ORDERING GUIDE
FortiClient
VPN/ZTNA EPP/APT MANAGED
Zero Trust Agent
Zero Trust Network Access (ZTNA) ⃝✓ ⃝✓ ⃝✓
Central Management ⃝✓ ⃝✓ ⃝✓
Central Logging and Reporting ⃝✓ ⃝✓ ⃝✓
SSL VPN with Multifactor Authentication (MFA)* ⃝✓ ⃝✓ ⃝✓
IPsec VPN with MFA* ⃝✓ ⃝✓ ⃝✓
Single Sign On Mobility Agent ⃝✓ ⃝✓ ⃝✓
IT Hygiene
Vulnerability Agent and Remediation ⃝✓ ⃝✓ ⃝✓
FortiGuard Web Filtering ⃝✓ ⃝✓ ⃝✓
Software Inventory ⃝✓ ⃝✓
Removable Media Control ⃝✓ ⃝✓
CASB
Cloud/API-based CASB ⃝✓ ⃝✓ ⃝✓
SaaS Application Control (Inline CASB) ⃝✓ ⃝✓ ⃝✓
FortiGuard Real-time SaaS Application Database
⃝✓ ⃝✓ ⃝✓
Updates
Malware Detection for Cloud Data ⃝✓ ⃝✓ ⃝✓
Endpoint Security (Endpoint Protection Platform (EPP))
FortiClient Cloud Sandbox (SaaS) ⃝✓ ⃝✓
FortiSandbox Integration (PaaS/Public Cloud/
⃝✓ ⃝✓ ⃝✓
On-premise)
Artificial Intelligence-powered Next Generation
⃝✓ ⃝✓
Antivirus
Automated Endpoint Quarantine ⃝✓ ⃝✓
Ransomware Protection ⃝✓ ⃝✓
FortiGuard Outbreak Detection ⃝✓ ⃝✓
Managed FortiClient Service (Delivered by Fortinet Experts)
Endpoint Onboarding ⃝✓
Initial Provisioning ⃝✓
Fortinet Security Fabric Setup/Integration ⃝✓
Vulnerability Monitoring ⃝✓
Endpoint Security Monitoring ⃝✓
Additional Services
Best Practice Service (BPS) Consultation Account add-on Account add-on ⃝✓
Endpoint Forensics Analysis** Optional Optional Optional
24x7 Support ⃝✓ ⃝✓ ⃝✓
On-premise/Air Gap Option ⃝✓ ⃝✓
* FortiClient licenses do not include FortiToken entitlement.
** You must purchase a separate SKU bundle for this option.
To download datasheets, product matrices, and case studies, visit https://www.fortinet.com/products/endpoint-security/forticlient.
Chromebook security is also available with central management via EMS, FortiGuard Web Filtering, and Additional Services.
NOTE: The FortiSASE ordering details have been relocated to a self-contained SASE ordering guide with other SASE
components. You can upgrade a FortiClient license to FortiSASE. See the FortiSASE Ordering Guide.
