Deployment and Initial Configuration
This domain tests how well you can plan a FortiClient EMS 7.4 deployment, choose the right form factor, open the right ports, and complete first-run configuration so endpoints and FortiGates can connect. Exam items often give a topology and ask which component initiates a connection, which port must be allowed, or what must be configured before registration can succeed.
Deployment choices
- On-premises EMS runs on supported Windows Server releases and on VMware, Hyper-V, or KVM. EMS Cloud is Fortinet-hosted. Choose on-premises when you need local AD/LDAP integration, data residency, or direct control of backups; choose cloud when you want to avoid server maintenance.
- Size the server by endpoint count and enabled features. Fortinet publishes sizing guidance; undersizing shows up as slow dashboards, delayed scans, and failed deployments.
- Licensing matters before configuration: the EMS license and the per-endpoint FortiClient licenses for Endpoint Control, ZTNA, or other features must be active before profiles can enforce those features.
Ports and connectivity
- FortiClient endpoints connect to EMS over TCP 8013 for telemetry and registration. This is the port most often forgotten in firewall rules.
- The EMS administrative GUI uses HTTPS, normally TCP 443. Restrict it to admin networks rather than exposing it to all endpoint subnets.
- FortiGate connects to EMS over TCP 8013 for the EMS connector/telemetry. EMS needs outbound TCP 443 to FortiGuard for updates and licensing checks.
First-run configuration
- Set the hostname, IP address, admin password, DNS, and NTP. Time skew breaks certificates, SAML, and registration trust.
- Activate the license, upload a trusted server certificate, configure the mail server used for invitations, and connect AD/LDAP if you will assign profiles by group.
- Add the FortiGate as an EMS connector, create an invitation, and assign a baseline profile. Test registration from an endpoint VLAN before rolling out broadly.
Worked example
A company has 600 endpoints across two sites and uses AD security groups. The admin deploys on-premises EMS with 4 vCPU and 8 GB RAM, allows TCP 8013 from both endpoint subnets to EMS, allows TCP 443 to EMS only from the admin VLAN, connects AD, uploads a CA-signed certificate, adds the FortiGate connector, and creates an invitation scoped to the Sales group. Reasoning: endpoints must reach 8013, admins need 443, the FortiGate needs outbound 8013, and AD group scoping avoids manually assigning every endpoint.
Traps that cost marks
- Opening 443 for endpoints but not 8013, so FortiClient never checks in.
- Forgetting NTP or using a self-signed certificate with SAML, causing trust errors.
- Activating profiles before licenses, then assuming the feature is broken.
- Treating EMS Cloud as if it automatically has local AD access without network and credential configuration.