Failed to apply On-fabrci rules

Author
Rsoufiane
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2021/07/02 02:28:31
  • Status: offline
2021/07/02 03:27:25 (permalink)
0

Failed to apply On-fabrci rules

Hi,
We have aroud 3k Forticlients used to establish a SSL/IPSec VPN with a fortigate.They are managed by a FortiEMS
On FortiEMS, we configured "on-fabric detection rules" with a LocalIP/subnet rule type so that the forticlient detects when the user is off fabric (when his IP changes) and shows him a list of VPN that he can connect to.
The problem (i think) is when the user is at home, the FC doens't detect the change in the IP adress and consider him still "on fabric" so he doesn't show him the VPN list.

We tried ipconfig/release and renew and reload the computer but the problem persist.
Versions : FC : 6.4.4.1655 and FEMS 6.4.4 build 1658
Thank you.
#1
fcb
Silver Member
  • Total Posts : 76
  • Scores: 1
  • Reward points: 0
  • Joined: 2007/06/20 21:01:59
  • Status: offline
Re: Failed to apply On-fabrci rules 2021/07/21 06:36:13 (permalink)
0
that's exactly right.... If you are "off-net" but cannot reach EMS, you'll not be able to talk to the server and get the other policy for "off-net". We setup split DNS so that our EMS server is accessible from the inside or outside. (ie: ems.yourdomain.com = 12.13.14.15 or your WAN IP block and ems.yourdomain.com on the inside = 10.11.12.13) All you need is a VIP on your gate to allow TCP.8013 into the EMS from the WAN
#2
Jump to:
© 2021 APG vNext Commercial Version 5.5