In a Fortinet Security Fabric environment, roles are distributed. FortiClient EMS acts as the Policy Administration and Decision Point, defining compliance rules and assigning Zero Trust tags to endpoints. The FortiClient agent on the endpoint reports its status and acts as the Policy Information Point. The FortiGate acts as the Policy Enforcement Point. It receives the ZTNA tags from EMS and uses them in ZTNA rules and firewall policies to dynamically grant or deny access to network resources, thereby enforcing compliance.

A. FortiClient reports its compliance status to EMS but does not enforce network access control policies on the FortiGate; it is the agent being monitored.

B. FortiClient EMS defines the rules and assigns tags but does not sit in the data path to block or allow traffic to corporate resources.

D. FortiAnalyzer is a logging and analytics platform; it collects data and provides reports but does not actively enforce security policies in real-time.

1. FortiClient EMS 7.2 Administration Guide, Page 258, "Zero Trust Tags". The guide explains, "FortiClient EMS sends endpoint information including ZTNA tags to FortiGate. You can use ZTNA tags on FortiGate to enforce dynamic access control."

2. FortiGate ZTNA Deployment Guide 7.2, Page 10, "ZTNA configuration overview". The guide shows that ZTNA rules are configured on the FortiGate to check for tags and enforce access.