1
ORDERING GUIDE | FortiClient
ORDER INFORMATION: DEVICE-BASED
You can order FortiClient in packs of 25, 500, 2000, and 10000. The following table reflects the latest device-based licenses:
SOLUTION SKU LICENSE VPN/ZTNA EPP/APT MANAGED
25-pack FC1-10-EMS05-428-01-DD FC1-10-EMS05-429-01-DD FC1-10-EMS05-485-01-DD
500-pack FC2-10-EMS05-428-01-DD FC2-10-EMS05-429-01-DD FC2-10-EMS05-485-01-DD
Cloud
2000-pack FC3-10-EMS05-428-01-DD FC3-10-EMS05-429-01-DD FC3-10-EMS05-485-01-DD
10000-pack FC4-10-EMS05-428-01-DD FC4-10-EMS05-429-01-DD FC4-10-EMS05-485-01-DD
25-pack FC1-10-EMS04-428-01-DD FC1-10-EMS04-429-01-DD N/A
500-pack FC2-10-EMS04-428-01-DD FC2-10-EMS04-429-01-DD N/A
On-premise
2000-pack FC3-10-EMS04-428-01-DD FC3-10-EMS04-429-01-DD N/A
10000-pack FC4-10-EMS04-428-01-DD FC4-10-EMS04-429-01-DD N/A
The following table reflects the latest device-based licenses that include the forensics analysis service:
SOLUTION SKU LICENSE VPN/ZTNA VPN/ZTNA + EPP/APT MANAGED
25-pack FC1-10-EMS05-537-01-DD FC1-10-EMS05-538-01-DD FC1-10-EMS05-539-01-DD
500-pack FC2-10-EMS05-537-01-DD FC2-10-EMS05-538-01-DD FC2-10-EMS05-539-01-DD
Device-based
2000-pack FC3-10-EMS05-537-01-DD FC3-10-EMS05-538-01-DD FC3-10-EMS05-539-01-DD
10000-pack FC4-10-EMS05-537-01-DD FC4-10-EMS05-538-01-DD FC4-10-EMS05-539-01-DD
ORDER LIFECYCLE
New Order Renew All Endpoints
Example: 500 ZTNA endpoints Example: renew all 550 ZTNA endpoints
Direct purchase 1x500-pack Use the co-term tool when the first renewal occurs. This
also aligns all contracts to the same expiration date.
• FC2-10-EMS05-428-01-12
• FC1Z-15-EMS05-428-02-00 (x2)
• FC2Z-15-EMS05-428-02-00 (x1)
Add More Endpoints
Example: add 50 ZTNA endpoints Upgrade Endpoints
Example: upgrade all 550 ZTNA endpoints to EPP/APT
Direct purchase 2x25-pack
Use the co-term tool to upgrade all endpoints to the end of
• FC1-10-EMS05-428-01-12 (x2)
the term, then follow standard renewal:
• FC1Z-15-EMS05-429-02-00 (x2)
• FC2Z-15-EMS05-429-02-00 (x1)
2
ORDERING GUIDE | FortiClient
ORDER INFORMATION: USER-BASED
You can order FortiClient based on the number of users. The following table reflects the latest FortiTrust user-based license
ranges:
SOLUTION SKU LICENSE VPN/ZTNA EPP/APT MANAGED
50-499 users FC2-10-EMS05-509-02-DD FC2-10-EMS05-546-02-DD FC2-10-EMS05-556-02-DD
500-1999 users FC3-10-EMS05-509-02-DD FC3-10-EMS05-546-02-DD FC3-10-EMS05-556-02-DD
Cloud
2000-9999 users FC4-10-EMS05-509-02-DD FC4-10-EMS05-546-02-DD FC4-10-EMS05-556-02-DD
10000+ users FC5-10-EMS05-509-02-DD FC5-10-EMS05-546-02-DD FC5-10-EMS05-556-02-DD
ORDER LIFECYCLE
New Order Renew All Users
Example: 400 ZTNA users Example: renew all 550 ZTNA users
Direct purchase 400 users Use the co-term tool to renew all user licenses. This also
aligns all contracts to the same expiration date.
• 400 x FC2-10-EMS05-557-02-DD
• 500 x FC3-10-EMS05-557-02-DD
Upgrade Users
Add More Users
Example: upgrade all 550 ZTNA users to EPP/APT
Example: add 50 ZTNA users
Use the co-term tool to upgrade all endpoints to the end of
Use the co-term tool to add more users. This also aligns all
the term, then follow standard renewal:
contracts to the same expiration date.
• 500 x FC3-10-EMS05-558-02-DD
3
ORDERING GUIDE | FortiClient
ORDER INFORMATION: ADDITIONAL SERVICES
Additional services available include NSE training and best practice deployment consultation:
ADDITIONAL SERVICES FORTICLIENT/EMS SERVICES SKU LICENSE
25-999 Endpoints FC1-10-FCBPS-310-02-DD
FortiCare Best Practices
Consultation Service 1000-9999 Endpoints FC2-10-FCBPS-310-02-DD
10000+ Endpoints FC5-10-FCBPS-310-02-DD
Classroom - Virtual ILT FT-FCT
Training Services Lab Access - Standard NSE Training Lab Environment FT-FCT-LAB
NSE5 Exam Voucher NSE-EX-SPL5
SEE ALSO
Other FortiClient SKUs are orderable for the following deployments:
• SASE: additional SKUs are available for FortiSASE deployments. See the FortiSASE Ordering Guide for details.
