Fortinet Document Library

Version:

Version:

Version:


Table of Contents

Related Videos

sidebar video

Setting up EMS Connector in FortiOS 6.4

  • 4,527 views
  • 11 months ago

Administration Guide

Download PDF
Copy Link

FortiClient EMS

The FortiGate Security Fabric root device can link to FortiClient Endpoint Management System (EMS) and FortiClient EMS Cloud (a cloud-based EMS solution) for endpoint connectors and automation. Up to three EMS servers can be added to the Security Fabric, including a FortiClient EMS Cloud server. EMS settings are synchronized between all fabric members.

To enable cloud-based EMS services, the FortiGate must be registered to FortiCloud with an appropriate user account. The following examples presume that the EMS certificate has already been configured.

To add an on-premise FortiClient EMS server to the Security Fabric in the GUI:
  1. On the root FortiGate, go to System > Feature Visibility and enable Endpoint Control.
  2. Go to Security Fabric > Fabric Connectors.
  3. Click Create New and click FortiClient EMS.
  4. For Type, click FortiClient EMS.
  5. Optionally, enable EMS Threat Feed. See Malware threat feed from EMS for more information about using this setting in an AV profile.
  6. Enter a name and IP address or FQDN. When connecting to a multitenancy-enabled EMS, Fabric connectors must use an FQDN to connect to EMS, where the FQDN hostname matches a site name in EMS (including "Default"). The following are examples of FQDNs to provide when configuring the connector to connect to the default site and to a site named SiteA, respectively: default.ems.yourcompany.com, sitea.ems.yourcompany.com. See Multitenancy.
  7. Click OK.

    A window appears to verify the EMS server certificate:

  8. Click Accept.

    The FortiClient EMS Status section displays a Successful connection and an Authorized certificate:

  9. If the device is not authorized, log in to the FortiClient EMS to authorize the FortiGate under Administration > Fabric Devices.
To add a FortiClient EMS Cloud server to the Security Fabric in the GUI:
  1. Go to Security Fabric > Fabric Connectors.
  2. Click Create New and click FortiClient EMS.
  3. Set Type to FortiClient EMS Cloud.
  4. Enter a name.
  5. Click OK.

    A window appears to verify the EMS server certificate.

  6. Click Accept.

    The FortiClient EMS Status section displays a Successful connection and an Authorized certificate.

To test connectivity with the EMS server:
  1. Go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS or FortiClient EMS Cloud card.
  2. In the FortiClient EMS Status section under Connection, click Refresh.
To add an on-premise FortiClient EMS server to the Security Fabric in the CLI:
config endpoint-control fctems
    edit <ems_name>
        set server <ip_address>
        set certificate <string>
        set https-port <integer>
        set source-ip <ip_address>
    next
end

The https-port is the EMS HTTPS access port number, and the source-ip is the REST API call source IP address.

To add a FortiClient EMS Cloud server to the Security Fabric in the CLI:
config endpoint-control fctems
    edit <name>
        set fortinetone-cloud-authentication enable
        set certificate <string>
    next
end
To verify an EMS certificate in the CLI:
# execute fctems verify ems137

        Subject:     C = CA, ST = bc, L = burnaby, O = devqa, OU = top3, CN = sys169.qa.fortinet.cm, emailAddress = xxxx@xxxxxxxx.xxx
        Issuer:      CN = 155-sub1.fortinet.com
        Valid from:  2017-12-05 00:37:57  GMT
        Valid to:    2027-12-02 18:08:13  GMT
        Fingerprint: D3:7A:1B:84:CC:B7:5C:F0:A5:73:3D:BB:ED:21:F2:E0
        Root CA:     No
        Version:     3
        Serial Num:
                01:86:a2
        Extensions:
                Name:     X509v3 Basic Constraints
                Critical: yes
                Content:
                CA:FALSE

                Name:     X509v3 Subject Key Identifier
                Critical: no
                Content:
                35:B0:E2:62:AF:9A:7A:E6:A6:8E:AD:CB:A4:CF:4D:7A:DE:27:39:A4

                Name:     X509v3 Authority Key Identifier
                Critical: no
                Content:
                keyid:66:54:0F:78:78:91:F2:E4:08:BB:80:2C:F6:BC:01:8E:3F:47:43:B1
DirName:/C=CA/ST=bc/L=burnaby/O=devqa/OU=top3/CN=fac155.fortinet.com/emailAddress=xyguo@fortinet.com
serial:01:86:A4

                Name:     X509v3 Subject Alternative Name
                Critical: no
                Content:
                DNS:sys169.qa.fortinet.cm

                Name:     X509v3 Key Usage
                Critical: no
                Content:
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only

                Name:     X509v3 Extended Key Usage
                Critical: no
                Content:
                TLS Web Server Authentication, TLS Web Client Authentication

EMS configuration needs user to confirm server certificate.
Do you wish to add the above certificate to trusted remote certificates? (y/n)y

Troubleshooting

Certificate not trusted

When configuring a new connection to an EMS server, the certificate might not be trusted.

