Use FortiClient console

Use FortiClient console

This section describes how a FortiClient endpoint user can use the FortiClient console when FortiClient is managed by FortiGate/EMS.

To use the FortiClient console:

1. View FortiClient Telemetry connection status, last profile update, and the gateway IP list. See Compliance on page 54.

If FortiClient Telemetry is connected to FortiGate, you can also view compliance status and instructions for remaining compliant on the Compliance tab.

2. View Antivirus threats. See Antivirus on page 65.
3. View web filter results. See View violations on page 79.
4. View application firewall results. See Application Firewall on page 81.
5. Configure and use remote access. See IPsec VPN and SSL VPN on page 83.
6. View vulnerability scan results. See Vulnerability Scan on page 92.
7. View notifications. See View notifications on page 63.

Configure FortiGate

This section provides an overview of configuring FortiGate for endpoint control.

Get started

FortiGate endpoint control is configured by completing the following tasks:

1. Enable the endpoint control feature. See Enable the Endpoint Control feature on page 34.
2. Enable FortiTelemetry on an interface. See Enable FortiTelemetry on an interface on page 34.
3. Configure firewall policies. See Configure firewall policies on page 35.
4. Configure FortiClient profiles. See Configure FortiClient profiles on page 35.

Configure FortiGate

After FortiClient software is installed on endpoints, and the FortiClient endpoints connect FortiTelemetry to FortiGate, FortiClient downloads a FortiClient profile from FortiGate.

Additional configuration options are available, depending on the needs of your network.

Enable the Endpoint Control feature

When using the GUI for configuration, you must enable endpoint control on FortiGate devices to use the device for FortiClient endpoint management.

When using the CLI for configuration, you can skip this step.

To enable the endpoint control feature:

1. Go to System > Feature Select.
2. In the Security Features list, enable Endpoint Control.
3. In the Additional Features list, enable Multiple Security Profiles.
4. Click Apply.

Enable FortiTelemetry on an interface

You must configure FortiClient communication on a FortiGate interface by specifying an IP address and enabling FortiTelemetry communication.

The IP address for the interface defines the gateway IP address for the FortiGate that FortiClient endpoints will use to connect FortiClient Telemetry to FortiGate.

You can also add any devices that are exempt from requiring FortiClient software to an exemption list for the interface.

To enable FortiTelemetry on an interface:

1. Go to Network > Interfaces.
2. Select an interface, and click Edit.
3. Set the following options:

4. Configure the remaining options as required.
5. Click OK.

Configure firewall policies

You must configure a firewall policy for FortiClient access to the Internet. The firewall policy must include the incoming interface that is defined for FortiTelemetry communication, and the outgoing interfaces that you want FortiClient endpoints to use for accessing the Internet. Otherwise, endpoints will be unable to access the Internet.

To configure firewall policies:

1. Go to Policy & Objects > IPv4 Policy.
2. Click Create New in the toolbar. The New Policy window is displayed.
3. In the Name box, type a name for the firewall policy.
4. In the Incoming Interface list, select the port defined for FortiTelemetry communication.
5. In the Outgoing Interface, select the port(s) defined for outgoing traffic from FortiGate.
6. Configure the remaining options as required.
7. Click OK.