• Chromebook: a dedicated version of FortiClient is available for Chromebook. Refer to the datasheet for
information.
UPGRADE MATRIX
For upgrades between different FortiClient versions: 3. Chromebook is standalone. Upgrades to or from
Chromebook are not permitted.
1. SASE, Managed Client, and user-based SKUs are Cloud-
only. 4. Current SASE user-based SKUs for the Secure Web
Gateway (SWG) use case are standalone. You can
2. FortiClient does not support upgrades between on-
upgrade FortiClient user-based ZTNA or EPP license to
premise and Cloud SKUs. Purchasing new SKUs is
user-based SASE license.
required to align with the new EMS instance. The BPS
team can help with migration support. 5. All other upgrades within Cloud or within on-premise are
supported as the matrix shows:
To use this matrix, select the current subscription in the left column, and follow the row to the right to see what is directly
upgradeable with the co-term tool.
FORTICLIENT CLOUD LICENSES
Upgrade to
Managed +
Upgrade from ZTNA/VPN EPP/APT Managed Client SASE - Agent-based SASE - Agentless Chromebook
Forensics
ZTNA/VPN
EPP/APT
Managed Client
SASE - Agent-based*
SASE - Agentless*
Chromebook
ON-PREMISE
Upgrade To
ZTNA + Foren- EPP/APT +
Upgrade FROM ZTNA/VPN EPP/APT Chromebook
sics Forensics
ZTNA/VPN
EPP/APT
Chromebook
* See FortiSASE Ordering Guide.
4
ORDERING GUIDE | FortiClient
FREQUENTLY ASKED QUESTIONS
What is BPS and should I include it for new deals? Can the same EMS instance support a mix of license types, such as VPN/
BPS allows customers access to on-demand consultation with FortiClient/ ZTNA and EPP/APT licenses at the same time?
EMS product experts on all topics including how to deploy FortiClient Yes.
solutions, recommended stable product upgrade paths for their use cases, Can the same EMS instance support a mix of license types even if the VPN/
guidance on license upgrades, guidance on EMS migrations with minimum ZTNA and EPP/APT licenses have different expiry dates?
data loss and transparent end user experience, and more. Including the BPS Yes.
service with every new customer deal is recommended so they have access
Can you have both device-based and user-based licenses?
to product experts for any questions and issues that may come up while
using the product. No, you cannot mix device-based and user-based license on same EMS
What is the easiest way to order? except during transition from one license to another.
What is FortiTrust?
Per-device packs are available for terms of one to five years. See the ordering
examples on the previous pages for expansion, renewals, and upgrades. FortiTrust is Fortinet’s brand for user-based licensing subscriptions, enabling
Is FortiClient licensed per-user or per-device? organizations to easily consume cloud-focused services. With user-based
licensing, expenses are clearer and there is an easier path to increase or
On-premise FortiClient EMS is licensed per-device/endpoint. decrease services consumed. Fortinet offers the FortiTrust license for our
For FortiClient Cloud, choose between per-device/endpoint licensing or per- cloud-based services only.
user licensing. You cannot mix the two license types on a single FortiClient Can you convert or switch from device-based to user-based license?
Cloud environment.
Currently you cannot convert or switch your current contract from device-
What happened to the SASE option? Why do the first two pages not show
based to user-based. You can order user-based SKU at next renewal but
it?
some endpoint data on EMS will be lost and/or a fresh install of EMS may be
All options are still available. See the FortiSASE Ordering Guide. required.
How do I upgrade from one FortiClient license to another? What is the FortiClient Forensics Service?
