Standalone FortiClient
About standalone mode
In standalone mode, FortiClient software is installed to computers or devices that have Internet access and are running a supported operating system. After FortiClient is installed, FortiClient automatically connects to FortiGuard Center (http://www.fortiguard.com) to protect the computer or device.
Get started
In standalone mode, you can configure FortiClient settings by using the FortiClient console. This section provides an overview of provisioning, configuring, and using FortiClient in standalone mode.
Provision and configure
In standalone mode, you can install FortiClient software to computers or devices with Internet access and configure a number of settings.
To provision and configure FortiClient:
- Install FortiClient on computers or devices. See FortiClient Provisioning on page 44. FortiClient connects to the Fortinet FortiGuard server to protect the computer.
- Configure FortiClient settings. See Settings on page 99.
- Configure Antivirus settings. See Antivirus on page 65.
- (Optional) Configure remote access. See IPsec VPN and SSL VPN on page 83.
Use FortiClient console
In standalone mode, you can use the following tabs in FortiClient console:
l Antivirus l Web Security l Remote Access
The Compliance tab is used only when FortiClient is running in managed mode. See Managed FortiClient on page 25.
To use the FortiClient console:
- View Antivirus threats. See View scan results on page 71.
- View web security results. See View violations on page 79.
- Use remote access. See Add new connections on page 83.
- View notifications. See View notifications on page 63.
Managed FortiClient
About managed mode
In managed mode, FortiClient software is installed to computers or devices on your network that have Internet access and are running a supported operating system. The computers or devices are referred to as endpoints or FortiClient endpoints. After FortiClient software is installed on endpoint devices, FortiClient:
l Automatically connects to FortiGuard Center (http://www.fortiguard.com) to protect the endpoint l Automatically attempts to connect FortiClient Telemetry to FortiGate or EMS
The endpoint user confirms the request to complete the FortiClient Telemetry connection to FortiGate/EMS.
You can optionally configure a FortiClient Telemetry connection that requires no confirmation by the endpoint user. See Custom FortiClient Installations on page 110.
After FortiClient Telemetry is connected to FortiGate/EMS, FortiClient downloads a profile from FortiGate/EMS, and the endpoint is managed.
FortiClient Telemetry connection options
FortiClient Telemetry can be connected to EMS or FortiGate. When EMS and FortiGate are integrated, FortiClient Telemetry connects to FortiGate as well as EMS.
FortiGate and EMS are used for the following different purposes. FortiGate is used to ensure that FortiClient endpoints adhere to the compliance rules defined for network access. EMS is used to provision, configure, and monitor FortiClient on endpoints.
FortiClient EMS
In this configuration, FortiClient Telemetry is connected to EMS and sends notifications to EMS, and EMS pushes a profile to FortiClient. The profile contains the configuration information for FortiClient.
After receiving the profile, all settings in the FortiClient console are locked because they are controlled by the profile.
FortiGate
In this configuration, FortiClient Telemetry is connected to FortiGate, and FortiClient downloads a profile from FortiGate.
The profile contains the compliance rules and optionally some configuration information for FortiClient. The compliance rules are used to configure endpoints for Network Access Compliance (NAC) and to specify what happens when endpoints fail to meet compliance rules. Endpoint users can use FortiClient console to view compliance status, compliance rules, and the steps required to remain compliant. See also Non-compliance action on page 29.
After receiving the profile, some settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile. However, endpoint users can change settings in FortiClient console that are not controlled by the profile.
FortiGate and EMS integration
In this configuration, FortiClient Telemetry connects to FortiGate for NAC and EMS for configuration information and real-time monitoring. This configuration is sometimes called integrated mode.
When FortiClient Telemetry is connected to FortiGate, a profile is pushed to FortiClient. The contents of the profile depend on the non-compliance action in the profile.
Non-compliance set to auto-update
When you use FortiGate to configure a FortiClient profile that contains compliance rules with a non-compliance setting of auto-update, you can also include some configuration information.
When FortiClient Telemetry connects to FortiGate, FortiClient downloads the profile that contains compliance rules and some configuration information from FortiGate.
After receiving the profile, some settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile. However, endpoint users can change settings in FortiClient console that are not controlled by the profile.
About managed mode
Non-compliance action set to block or warn
When you use FortiGate to configure a FortiClient profile that contains compliance rules with a non-compliance action of warn or block, you must either use EMS to provision FortiClient endpoints, or you must manually configure FortiClient endpoints. In this configuration, FortiGate provides only the compliance rules; it does not provision the FortiClient endpoints.
When FortiClient Telemetry connects to FortiGate, FortiClient downloads the compliance rules from FortiGate, and EMS pushes the configuration information to FortiClient.
You should ensure that the configuration pushed from EMS matches the compliance rules set on FortiGate to avoid conflicting settings.
After receiving the compliance rules and profile, all settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile.
FortiGate network topologies and FortiClient
This section describes the supported FortiGate network topologies for FortiClient in managed mode. The following topologies are supported:
- FortiClient is directly connected to FortiGate; either to a physical port, switch port or WiFi network.
- FortiClient is connected to FortiGate, but is behind a router or NAT device.
- FortiClient is connected to FortiGate across a VPN connection.
On-net / off-net
The on-net feature requires a FortiGate to be used as a DHCP server. This is usually configured on the same FortiGate to which FortiClient is connected. When the device on which FortiClient is running has an IP address from the FortiGate’s DHCP server, it is on-net. For any other IP addresses, it is off-net.
On the FortiGate, the DHCP server can be used, or several network subnets can be provided for the on-net feature. FortiClient is on-net if:
l FortiClient Telemetry is connected to FortiGate, l FortiClient belongs to one of the pre-configured on-net subnets, or l It provides the DHCP for on-net properties.
Otherwise, FortiClient will be off-net.
About managed mode