FCP FortiClient EMS 7.4 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

EMS appliance deployment formats

FortiClient EMS 7.4 ships as a Linux virtual appliance in OVA/OVF, Hyper-V VHD, and KVM qcow2 formats. No Windows server install exists; only FortiClient endpoint software runs on Windows.

EMS default GUI port

The EMS administrative GUI and FortiClient telemetry/registration use TCP 8443 by default. The installer and update portal use TCP 10443, so both must be reachable from endpoints.

EMS trial license limits

An unlicensed EMS appliance runs in trial mode limited to three managed endpoints for thirty days. A valid license key must be applied to manage production fleets.

EMS HA requirements

EMS high availability pairs require identical firmware versions, a dedicated heartbeat link between nodes, and a shared virtual IP that endpoints use for registration and telemetry.

NTP before certificates

Configure NTP on EMS before any certificate operation. Clock skew greater than five minutes breaks FortiClient certificate enrollment, fabric authorization, and registration.

FortiGate fabric authorization

EMS must authorize each FortiGate serial number under Fabric settings and import the FortiGate CA. Without authorization the FortiGate EMS connector shows disconnected and tags do not flow.

Invitation code purpose

An invitation code is a limited-use token generated in EMS that binds a registering endpoint to a specific endpoint group and profile. Codes can expire or cap registration count.

Telemetry registration methods

Endpoints find EMS by invitation code, DNS service discovery record, or manually entered EMS address. The chosen method is embedded in the FortiClient installer package.

EMS installer builder

EMS builds FortiClient installers under Deployment > Installers. You select FortiClient version, enabled features, and the EMS address baked in, producing MSI, EXE, DMG, DEB, or RPM packages.

Dynamic endpoint groups

Dynamic groups populate automatically from AD/LDAP directory group membership or endpoint tags. They require a configured and synchronized directory connector to evaluate membership.

Profile lock behavior

Locking a setting in an endpoint profile prevents the local user from changing or disabling it. Unlocked settings remain user-editable even when the profile enables the feature.

Profile assignment precedence

When multiple endpoint profiles apply to an endpoint, EMS evaluates them in list order. The first matching profile wins, and its locked settings override later profiles.

Application firewall control

The FortiClient application firewall allows or blocks executables by signature or hash, independent of port-based firewall rules. It is the endpoint equivalent of application control.

Web filter safe search

FortiClient web filtering enforces safe search on supported search engines and rates URLs by FortiGuard category. Each category can be blocked, allowed, or warned.

Vulnerability scan in profile

Enabling vulnerability scan in an endpoint profile schedules OS and application CVE checks on the endpoint. Results feed EMS vulnerability management and compliance evaluation.

ZTNA access proxy

A FortiGate ZTNA server acts as an access proxy with a virtual host, certificate, and server mapping to a real internal server. Clients reach internal apps through it, not a full tunnel.

EMS tags in ZTNA policy

EMS applies endpoint tags based on compliance or scan results and pushes them to FortiGate. ZTNA firewall policies match on the EMS tag to enforce device posture.

ZTNA endpoint mode

In endpoint mode, FortiClient on an EMS-managed endpoint reaches ZTNA destinations using EMS tags for posture. No client certificate is required for the endpoint itself.

ZTNA client mode

Client mode uses certificate-based authentication for unmanaged or BYOD endpoints. EMS acts as the certificate authority and FortiGate trusts the EMS CA.

SSL VPN versus ZTNA

SSL VPN grants broad network access through a portal and tunnel. ZTNA grants per-application access based on identity and device posture, and is the recommended replacement in 7.4.

ZTNA rule ordering

FortiGate ZTNA policies evaluate top-down and an implicit deny applies when no rule matches. Order rules from most specific source tag and destination to least specific.

Compliance rule conditions

Compliance rules combine conditions such as antivirus installed and current, real-time protection enabled, OS patch level, disk encryption, firewall enabled, and vulnerability scan age.

Compliance status values

EMS reports endpoints as Compliant, Non-Compliant, or At Risk. At Risk means status is unknown or not yet evaluated, typically because telemetry has not arrived.

Compliance grace period

A grace period keeps newly registered endpoints at risk for a defined window before enforcement actions apply. Set it shorter than the patch cycle to avoid permanent exemptions.

FortiNAC EMS connector

FortiNAC consumes EMS compliance status for network access control. The EMS connector must be authorized in FortiNAC and the endpoint must be registered to EMS.

Vulnerability scan outputs

Vulnerability scans report CVE identifiers, affected software, severity, and remediation references. Results appear in EMS vulnerability management and can be scheduled or run on demand.

Patch management connector

EMS patch management uses a connector such as WSUS or Intune to correlate detected CVEs with available patches and to trigger deployment. Patch status is tracked per endpoint.

Vulnerability risk prioritization

Prioritize remediation by CVSS severity, known exploit availability, and count of affected endpoints. Critical and high findings with active exploits are remediated first.

Failed patch causes

Failed patch deployments usually indicate a pending reboot, insufficient disk space, or missing approval in the upstream patch tool such as WSUS or Intune.

EMS log forwarding

EMS forwards FortiClient, system, and admin events to syslog or FortiAnalyzer under System Settings > Log Settings. Local logs are retained per the configured retention policy.

Registration failure causes

Registration failures typically trace to wrong EMS address or port, expired invitation code, certificate trust failure, endpoint clock skew, or a firewall blocking TCP 8443.

Fabric upgrade order

Upgrade EMS first, then FortiClient, then FortiGate. FortiClient versions outside the supported range for the EMS release fail to register or lose profile features.

EMS certificate expiry impact

An expired EMS server certificate breaks all new endpoint registrations and fabric connections. Verify the certificate validity and that endpoints trust the issuing CA.