You can perform upgrades using the co-term tool. The FortiClient Forensic Service provides remote endpoint analysis to help
NOTE: Upgrades are not supported between on-premise and cloud EMS endpoint customers respond to and recover from cyber incidents. For each
deployments. engagement, forensic analysts from Fortinet’s FortiGuard Labs remotely
What are the deployment options for FortiClient EMS? assist in the collection, examination, and presentation of digital evidence,
You can install FortiClient EMS on a Windows Server in your datacenter including a final detailed report. The Endpoint Forensics service is available
(on-premise), in the public cloud, or use FortiClient Cloud directly as a cloud for FortiClient Cloud and on-premise EMS with EMS 7.2.2 or a later version.
service. Can you mix user- and device-based licenses?
What is FortiClient Cloud? No.
FortiClient Cloud is a Fortinet-hosted FortiClient EMS instance. You can My existing customer has a device license that is expiring soon. How can
choose this option to avoid setting up and maintaining your EMS server. they transition to a user license?
What is the maximum number of endpoints that FortiClient Cloud can They can purchase a user-based license and apply it. As soon as the device-
manage? based license expires, EMS starts using the user-based license. You can also
Currently, FortiClient Cloud can manage up to 250000 endpoints. contact Customer Service to remove a device-based license and apply the
user-based license.
What is ZTNA?
What happened to the pack-based user licenses? Does on-premise EMS
ZTNA refers to the proxy-based ZTNA functionality released in FortiOS and
still support user-based licenses?
FortiClient 7.0. This includes the ZTNA device posture checks, certificate
management, and session encoding to securely access trusted applications Starting in mid-Q1, the price list no longer offers the pack-based user
behind the FortiGate ZTNA application gateway. licenses. If a customer wants to buy the user-based license, they can order
the FortiTrust range-based user license for FortiClient Cloud. User-based
I purchased FortiClient with the EMS01/EMS03 SKUs. Can I upgrade to the
licenses are no longer available for on-premise deployments.
new EMS04/EMS05 SKUs?
Due to feature changes, direct upgrade is not supported. You should
purchase new SKUs at the time of renewal. If deploying on-premise with the
older SKUs, consider moving to cloud-based deployment at the same time.
Is the FortiCloud Premium Subscription required for FortiClient Cloud?
No, FortiClient Cloud does not require a FortiCloud Premium subscription.
ONBOARDING
How does FortiClient onboarding work? all topics, including initial setup and deployment,
integration, upgrade/migration, and more. You can
Initial system setup and endpoint device or user
purchase BPS as an annual subscription. It is fully
onboarding has several options, depending on the
integated with FortiCare for a simplified engagement
customer needs:
process.
1. Manual/DIY: as always, full documentation, videos,
open source tools, and other resources are available. 3. Managed FortiClient: initial setup and onboarding is
part of the managed FortiClient service out of the box.
2. Best Practice Consultation: leverage the subscription-
based FortiCare BPS for expert consultation on 4. Professional Service (PS): to complete the project
under SLA-driven engagement, PS is a perfect option.
5
ORDERING GUIDE | FortiClient
FORTINET TRAINING AND CERTIFICATION
Ordering Information
FCP - FortiClient EMS Administrator Training and Certification
SKU DESCRIPTION
Learn how to use FortiClient EMS features, provision FortiClient endpoints,
integrate the FortiClient EMS with the Security Fabric, deploy and configure FT-FCT Instructor-led training – two full days or three half-days
the ZTNA agent and endpoint security features, and understand how to FT-FCT-LAB On-demand self-paced labs
deploy, manage, and maintain endpoint security using FortiClient EMS.
NSE-EX-FTE2 Certification exam
Course description
For information about prerequisites, agenda topics, and learning objectives, see the course description at https://training.fortinet.com/local/staticpage/view.
php?page=library_forticlient-ems-administrator
Visit www.fortinet.com for more details
Copyright © 2024 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or
company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other condi-
tions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s SVP Legal and above, with a purchaser
that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any
such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise
revise this publication without notice, and the most current version of the publication shall be applicable.
FC-OG-R19-20240612