When you click Authorize, a warning displays: The server certificate cannot be authenticated with installed CA certificates. Please install its CA certificates on this FortiGate.

In the CLI, an error message displays when you try to verify the certificate:

# execute fctems verify Win2K16-EMS
certificate not configured/verified: 2
Could not verify server certificate based on current certificate authorities.
Error 1--92-60-0 in get SN call: EMS Certificate is not signed by a known CA.

The default FortiClient EMS certificate that is used for the SDN connection is signed by the CA certificate that is saved on the Windows server when FortiClient EMS is first installed. You can manually export and install it on the FortiGate.

To manually export and install the certificate on to the FortiGate:
  1. Export the EMS certificate on the server that EMS is installed on:
    1. On the Windows server that EMS is installed on, go to Settings > Manage computer certificates.
    2. In the certificate management module, go to Trusted Root Certification Authorities > Certificates.
    3. Right click on the certificate issued by FortiClient Enterprise Management Server and select All Tasks > Export.
    4. The Certificate Export Wizard opens. Click Next.
    5. Select Base-64 encoded X.509, then click Next.

    6. Enter a file name for the certificate and click Browse to select the folder where it will be located, then click Next.
    7. Review the settings, then click Finish. The certificate is downloaded to the specified folder.
  2. On the FortiGate, import the certificate:
    1. Go to System > Certificate. By default, the Certificate option is not visible, see Feature visibility for information.
    2. Click Import > CA Certificate.
    3. Set Type to File, and click Upload to import the certificate from the management computer.
    4. Click OK. The imported certificate is shown in the Remote CA Certificate section of the certificate table.
  3. Try to authorize the certificate on the FortiGate:
    1. Go to Security Fabric > Fabric Connectors and edit the FortiClient EMS connector. The connection status should now say that the certificate is not authorized.
    2. Click Authorize. The following warning is shown:

      The warning can also be seen in the CLI:

      # execute fctems verify Win2K16-EMS
      failure in certificate configuration/verification: -4
      Could not verify EMS. Error 1--94-0-401 in get SN call: Authentication denied.
      
  4. Authorize the FortiGate on EMS:
    1. Log in to the EMS server console and go to Administration > Fabric Devices.
    2. Select the serial number of the FortiGate device, then click Authorize.
  5. Try to authorize the certificate on the FortiGate again:
    1. On the FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiClient EMS connector.
    2. Click Authorize.
    3. When presented with the EMS server certificate, click Accept to accept the certificate.

      Your connection should now be successful and authorized.

    4. Click OK.

Using EMS silent approval in the Security Fabric

FortiClient EMS with Fabric authorization and silent approval capabilities can approve the root FortiGate in a Security Fabric once, and then silently approve remaining downstream FortiGates in the Fabric. Similarly in an HA scenario, an approval only needs to be made once to the HA primary unit. The remaining cluster members are approved silently.

To use EMS silent approval:
  1. Configure the EMS entry on the root FortiGate or HA primary:
    config endpoint-control fctems
        edit "ems139"
            set fortinetone-cloud-authentication disable
            set server "172.16.200.139"
            set https-port 443
            set source-ip 0.0.0.0
            set pull-sysinfo enable
            set pull-vulnerabilities enable
            set pull-avatars enable
            set pull-tags enable
            set pull-malware-hash enable
            unset capabilities
            set call-timeout 30
            set websocket-override disable
        next
    end

    When the entry is created, the capabilities are unset by default.

  2. Authenticate the FortiGate with EMS:
    # execute fctems verify ems_139
    ...

    The FortiGate will enable the Fabric authorization and silent approval based on the EMS supported capabilities.

    config endpoint-control fctems
        edit "ems139"
            set server "172.18.62.12"
            set capabilities fabric-auth silent-approval websocket
        next
    end
  3. Configure a downstream device in the Security Fabric (see Configuring the root FortiGate and downstream FortiGates for more details). The downstream device will be silently approved.
  4. Configure a secondary device in an HA system (see HA active-passive cluster setup and HA active-active cluster setup for more details). The secondary device will be silently approved.

