Standalone FortiClient

Standalone FortiClient

About standalone mode

In standalone mode, FortiClient software is installed to computers or devices that have Internet access and are running a supported operating system. After FortiClient is installed, FortiClient automatically connects to FortiGuard Center (http://www.fortiguard.com) to protect the computer or device.

Get started

In standalone mode, you can configure FortiClient settings by using the FortiClient console. This section provides an overview of provisioning, configuring, and using FortiClient in standalone mode.

Provision and configure

In standalone mode, you can install FortiClient software to computers or devices with Internet access and configure a number of settings.

To provision and configure FortiClient:

  1. Install FortiClient on computers or devices. See FortiClient Provisioning on page 44. FortiClient connects to the Fortinet FortiGuard server to protect the computer.
  2. Configure FortiClient settings. See Settings on page 99.
  3. Configure Antivirus settings. See Antivirus on page 65.
  4. (Optional) Configure remote access. See IPsec VPN and SSL VPN on page 83.

Use FortiClient console

In standalone mode, you can use the following tabs in FortiClient console:

l Antivirus l Web Security l Remote Access

The Compliance tab is used only when FortiClient is running in managed mode. See Managed FortiClient on page 25.

To use the FortiClient console:

  1. View Antivirus threats. See View scan results on page 71.
  2. View web security results. See View violations on page 79.
  3. Use remote access. See Add new connections on page 83.
  4. View notifications. See View notifications on page 63.

Managed FortiClient

About managed mode

In managed mode, FortiClient software is installed to computers or devices on your network that have Internet access and are running a supported operating system. The computers or devices are referred to as endpoints or FortiClient endpoints. After FortiClient software is installed on endpoint devices, FortiClient:

l Automatically connects to FortiGuard Center (http://www.fortiguard.com) to protect the endpoint l Automatically attempts to connect FortiClient Telemetry to FortiGate or EMS

The endpoint user confirms the request to complete the FortiClient Telemetry connection to FortiGate/EMS.

You can optionally configure a FortiClient Telemetry connection that requires no confirmation by the endpoint user. See Custom FortiClient Installations on page 110.

After FortiClient Telemetry is connected to FortiGate/EMS, FortiClient downloads a profile from FortiGate/EMS, and the endpoint is managed.

FortiClient Telemetry connection options

FortiClient Telemetry can be connected to EMS or FortiGate. When EMS and FortiGate are integrated, FortiClient Telemetry connects to FortiGate as well as EMS.

FortiGate and EMS are used for the following different purposes. FortiGate is used to ensure that FortiClient endpoints adhere to the compliance rules defined for network access. EMS is used to provision, configure, and monitor FortiClient on endpoints.

FortiClient EMS

In this configuration, FortiClient Telemetry is connected to EMS and sends notifications to EMS, and EMS pushes a profile to FortiClient. The profile contains the configuration information for FortiClient.

After receiving the profile, all settings in the FortiClient console are locked because they are controlled by the profile.

FortiGate

In this configuration, FortiClient Telemetry is connected to FortiGate, and FortiClient downloads a profile from FortiGate.

The profile contains the compliance rules and optionally some configuration information for FortiClient. The compliance rules are used to configure endpoints for Network Access Compliance (NAC) and to specify what happens when endpoints fail to meet compliance rules. Endpoint users can use FortiClient console to view compliance status, compliance rules, and the steps required to remain compliant. See also Non-compliance action on page 29.

After receiving the profile, some settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile. However, endpoint users can change settings in FortiClient console that are not controlled by the profile.

FortiGate and EMS integration

In this configuration, FortiClient Telemetry connects to FortiGate for NAC and EMS for configuration information and real-time monitoring. This configuration is sometimes called integrated mode.

When FortiClient Telemetry is connected to FortiGate, a profile is pushed to FortiClient. The contents of the profile depend on the non-compliance action in the profile.

Non-compliance set to auto-update

When you use FortiGate to configure a FortiClient profile that contains compliance rules with a non-compliance setting of auto-update, you can also include some configuration information.

When FortiClient Telemetry connects to FortiGate, FortiClient downloads the profile that contains compliance rules and some configuration information from FortiGate.

After receiving the profile, some settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile. However, endpoint users can change settings in FortiClient console that are not controlled by the profile.

 

About managed mode

Non-compliance action set to block or warn

When you use FortiGate to configure a FortiClient profile that contains compliance rules with a non-compliance action of warn or block, you must either use EMS to provision FortiClient endpoints, or you must manually configure FortiClient endpoints. In this configuration, FortiGate provides only the compliance rules; it does not provision the FortiClient endpoints.

When FortiClient Telemetry connects to FortiGate, FortiClient downloads the compliance rules from FortiGate, and EMS pushes the configuration information to FortiClient.

You should ensure that the configuration pushed from EMS matches the compliance rules set on FortiGate to avoid conflicting settings.

After receiving the compliance rules and profile, all settings in the FortiClient console are locked because they are controlled by the compliance rules and configuration information in the profile.

FortiGate network topologies and FortiClient

This section describes the supported FortiGate network topologies for FortiClient in managed mode. The following topologies are supported:

  1. FortiClient is directly connected to FortiGate; either to a physical port, switch port or WiFi network.
  2. FortiClient is connected to FortiGate, but is behind a router or NAT device.
  3. FortiClient is connected to FortiGate across a VPN connection.

On-net / off-net

The on-net feature requires a FortiGate to be used as a DHCP server. This is usually configured on the same FortiGate to which FortiClient is connected. When the device on which FortiClient is running has an IP address from the FortiGate’s DHCP server, it is on-net. For any other IP addresses, it is off-net.

On the FortiGate, the DHCP server can be used, or several network subnets can be provided for the on-net feature. FortiClient is on-net if:

l FortiClient Telemetry is connected to FortiGate, l FortiClient belongs to one of the pre-configured on-net subnets, or l It provides the DHCP for on-net properties.

Otherwise, FortiClient will be off-net.

About managed mode


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

This entry was posted in FortiClient and tagged on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

3 thoughts on “Standalone FortiClient

  1. Mr-Pop-Up

    Hello, I have been reading this article trying to find out how to run a standalone FortiCLient. The reason why I wanted this standalone thing is because my FortiClient antivirus keeps asking me if I would like to update it. Well, it’s not exactly the FortiClient, but the UAC whic must be triggered my FortiClient. So, almost every 30 mins a pop-up window shows asking me for instructions. You see, i would not like to turn off my UAC, but if i could set an update frequency, would it stop nagging me? However, there are no update frequaency settings in my antivirus. It’s called FortiClient 5.4.2.0860.
    When I tried to get rid of this UAC pop-up, I found some articles on the Internet, saying that I can set an update frequency. However, those articles recommended to install some Standalone version. Is my version standalone? If so, where are the update frequency settings? And if I need to install some, unknown to me, standalone version, where do I download it? Please, help me because your answer would certainly improve the users’ experience.
    PS Here is the pop-up window: https://imgur.com/IyNYgkt

    Reply

Leave a Reply to Mr-Pop-Up Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.