ZTNA without legacy VPN
An organization retires its SSL VPN in favor of FortiClient + ZTNA; users stop joining the network and access applications directly.
Fortinet · Network Security and SD-WAN
FortiClient (ZTNA + EPP)
One agent for VPN, ZTNA, EDR and compliance.
Quick answer
FortiClient is Fortinet's enterprise client agent. A single agent delivers VPN (SSL and IPsec), Zero Trust Network Access (ZTNA), endpoint protection (EPP), compliance checks and web filtering. It is centrally managed via FortiClient EMS (Endpoint Management Server).
FortiClient ships in tiered packages: Free (VPN only), ZTNA, EPP and Cloud. The same agent contains all capabilities; features activate by license.
ZTNA: through FortiGate's ZTNA gateway, user + device + posture-based application access is delivered. Fortinet's strategic VPN replacement.
EPP: anti-malware (FortiGuard), anti-exploit, web filtering, behavioral protection. Combined with FortiEDR you get advanced EDR.
Key features
What it offers
- ZTNA-based application access
- Anti-exploit and behavioral protection
- Compliance (posture) checks
- Web filtering and URL categorization
- Centralized management with EMS
- SSL and IPsec VPN
- FortiSASE integration
- Windows, macOS, Linux, iOS, Android
Tech Summary
Important technical data
- Platforms
- Windows 10/11, macOS 12+, Linux, iOS, Android, ChromeOS
- Management
- FortiClient EMS (on-prem or cloud)
- Agent size
- ~200 MB disk
- Licensing
- Per user, annual; EMS user limit
- VPN
- SSL VPN + IPsec VPN
- EDR
- Bundled with FortiEDR
Use CasesGeneral Education Logistics Finance
When would you choose this product?
Student laptop fleet
Across 10,000 teacher and student laptops, FortiClient EPP and web filtering block inappropriate sites.
Compliance for field staff
Field staff laptops are posture-checked via FortiClient; ZTNA blocks access if antivirus is off, disk is unencrypted or patches are out of date.
Branch staff compliance
At a bank each branch laptop is checked through FortiClient for firewall + disk encryption + patch status.
Who is it for?
All enterprise client fleets; organizations practicing hybrid work.
Frequently Asked Questions
Frequently asked questions
What does the free FortiClient version do?
FortiClient Free includes only SSL VPN and IPsec VPN; used to connect to a FortiGate. Paid versions are required for anti-malware, ZTNA and EMS management.
What is FortiClient EMS?
Endpoint Management Server — the central console for FortiClient agents. Policy distribution, inventory, compliance reporting and ZTNA tag management happen in EMS. Runs on-prem or in the cloud (EMS Cloud).
How does FortiEDR differ from FortiClient?
FortiClient offers core EPP. FortiEDR adds behavioral post-infection protection, forensic timelines, threat hunting and XDR correlation. The two are typically deployed together.
Which applications work with ZTNA?
Web-based (HTTP/HTTPS) and TCP-based (RDP, SSH, SMB) applications are supported. With application-aware proxy, access is granted at the application level rather than the network level.
How do we migrate from VPN to ZTNA?
Sora Yazılım's typical migration: 1) enable ZTNA gateway on FortiGate, 2) define application list in EMS, 3) onboard a pilot group to ZTNA, 4) ramp all users, 5) retire the old VPN server. Typical 4–8 weeks.
What does the posture check verify?
OS version, patch status, anti-malware active/up-to-date, disk encryption, firewall state, lost/stolen status, and custom registry/file checks. On policy failure, access is blocked or restricted.
How is macOS and Linux support?
macOS has full support (including Apple silicon natively). Linux supports VPN and ZTNA, with limited EPP coverage (RHEL, Ubuntu, CentOS).
Can it be used in BYOD mode?
Yes. FortiClient installed on a personal device runs with limited permissions; it activates only when accessing corporate resources. User privacy is preserved.
How is the license purchased?
FortiClient EMS licensing is priced by user count and term. ZTNA and EPP modules are separate SKUs. Sora Yazılım recommends a package matching your needs.
Does FortiClient support Single Sign-On (SSO)?
Yes. SAML, OIDC, Kerberos and RADIUS are supported. Integrates with Entra ID, Okta, Google Workspace; ZTNA tag information can be sourced from the IdP.
Vendor's official product page
Opens the vendor's original technical documentation and product page in a new tab.
Fortinet — FortiClient (ZTNA + EPP) →From the same brand
Fortinet family — other products
FortiGate NGFW
AI-driven Next-Gen Firewall family (40F → 7081F).
DetailsFortiSASE
Cloud-delivered Secure Access Service Edge for hybrid workers.
DetailsFortiEDR / FortiXDR
Endpoint Detection & Response and extended detection/response.
DetailsFortiAP (Wi-Fi 6/6E/7)
Enterprise wireless access points orchestrated by FortiGate.
DetailsComparable Solutions
Similar solutions from other brands
FortiClient (ZTNA + EPP) licensing + deployment + support
Sora Yazılım handles licensing, deployment, training and ongoing management — all from a single team.