Related Videos

sidebar video

Setting up EMS Connector in FortiOS 6.4

  • 4,527 views
  • 11 months ago

FortiClient EMS

The FortiGate Security Fabric root device can link to FortiClient Endpoint Management System (EMS) and FortiClient EMS Cloud (a cloud-based EMS solution) for endpoint connectors and automation. Up to three EMS servers can be added to the Security Fabric, including a FortiClient EMS Cloud server. EMS settings are synchronized between all fabric members.

To enable cloud-based EMS services, the FortiGate must be registered to FortiCloud with an appropriate user account. The following examples presume that the EMS certificate has already been configured.

To add an on-premise FortiClient EMS server to the Security Fabric in the GUI:
  1. On the root FortiGate, go to System > Feature Visibility and enable Endpoint Control.
  2. Go to Security Fabric > Fabric Connectors.
  3. Click Create New and click FortiClient EMS.
  4. For Type, click FortiClient EMS.
  5. Optionally, enable EMS Threat Feed. See Malware threat feed from EMS for more information about using this setting in an AV profile.
  6. Enter a name and IP address or FQDN. When connecting to a multitenancy-enabled EMS, Fabric connectors must use an FQDN to connect to EMS, where the FQDN hostname matches a site name in EMS (including "Default"). The following are examples of FQDNs to provide when configuring the connector to connect to the default site and to a site named SiteA, respectively: default.ems.yourcompany.com, sitea.ems.yourcompany.com. See Multitenancy.
  7. Click OK.

    A window appears to verify the EMS server certificate:

  8. Click Accept.

    The FortiClient EMS Status section displays a Successful connection and an Authorized certificate:

  9. If the device is not authorized, log in to the FortiClient EMS to authorize the FortiGate under Administration > Fabric Devices.
To add a FortiClient EMS Cloud server to the Security Fabric in the GUI:
  1. Go to Security Fabric > Fabric Connectors.
  2. Click Create New and click FortiClient EMS.
  3. Set Type to FortiClient EMS Cloud.
  4. Enter a name.
  5. Click OK.

    A window appears to verify the EMS server certificate.

  6. Click Accept.

    The FortiClient EMS Status section displays a Successful connection and an Authorized certificate.

To test connectivity with the EMS server:
  1. Go to Security Fabric > Fabric Connectors and double-click the FortiClient EMS or FortiClient EMS Cloud card.
  2. In the FortiClient EMS Status section under Connection, click Refresh.
To add an on-premise FortiClient EMS server to the Security Fabric in the CLI:
config endpoint-control fctems
    edit <ems_name>
        set server <ip_address>
        set certificate <string>
        set https-port <integer>
        set source-ip <ip_address>
    next
end

The https-port is the EMS HTTPS access port number, and the source-ip is the REST API call source IP address.

To add a FortiClient EMS Cloud server to the Security Fabric in the CLI:
config endpoint-control fctems
    edit <name>
        set fortinetone-cloud-authentication enable
        set certificate <string>
    next
end
To verify an EMS certificate in the CLI:
# execute fctems verify ems137

        Subject:     C = CA, ST = bc, L = burnaby, O = devqa, OU = top3, CN = sys169.qa.fortinet.cm, emailAddress = xxxx@xxxxxxxx.xxx
        Issuer:      CN = 155-sub1.fortinet.com
        Valid from:  2017-12-05 00:37:57  GMT
        Valid to:    2027-12-02 18:08:13  GMT
        Fingerprint: D3:7A:1B:84:CC:B7:5C:F0:A5:73:3D:BB:ED:21:F2:E0
        Root CA:     No
        Version:     3
        Serial Num:
                01:86:a2
        Extensions:
                Name:     X509v3 Basic Constraints
                Critical: yes
                Content:
                CA:FALSE

                Name:     X509v3 Subject Key Identifier
                Critical: no
                Content:
                35:B0:E2:62:AF:9A:7A:E6:A6:8E:AD:CB:A4:CF:4D:7A:DE:27:39:A4

                Name:     X509v3 Authority Key Identifier
                Critical: no
                Content:
                keyid:66:54:0F:78:78:91:F2:E4:08:BB:80:2C:F6:BC:01:8E:3F:47:43:B1
DirName:/C=CA/ST=bc/L=burnaby/O=devqa/OU=top3/CN=fac155.fortinet.com/emailAddress=xyguo@fortinet.com
serial:01:86:A4

                Name:     X509v3 Subject Alternative Name
                Critical: no
                Content:
                DNS:sys169.qa.fortinet.cm

                Name:     X509v3 Key Usage
                Critical: no
                Content:
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign, Encipher Only, Decipher Only

                Name:     X509v3 Extended Key Usage
                Critical: no
                Content:
                TLS Web Server Authentication, TLS Web Client Authentication

EMS configuration needs user to confirm server certificate.
Do you wish to add the above certificate to trusted remote certificates? (y/n)y

Troubleshooting

Certificate not trusted

When configuring a new connection to an EMS server, the certificate might not be trusted.

