

4. In Tag Types Being Shared, select at least one tag type to share. EMS selects Zero Trust Tags by default and you cannot deselect it. EMS only shares the selected tag types with the configured Fabric devices.

   Tag	Description
   Zero Trust tags	See Zero Trust Tags.
   FortiGuard outbreak alert tags	See FortiGuard Outbreak Alerts.
   Classification tags	See Viewing the Endpoints pane.
   Fabric tags	Fabric tags require connection to FortiAnalyzer. See the following process: EMS administrator configures FortiAnalyzer in a System Settings profile. See System Settings. FortiClient connects to EMS and receives FortiAnalyzer connection information from the profile. FortiClient sends logs to FortiAnalyzer. FortiAnalyzer administrator configures rule to tag endpoints which have indicators of compromise (IOC). If a log entry received from FortiClient on the FortiAnalyzer matches an IOC, FortiAnalyzer adds a tag to that endpoint. EMS adds this tag to the endpoint. You can view the tag in the endpoint details, as well as in Zero Trust Tag Monitor. This tag displays as a Fortinet Security Fabric tag in Zero Trust Tag Monitor, but the tag displays under Classification Tags in endpoint details. See Viewing the Endpoints pane. If FortiGate is configured to receive all tags for this specific endpoint, EMS sends the tag to FortiGate. See EMS API support for FortiAnalyzer to notify and tag suspicious endpoints.

5. Click Save.

To change the FortiGate authorization status:

1. Go to Administration > Fabric Devices.
2. Select the desired FortiGate.
3. Click Deny or Authorize. The FortiGate status in the Authorized column changes.