Deploy FortiClient VPN with Addigy

VPN
1

Had more trouble than expected finding the requirements to deploy FortiClient for VPN silently to macs, so thought I’d share here what I’ve got so far. This is working for me to (almost) silently install it; there is still a pop-up requesting permission for FortiTray to add a VPN Configuration that I can’t figure out. There are some JAMF discussions about creating a dummy VPN configuration and pushing that first, but it didn’t get around the prompt for me using Addigy.

​

The publicly available FortiClient VPN doesn’t include the .mpkg. If you have a Fortinet login, download the FortiClientMac software for the version you need from https://support.fortinet.com/Download/FirmwareImages.aspx. Extract the .mpkg and create a simple Addigy custom software script for it.

sudo /usr/sbin/installer -pkg FortiClientVPNInstall.mpkg -target /

​

Team Identifier for profiles: AH4XFXJ7DK

​

System Extension Bundle Identifiers:

  • com.fortinet.FortiClient
  • com.fortinet.forticlient.macos.webfilter
  • com.fortinet.forticlient.macos.vpn.nwextension
  • com.fortinet.forticlient.macos.proxy

​

PPPC Identifier: com.fortinet.FortiClient

PPPC Signature: identifier “com.fortinet.FortiClient” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AH4XFXJ7DK

Service Management

  • Team identifier: AH4XFXJ7DK
  • com.fortinet.credential_store
  • com.fortinet.fct_launcher
  • com.fortinet.forticlient.macos.PrivilegedHelper
  • com.fortinet.fctctl
  • com.fortinet.config
  • com.fortinet.fctservctl2
  • com.fortinet.fssoagent_launchagent
  • com.fortinet.fssoagent_launchdaemon
  • com.fortinet.ztnafw
  • com.fortinet.credential_store
  • com.fortinet.forticlient.ztagent

​

Hope this saves someone some time!

2

Thanks for sharing this. I am hung up on this part:

Extract the .mpkg and create a simple Addigy custom software script for it.

I have access to the support portal and I see there are two versions for Mac

  • FortiClient_7.2.2.0776_macosx.dmg
  • FortiClientVPNSetup_7.2.2.0776_macosx.dmg

I am not sure how to create the .mpkg. Can you help?

3

Thanks for this it is helping. I am new to Addigy and Mac so really thianks. Some questions:

in the PPC identifier is everything in the PPPC Signature filled ? from the identifier or do I start from the "com.fortinet.

In the service management are everything else after the team identifier a bundle a identifier?

For EMS you would normally set the EMS service managed path in the field. Can that be set somewhere automatically? So the user don’t have to?

Again thanks for this

4

Awesome, u/awesomewhiskey — thank you for sharing!

5

Thanks for posting this! I registered on the site however, I do not seem to be able to download the client since we dont have products registered yet (waiting to get info from client) Would it be possible if you can DM me the client? (assuming this does not break any rules on this board)

6

I got it installed! Some people can connect just fine. However, I am finding that some people don’t have FortiTray running on their computer so it won’t prompt for SSO.

It seems a manual uninstall and then re-install from the Fortinet package seems to fix it but I can’t figure out why some work and some don’t.

7

Click into the DMG, run the .app but do not click install. Navigate to the following path /private/var/folders/0f/*somerandomstring*/T/fctupdate/FortiClient.dmg

There you will find the .mpkg mine was just titled install.mpkg
This will also update overtop of previous versions.

8

The .mpkg is just the file inside the .dmg image, drag and drop to anywhere else and you can manipulate it from there.

9

identifier “com.fortinet.FortiClient” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AH4XFXJ7DK

This is the entire PPPC Identifier so copy the entire thing.

In the service management are everything else after the team identifier a bundle a identifier

Correct; each of those items is an individual bundle Identifier.

For EMS you would normally set the EMS service managed path in the field. Can that be set somewhere automatically? So the user don’t have to?

It will depend if teh package allows you to set that as part of an installtion script; you’d have to check Forticlient to see if that’s documented anywhere, but if it’s possible you could set that in the installation script field in Addigy.

Alternatively, I’m not sure if Forticlient does it this way but some vendors have you download specific installers per site/organization, so if they do you’d just make sure you were naming your custom package in Addigy for each client.

10

Here is a guide with a better way to do it. https://github.com/pro4tlzz/ITSupportTools/blob/main/jamf/forticlient/install-configure/installing-forticlient-vpn-with-configuration-settings.md

11

Thanks - I figured out that if you use the mpkg file from the EMS server you get the full FortiClient. You just need to then enter the EMS connection and an Admin has to provide credentials for the SSL certificate to be installed. A niggle, but can be worked around