When you click Authorize, a warning displays: The server certificate cannot be authenticated with installed CA certificates. Please install its CA certificates on this FortiGate.

In the CLI, an error message displays when you try to verify the certificate:

# execute fctems verify Win2K16-EMS
certificate not configured/verified: 2
Could not verify server certificate based on current certificate authorities.
Error 1--92-60-0 in get SN call: EMS Certificate is not signed by a known CA.

The default FortiClient EMS certificate that is used for the SDN connection is signed by the CA certificate that is saved on the Windows server when FortiClient EMS is first installed. You can manually export and install it on the FortiGate.

To manually export and install the certificate on to the FortiGate:
  1. Export the EMS certificate on the server that EMS is installed on:
    1. On the Windows server that EMS is installed on, go to Settings > Manage computer certificates.
    2. In the certificate management module, go to Trusted Root Certification Authorities > Certificates.
    3. Right click on the certificate issued by FortiClient Enterprise Management Server and select All Tasks > Export.
    4. The Certificate Export Wizard opens. Click Next.
    5. Select Base-64 encoded X.509, then click Next.

    6. Enter a file name for the certificate and click Browse to select the folder where it will be located, then click Next.
    7. Review the settings, then click Finish. The certificate is downloaded to the specified folder.
  2. On the FortiGate, import the certificate:
    1. Go to System > Certificate. By default, the Certificate option is not visible, see Feature visibility for information.
    2. Click Import > CA Certificate.
    3. Set Type to File, and click Upload to import the certificate from the management computer.
    4. Click OK. The imported certificate is shown in the Remote CA Certificate section of the certificate table.
  3. Try to authorize the certificate on the FortiGate:
    1. Go to Security Fabric > Fabric Connectors and edit the FortiClient EMS connector. The connection status should now say that the certificate is not authorized.
    2. Click Authorize. The following warning is shown:

      The warning can also be seen in the CLI:

      # execute fctems verify Win2K16-EMS
      failure in certificate configuration/verification: -4
      Could not verify EMS. Error 1--94-0-401 in get SN call: Authentication denied.
      
  4. Authorize the FortiGate on EMS:
    1. Log in to the EMS server console and go to Administration > Fabric Devices.
    2. Select the serial number of the FortiGate device, then click Authorize.
  5. Try to authorize the certificate on the FortiGate again:
    1. On the FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiClient EMS connector.
    2. Click Authorize.
    3. When presented with the EMS server certificate, click Accept to accept the certificate.

      Your connection should now be successful and authorized.

    4. Click OK.

Using EMS silent approval in the Security Fabric

FortiClient EMS with Fabric authorization and silent approval capabilities can approve the root FortiGate in a Security Fabric once, and then silently approve remaining downstream FortiGates in the Fabric. Similarly in an HA scenario, an approval only needs to be made once to the HA primary unit. The remaining cluster members are approved silently.

To use EMS silent approval:
  1. Configure the EMS entry on the root FortiGate or HA primary:
    config endpoint-control fctems
        edit "ems139"
            set fortinetone-cloud-authentication disable
            set server "172.16.200.139"
            set https-port 443
            set source-ip 0.0.0.0
            set pull-sysinfo enable
            set pull-vulnerabilities enable
            set pull-avatars enable
            set pull-tags enable
            set pull-malware-hash enable
            unset capabilities
            set call-timeout 30
            set websocket-override disable
        next
    end

    When the entry is created, the capabilities are unset by default.

  2. Authenticate the FortiGate with EMS:
    # execute fctems verify ems_139
    ...

    The FortiGate will enable the Fabric authorization and silent approval based on the EMS supported capabilities.

    config endpoint-control fctems
        edit "ems139"
            set server "172.18.62.12"
            set capabilities fabric-auth silent-approval websocket
        next
    end
  3. Configure a downstream device in the Security Fabric (see Configuring the root FortiGate and downstream FortiGates for more details). The downstream device will be silently approved.
  4. Configure a secondary device in an HA system (see HA active-passive cluster setup and HA active-active cluster setup for more details). The secondary device will be silently approved.