Configuring FortiOS dynamic policies using EMS security posture tags

FortiOS uses an EMS connector to retrieve security posture tags from EMS. Configuring this feature requires the following steps:

1. Checking prerequisites
2. Configuring the EMS connector:
   1. Uploading certificates to EMS and FortiOS
   2. Creating the EMS connector in FortiOS
   3. Authorizing the FortiOS EMS connector in EMS
   4. Verifying the FortiOS-EMS connection in FortiOS
3. Creating an address group for the security posture tags
4. Creating a dynamic firewall policy using security posture tags from EMS

If you configure a connection between EMS and a FortiGate that is part of a Security Fabric with multiple FortiGates, the root FortiGate can also obtain security posture tags from EMS. However, the root FortiGate does not have any IP addresses to associate with the received tags.

Checking prerequisites

You must ensure that the following prerequisites are met before configuring this feature:

• Create security posture tagging rules. See Adding a security posture tagging rule set.
• After FortiClient connects Telemetry to EMS, confirm that EMS dynamically tags endpoints based on the security posture tagging rules. See Security Posture Tag Monitor.
• Export a certificate authority (CA)-signed certificate to upload to FortiOS and web server certificate to upload to EMS. For details on configuring a server certificate using the Microsoft Certification Authority Management Console, see Configure the Server Certificate Template. You can use another CA as desired.

Configuring the EMS connector

Uploading certificates to EMS and FortiOS

To upload certificates to EMS and FortiOS:

Setting up a secure connection between EMS and FortiOS requires a certificate. Uploading the CA-signed certificate to FortiOS allows FortiOS to trust the certificate that you configure in EMS.

1. Configure the server certificate in EMS:
   1. Go to System Settings > EMS Server Certificates.
   2. Click Add.
   3. Configure the certificate as desired.
   4. Go to System Settings > EMS Settings.
   5. Under Shared Settings, from the Webserver certificate dropdown list, select the configured certificate.
   6. Click Save.
2. Upload the certificate to FortiOS:
   1. Go to System > Certificates.
   2. From the Create/Import dropdown list, select CA Certificate.
   3. Upload the CA-signed certificate.

Creating the EMS connector in FortiOS

You can create the EMS connector in the FortiOS GUI or CLI.

To create the EMS connector in the FortiOS GUI:

1. Go to Security Fabric > Fabric Connectors.
2. Right-click FortiClient EMS, then select Edit.
3. For Status, select Enabled.
4. For Type, select FortiClient EMS.
5. In the Name field, enter the desired name.
6. In the IP/Domain name field, enter the EMS IP address or domain name. If EMS multitenancy is enabled, you must enter the FQDN instead of the IP address. You must enter the FQDN in the format site.fqdn to integrate the FortiGate to the specific EMS multitenancy site. For example, if the site name is sitea, enter sitea.ems.example.com. See Multitenancy.
7. Ensure to enable Synchronize firewall addresses. This allows FortiOS to automatically create and synchronize firewall addresses for security posture tags received from EMS.

   

8. Click OK.

To create the EMS connector in the FortiOS CLI:

config endpoint-control fctems

edit 1

set fortinetone-cloud-authentication disable

set server "172.16.200.137"

set https-port 443

set source-ip 0.0.0.0

set pull-sysinfo enable

set pull-vulnerabilities enable

set pull-avatars enable

set pull-tags enable

set call-timeout 180

next

end

Authorizing the FortiOS EMS connector in EMS

To authorize the FortiOS EMS connector in EMS:

EMS must authorize the Fabric connector created in FortiOS. Do one of the following:

• Log in to EMS. A prompt displays to authorize the FortiGate. Click Authorize.
• Go to Fabric & Connectors > Fabric Devices. Select the desired FortiGate, then click Authorize.

You can view all FortiGates that the EMS has authorized in Fabric & Connectors > Fabric Devices. See Fabric Devices.

Verifying the FortiOS-EMS connection in FortiOS

To verify the FortiOS-EMS connection in FortiOS:

1. Authorize the connection by doing one of the following:
   1. In Security Fabric > Fabric Connectors, click the desired EMS connector. Click Authorize.
   2. After EMS authorizes the FortiGate, authorize the connection in the FortiOS CLI by running the execute fctems verify <EMS ID> command.
2. FortiOS should now automatically pull security posture tags from EMS. Go to Policy & Objects > ZTNA > Security Posture Tags to view the tags.

   

Creating an address group for the security posture tags

To create an address group for the ZTNA tags in the FortiOS CLI:

config firewall addrgrp

edit SPgroup

set category ztna-ems-tag

next

end

Creating a dynamic firewall policy using security posture tags from EMS

To create a dynamic firewall policy using ZTNA tags from EMS:

1. In FortiOS, go to Policy & Objects > Firewall Policy. Click Create new.
2. In the Security posture tag field, click +. The Select Entries pane appears. Under Security Posture Tag, select the desired tag from EMS.
3. Configure other options as desired. Click OK.
4. Go to Policy & Objects > Firewall Policy to ensure the policy was created. FortiOS updates this policy when it receives updates from EMS.