ZTNA tag caching and direct tag synchronization

FortiOS supports resilient ZTNA enforcement by allowing tag evaluation to continue using cached endpoint information when communication with FortiClient EMS is temporarily unavailable. This improves reliability by preventing unnecessary access disruptions caused by EMS connectivity issues. The cache duration is configurable and has a default of 180s.

In addition, an optimized tag synchronization model reduces dependency on EMS for real-time tag resolution by enabling direct tag sharing between FortiClient and FortiGate. This streamlined approach minimizes latency, reduces complexity, and enhances overall system stability, while providing uninterrupted ZTNA service in the event of an EMS outage.

To configure the tag cache duration:

config endpoint-control fctems
    edit 0
        set out-of-sync-threshold <int>
    next
end

To see a listing of the ZTNA cache:

# diagnose test app fc 7
(...)
#ID:1
UID: 0D48C06390CA42D78158BE90C480A3F0
EMS: FCTEMS1234567890 00000000000000000000000000000000
State: sysinfo:1, tag:1, tagsz:1, out-of-sync:0, ref:0
Owner: (...)
Cert SN: EA997DBF4(...)184C608C62E2A40B
online: Yes
Sub TS: 0
Route IP:10.6.30.214, vdom:vdom1(1)
Route IP:10.1.100.214, vdom:vdom1(1)
Route IP:255.255.255.255, vdom:vdom1(1)
idx:0, ttdl:1 name:all_registered_clients
idx:4, ttdl:1 name:ZT_EMS_MGMT
idx:5, ttdl:1 name:Group-Membership-Domain-Use
idx:7, ttdl:1 name:ZT_AD_MGMT
idx:8, ttdl:1 name:ZT_OS_WIN
idx:9, ttdl:1 name:ZT_PO_AV_ENABLED
idx:10, ttdl:1 name:ZT_PO_VUL_CRITICAL
idx:11, ttdl:1 name:Group-Membership-Domain-U
idx:12, ttdl:1 name:Group-Membership-Domain-Users
idx:13, ttdl:1 name:ZT_FILE_TESTFILE

To see a listing of the gateway VPN cache:

# diagnose test app fc 33
Gateway VPN Cache:
0:
  uid: 0D48C06390CA42D78158BE90C480A3F0
    route#0:
    vdom: vdom1
    intf: ipsecvpn_0
    sn: FG181FTK12345678
    IP: 3.1.1.1
Gateway IPv4 Cache:
0: vdom1_3.1.1.1: 0D48C06390CA42D78158BE90C480A3F0
Gateway IPv6 Cache: