FortiClient

Why do you need FortiClient?

The endpoint is where network cybersecurity runs out of visibility: once traffic is encrypted and the laptop is on someone’s home connection, the only remaining vantage point is the machine itself. What an agent of this class is really being asked to do is close that gap without becoming a second problem.

The more agents on one machine, the greater the chance that the first complaint about slowness gets solved by switching off the one that protected it.

FortiClient is Fortinet’s unified agent (Fabric Agent): a single modular client that combines ZTNA, VPN, endpoint protection and vulnerability scanning, with telemetry flowing to FortiGate and other Security Fabric components. The same agent supports FortiSASE, FortiNAC and FortiPAM, and it is centrally managed from FortiClient EMS or FortiClient Cloud.

How does it work?

Zero Trust Network Access

Application access after verifying the user and the device:

• An automatic, encrypted tunnel to the ZTNA gateway (access proxy) on FortiGate, established for each session
• Continuous device posture checks during the session
• User and device identity verification, MFA and SSO
• The same access rules in the office and outside it

Fabric Agent Telemetry

Security Fabric integration:

• Real-time endpoint status in the FortiGate console
• Security posture tags and dynamic groups in FortiGate policies
• Linking devices to users and the Active Directory structure
• Vulnerability information for firewall and ZTNA policies
• Automated quarantine of a suspicious device

Endpoint Protection

Protection in the EPP edition:

• AI-powered NGAV
• Behavior-based anti-exploit protection
• Ransomware protection with rollback (Windows)
• FortiSandbox and FortiClient Cloud Sandbox integration
• Removable media control

Key Features

VPN Client

• IPsec VPN and SSL VPN
• Application-based split tunneling
• Autoconnect, always-on VPN, connection before Windows logon
• Authentication: RADIUS, LDAP, TACACS+, X.509 certificates, FortiToken
• MFA

FortiEDR Integration and Incident Analysis

• FortiClient EMS ingests device status from FortiEDR for ZTNA posture checks
• Automated isolation of suspicious devices
• Real-time investigation based on telemetry
• FortiClient Forensic Analysis service (FortiGuard Labs analysts)

Vulnerability Management

• Vulnerability scanning and a dashboard of vulnerable endpoints
• Automated patching, also outside the corporate network
• Software inventory
• Prioritization of unpatched OS and application vulnerabilities
• Central logging for compliance reporting (with FortiAnalyzer)

Web Security

• FortiGuard web and video filtering, also outside the office
• Inline and API-based CASB
• YouTube and keyword filtering
• Application firewall
• USB device control

FortiClient Editions

VPN/ZTNA Edition:

• Zero trust agent with MFA
• IPsec and SSL VPN with MFA
• Fabric telemetry and vulnerability scanner
• Central management (EMS or FortiClient Cloud)

Endpoint protection (EPP) Edition:

• Everything from the VPN/ZTNA Edition plus:
• NGAV and ransomware protection
• Application firewall
• Sandbox integration
• Software inventory and automated quarantine

Chromebook Edition:

• Web and video filtering
• Central management
• Shared devices, e.g. in schools

FortiClient VPN-only:

• VPN client only, downloadable from the vendor’s website
• No support, central management or device posture assessment

FortiClient EMS

Endpoint Management Server for central management:

• Remote FortiClient deployment and controlled upgrades
• Automatic groups, Active Directory and Microsoft Entra synchronization
• Device and software inventory
• Zero trust tagging rules and dynamic access control
• Central quarantine management
• On-premises (EMS) or cloud (FortiClient Cloud)

Who is it for?

• Organizations implementing Zero Trust Network Access
• Organizations that want to combine VPN and endpoint protection in one agent
• Environments with FortiGate, FortiSASE or FortiNAC
• IT teams that need central endpoint management

Benefits

For IT: one agent instead of many, central management from EMS, remote deployment

For security: Fabric telemetry, ZTNA, endpoint protection, quarantine

For business: fewer agents per device, licensing by device or by user

Specification

Platforms	Windows, macOS, Linux, iOS, Android, Chromebook
ZTNA	ZTNA gateway on FortiGate, FortiSASE
VPN	IPsec VPN, SSL VPN
Management	FortiClient EMS (on-premises) or FortiClient Cloud

When does FortiClient make sense in your organization?

An endpoint agent connects two decisions that are usually made by different teams: who connects to company resources and from where, and whether the device is in a state that allows it. Three situations in which FortiClient brings them together:

Remote employee access to company resources

A financial institution with hybrid employees needs access to internal applications without opening up the whole network. FortiClient establishes an automatic, encrypted tunnel to the ZTNA gateway on FortiGate, and access to a specific application depends on the user’s identity, MFA and the device posture, checked throughout the session. The same agent handles VPN, so the move from VPN to ZTNA can be carried out by user group, without replacing software on laptops. Team permissions can be mapped from the Active Directory structure, which FortiGate uses in access policies.

Device posture checks before network admission

FortiClient EMS assigns tags to devices based on their security posture — for example, a detected vulnerability or missing required protection — and builds dynamic groups from them. FortiGate uses these groups in policies, so a device that no longer meets the conditions loses access without a manual rule change, and a compromised endpoint can be cut off from the network with quarantine. If the organization uses FortiEDR, EMS ingests device status from it, so an incident detected on the endpoint affects the ZTNA access assessment. The same agent works with FortiNAC, which controls devices connected in the office.

Protecting laptops outside the office

A salesperson’s laptop rarely sees the corporate network. FortiClient protects it regardless of location: web filtering works remotely, vulnerability patching also runs outside the corporate network, and the VPN can connect automatically, including before Windows logon. On Windows, ransomware protection can roll back changes made by a malicious program. With FortiSASE, the license includes FortiClient, and traffic goes through automatic tunnels to points of presence in the cloud. A user-based license covers up to three devices per person, such as a laptop and a phone, and the administrator sees vulnerable devices in a single dashboard.

Why deploy FortiClient with nFlo?

FortiClient touches both remote access and endpoint protection, so the project brings the network team and the security team together. In a FortiClient project, the nFlo team:

• inventories devices, operating systems, existing agents and the current remote access model,
• designs device posture tags, ZTNA and VPN policies and the FortiGate integration,
• deploys the agent with EMS in stages, group by group,
• maintains the policies, protection profiles and reports.

Endpoint protection with FortiClient is part of the Managed Endpoint Protection (EDR/XDR) service, and ZTNA and access control are part of Network Security. Start a conversation about remote access and devices in your organization through contact; you can read about nFlo’s cooperation with the vendor on the Fortinet page.

FAQ

How does FortiClient differ from traditional VPN? The VPN client is one of FortiClient’s functions. The same agent establishes ZTNA tunnels with device posture checks, protects the endpoint (in the EPP edition), scans for vulnerabilities and sends telemetry to the Security Fabric.

Does FortiClient require FortiGate? ZTNA with the application gateway on FortiGate and telemetry in the FortiGate console — yes; the alternative for ZTNA is FortiSASE, whose license includes FortiClient. Telemetry, tags and device posture assessment require management from EMS or FortiClient Cloud.

What is FortiClient EMS? Endpoint Management Server for central management: remote agent deployment, policies, device posture tags, quarantine and inventory. It runs on-premises or as FortiClient Cloud.

Which platforms are supported? Windows, macOS, Linux, iOS, Android and Chromebook. The feature set differs by platform — for example, ransomware protection is Windows-only, and sandbox integration does not cover Linux.

How does ZTNA work? For each session, FortiClient establishes an automatic, encrypted tunnel to the ZTNA gateway on FortiGate, which verifies the user and the device. Device posture is checked during the session, and the access policy applies to specific applications; MFA can be added.

Does FortiClient have antivirus? Yes, in the endpoint protection (EPP) edition: AI-powered NGAV, behavior-based anti-exploit protection, ransomware protection (Windows) and removable media control.

How does FortiSandbox integration work? FortiClient can block the execution of never-before-seen files and automatically submit them for real-time analysis. Sandbox settings are synchronized across managed endpoints, and a detailed file analysis is available in the central management tools.

Is cloud management available? Yes. FortiClient Cloud provides cloud-based management as an alternative to on-premises FortiClient EMS.

How does licensing work? By number of devices (packs) or by user (FortiTrust — one user can install FortiClient on up to three devices), with EMS in the cloud or on-premises. Editions differ in scope: VPN/ZTNA, VPN/ZTNA with endpoint protection, Chromebook.

What does support look like? FortiClient editions include round-the-clock FortiCare vendor support. nFlo, as a Fortinet Advocate Partner, deploys FortiClient and EMS and maintains endpoint protection policies.

Is FortiClient available for free? A free SSL VPN client for Android is available on Google Play. On its download page, Fortinet also offers FortiClient VPN-only, which is the VPN client alone; support, central management and device posture assessment require one of the Enterprise editions.

Does FortiClient check the device before a VPN connection? Yes. The data sheet lists a security posture tag check before VPN (on some platforms). The result of the check determines admission to the connection, and with ZTNA the device posture continues to be assessed throughout the session.

How does FortiClient work with FortiSASE and FortiNAC? FortiClient is the FortiSASE agent: the FortiSASE license includes it, devices are registered by an EMS instance within FortiSASE, and vulnerability scan results feed the ZTNA access assessment. FortiNAC and FortiPAM also use FortiClient as their agent.