The ZTNA Access Proxy is the FortiGate feature that acts as the policy enforcement point. It receives the ZTNA tags from FortiClient EMS via the Fabric Connector and uses them to grant or deny access to protected resources according to the defined ZTNA rules. Simply having tags in EMS is not enough without the Access Proxy to interpret and act on them.

The EMS console’s endpoint status view provides immediate, crucial diagnostic information like last successful connection, current connection state, and any registration or communication errors. This should always be the first step to understand the client’s perspective before making server-side or network changes.

The ‘Feature Visibility’ section within a Configuration Profile in EMS allows an administrator to selectively enable or disable specific FortiClient modules (like AV, Web Filter, VPN) for assigned groups. This is the direct method to run FortiClient in a VPN-only mode post-installation.

The correct method is to enable the ‘Device Compliance’ option within the FortiClient EMS configuration profile. This causes FortiClient to report its compliance state to the FortiGate via the Fabric Agent. On the FortiGate, a Network Access Control (NAC) policy can then be created that uses the ‘FortiClient Compliance’ source and is set to ‘Block’ traffic for non-compliant hosts, preventing network access entirely until compliance is restored.

ZTNA is designed for this precise least-privilege, time-bound access scenario. An EMS ZTNA tag provides the identity context. A ZTNA Access Proxy rule on the FortiGate can restrict access to a single application (e.g., RDP/SSH to one server). Setting the tag to expire in EMS automatically revokes the user’s access after the set duration, meeting all requirements seamlessly.

For imported endpoints (like those from AD or a CSV file) to auto-register when FortiClient first runs, the ‘Enable Automatic Registration’ checkbox must be selected for that specific endpoint or group within the EMS console. This links the pre-created device record to the physical client, allowing it to claim its configuration without manual approval.

FortiClient modules (like Web Filtering, AntiVirus) rely on connecting to specific FortiGuard servers for rating updates and cloud-based lookups. If DNS fails to resolve these server hostnames (e.g., fortiguard.com), the client reports the cloud service as unreachable. Verifying and correcting DNS settings on the endpoints or their network is the key fix.

The ‘Endpoint Log Forwarding’ section within a FortiClient EMS Configuration Profile allows administrators to define which Windows event logs (by channel and level) should be collected from the endpoint and sent directly to a syslog server (like FortiAnalyzer or FortiSIEM). This is the native, supported method for centralized log collection from endpoints.

The Vulnerability Scan profile in EMS includes ‘Reboot Deferral’ settings. Administrators can configure how many times a user can defer a required reboot and the maximum deferral time. Increasing these values reduces disruption for mobile users by giving them more flexibility on when to reboot, without disabling the critical scan or remediation function.

The ZTNA Access Proxy is the FortiGate feature that acts as the policy enforcement point. It receives the ZTNA tags from FortiClient EMS via the Fabric Connector and uses them to grant or deny access to protected resources according to the defined ZTNA rules. Simply having tags in EMS is not enough without the Access Proxy to interpret and act on them.0