ZTNA scalability support for up to 50 thousand concurrent endpoints

ZTNA scalability supports up to 50 thousand concurrent endpoints. Communication between FortiOS and FortiClient EMS has efficient queries that request incremental updates. Retrieved device information can be written to the FortiClient NAC daemon cache.

FortiOS can receive tag information from the EMS common tags API. This feature requires FortiClient EMS 7.0.3 or later.

The APIs api/v1/report/fct/uid_tags and api/v1/report/fct/tags replace the API api/v1/report/fct/host_tags.

To use the common tags API capability:

1. Enable the common tags API when connecting the EMS:

   config endpoint-control fctems
       edit "local.ems"
           set server "10.6.30.213"
           set capabilities fabric-auth silent-approval websocket websocket-malware push-ca-certs common-tags-api
       next
   end

2. The FortiGate uses the new APIs to obtain device information from the EMS:

   [ec_ems_context_submit_work:414] Call submitted successfully.
       obj-id: 11, desc: REST API to get updates of tag endpoints., entry: api/v1/report/fct/tags.
   [ec_ems_context_submit_work:414] Call submitted successfully.
       obj-id: 12, desc: REST API to get updates of tags associated with FCT UID., entry: api/v1/report/fct/uid_tags.
   [ec_ez_worker_process:334] Processing call for obj-id: 11, entry: "api/v1/report/fct/tags"
   [dynamic_addr_ha_act:215] called (EMS SN N/A).
   [dynamic_addr_ha_act:215] called (EMS SN N/A).
   [ec_ez_worker_process:441] Call completed successfully.
       obj-id: 11, desc: "REST API to get updates of tag endpoints.", entry: "api/v1/report/fct/tags".
   [ec_ez_worker_process:334] Processing call for obj-id: 12, entry: "api/v1/report/fct/uid_tags"
   [ec_record_sync_tags_info_store:1419] Received 1 tags for 3D86DF70B85E16CBAD67908A897B4494 with sn FCTEMS8888888888
   [ec_record_sync_tags_info_store:1419] Received 1 tags for DA12930442F13F84D2441F03FCB6A10E with sn FCTEMS8888888888
   [ec_record_sync_tags_info_store:1419] Received 1 tags for 25C59C275F257F4C5FBC7F6F5F56788E with sn FCTEMS8888888888
   [ec_ez_worker_process:441] Call completed successfully.
       obj-id: 12, desc: "REST API to get updates of tags associated with FCT UID.", entry: "api/v1/report/fct/uid_tags".
   [ec_ems_context_submit_work:414] Call submitted successfully.
       obj-id: 7, desc: REST API to get updates about system info., entry: api/v1/report/fct/sysinfo.
   [ec_ems_context_submit_work:414] Call submitted successfully.
       obj-id: 11, desc: REST API to get updates of tag endpoints., entry: api/v1/report/fct/tags.
   [ec_ez_worker_process:334] Processing call for obj-id: 11, entry: "api/v1/report/fct/tags"
   [ec_ez_worker_process:441] Call completed successfully.
       obj-id: 11, desc: "REST API to get updates of tag endpoints.", entry: "api/v1/report/fct/tags".
   (......)

3. Confirm that the device information from the EMS is written to the FortiClient NAC daemon cache:

   # diagnose endpoint record list
       ...
             Avatar source: OS
               Phone number:
               Number of Routes: (1)
                       Gateway Route #0:
                               - IP:10.1.91.6, MAC: 4f:8d:c2:73:dd:fe, Indirect: no
                               - Interface:port2, VFID:1, SN: FG5H1E5999999999
   online records: 37174; offline records: 0; quarantined records: 0; out-of-sync records: 0

4. Use the tags that are pulled from the EMS in a firewall address:

   config firewall address
       edit "FCTEMS8888888888_ZT_AD_MGMT"
           set type dynamic
           set sub-type ems-tag
           set obj-tag "ZT_AD_MGMT"
           set tag-type "zero_trust"
       next
   end

5. Check the tags' resolved IP and MAC addresses:

   # diagnose firewall fqdn getinfo-ip FCTEMS8888888888_ZT_AD_MGMT
   getinfo FCTEMS8888888888_ZT_AD_MGMT id:114 generation:106 count:187 data_len:6160 flag 0
   

   # diagnose firewall fqdn getinfo-mac MAC_FCTEMS8888888888_ZT_AD_MGMT
   getinfo MAC_FCTEMS8888888888_ZT_AD_MGMT id:163 generation:105 count:371 data_len:2226 flag 0
   

   # diagnose firewall dynamic address  FCTEMS8888888888_ZT_AD_MGMT
   CMDB name: FCTEMS8888888888_ZT_AD_MGMT
   TAG name: ZT_AD_MGMT
   FCTEMS8888888888_ZT_AD_MGMT: ID(114)
           ADDR(10.1.10.4)
   (......)
           ADDR(10.1.99.195)
   Total IP dynamic range blocks: 190.
   Total IP dynamic addresses: 281.
   

   # diagnose firewall dynamic address MAC_FCTEMS8888888888_ZT_AD_MGMT
   CMDB name: MAC_FCTEMS8888888888_ZT_AD_MGMT
   TAG name: ZT_AD_MGMT
   MAC_FCTEMS8888888888_ZT_AD_MGMT: ID(163)
           MAC(52:f1:9d:06:1c:db)
           MAC(4b:77:2b:db:82:15)
           MAC(df:6e:9e:d9:04:1e)
   Total MAC dynamic addresses: 393.