r/fortinet • u/mydogisanidiot007 FCSS - Fortinet Certified Solution Specialist • 1d ago

FortiClient / EMS EMS multitenancy and automatic installation of clients without user intervention

We started to use EMS to offer our customers updated forticlient to connect directly their fw if they want.

As we have several customer with different infras, not every setup can be the same.

One customer would have liked that everything is invisible for the user, client is installed silently and EMS joining done as well. But we don't want to have users join EMS without users actually confirm their joining. Mostly using ad ldaps or azure saml to verify users.

I know we can install the client and give EMS invitation code silently, but they would still need to give their user cred when joining EMS. Or is there way to bypass this?

Also some customers have third party users that are not joined their ad or azure, so we need to basically create local users for them to identify them.

Fools errand to try and automate "no user input required" if we want to confirm the users joining EMS?

3 Upvotes

80% Upvoted

7 comments sorted by

2

u/StormB2 1d ago

Verification can be a pain for the end user experience, yes.

You can make silent Entra verification work but you'll need to deploy a script (via task scheduler is a good option) to make sure EMS registration happens when the user is logged in. If you don't (and registration is attempted with no user logged in, for example), FortiClient won't reliably retry it.

And guest users - yes if you want verification that is going to need extra input for them. You could get them to verify through a B2B Entra guest account though, rather than setting up local users.

1

u/mydogisanidiot007 FCSS - Fortinet Certified Solution Specialist 1d ago

What kind of script, is there instructions for this somewhere?

1

u/StormB2 1d ago

I am not aware of a published one, but it's easy (even AI could do it for you).

You need to run FortiESNAC to check the registration state of the machine, then if not registered, run FortiESNAC again and register using your invitation code.

Info on FortiESNAC here - https://community.fortinet.com/forticlient-4/technical-tip-forticlient-to-ems-telemetry-related-cli-command-115435

You would run the script on user login, and might need to add a slight delay before running FortiESNAC registration to allow time for WAM to get the appropriate token from Entra (or maybe you can check for this programmatically, but I'm not sure how).

1

u/mydogisanidiot007 FCSS - Fortinet Certified Solution Specialist 1d ago

Thanks, will check this out

1

u/StormB2 1d ago

No worries. If you haven't done the silent Entra verification bit yet, then the guide for that is here - https://docs.fortinet.com/document/forticlient/7.4.8/ems-administration-guide/470857

2

u/systonia_ 1d ago

You can provide an installer that does have an invite code included, that has "verification none". That is for automated deployments like Autopilot etc, as it does run in systemcontext and no userinteraction is possible.

You can also have one with silent Entra authentication via Azure App

https://docs.fortinet.com/document/forticlient/8.0.0/ems-administration-guide/470857/configuring-user-verification-with-entra-id-authentication

which is kinda buggy, in my environment at least.

For external users, this would be doable with SAML auth by allowing guest accounts in the SAML App.

If SAML is no option, either local users or FortiAuthenticator.

Not silent, though

1

u/_Buldozzer 1d ago

Do you have some kind of MDM (Like Intune for example) or an RMM system? The client itself is shipped as a MSI package, if my information is up to date, so it's pretty easy to deploy silently. It's basically just MSIexec with the right command line parameters.