Distributing customized FortiClient installers using a FortiGate unit

[#1]

Article

Description	Starting with FortiClient 3.0 MR5 Patch 3, you can customize FortiClient installer packages designed for distribution through the FortiClient Check feature on some FortiGate models.
Background	Some FortiGate models, including the FortiGate-224B, FortiGate-1000A and FortiGate-3600A, can check that users have the FortiClient application running on their computers and deny network access to those who do not. Optionally, these FortiGate units can redirect denied users to an internal web portal from which they can download the FortiClient installation file. FortiClient installer files intended for upload to FortiGate units are smaller than the standard installer. They contain a much smaller antivirus database. After installation, the FortiClient application obtains the entire database when it performs an antivirus update. These reduced-size installer files have "_FG" in their name. Prior to FortiClient 3.0 MR5 Patch 3, only .exe reduced-size installers were available, which are not customizable. Now, reduced-size MSI installers in a .zip package are available. You can customize these in the same way that you can customize the full size MSI installers. FortiOS 3.0 MR6 supports upload of either MSI or .exe FortiClient installers. To use MSI installers with earlier versions of FortiOS, you need to package the MSI installer in a self-extracting archive.
Components	FortiClient reduced-size MSI installer (.zip file) from the Support web site. A FortiGate unit with FortiClient Check feature. Third-party self-extracting archive utility such as WinRAR or UPX. (Required only if the FortiGate unit firmware is FortiOS 3.0 MR5 or earlier)
Create the customized installer	To customize a FortiClient installer for upload to a FortiGate unit Obtain the reduced-size FortiClient installation package from the Support web site. Download the .zip file with "_FG" in its name. If you want the 64-bit version of the FortiClient application, the file name must also contain "_x64". Customize the .zip package following the instructions in the Installation chapter of the FortiClient Administration Guide. If you will upload the installer to an FortiGate unit running FortiOS 3.0 MR5 or earlier, package the customized MSI in a self-extracting archive using a third-party compression program such as WinRAR. For more information, refer to the documentation for the third-party tool.
Upload the installer to the FortiGate unit	To customize a FortiClient installer for upload to a FortiGate unit Connect your computer to the FortiGate unit's web-based manager. Refer to the Installation Guide for your FortiGate unit for more information. In the web-based manager, go to System > Status. In the System Information section, select Update on the FortiClient Version line. Select Browse, navigate to the FortiClient installation file on the computer and then select Open. Select OK. The FortiGate unit uploads the file. Note: The file name must begin with "FortiClientSetup_", followed by the version number. For example, "3.0.525". On FortiGate units running FortiOS 3.0 MR5 or earlier, the remainder of the file name must be "_FG.exe". It is not possible to upload an MSI installer package. You must create a self-extracting archive. On later versions of FortiOS, you can upload either a .msi or .exe package.
Note on installing FortiClient	Note: If you download a customized self-extracting installer (.exe) package from a FortiGate unit, you must run the self-extractor to obtain the MSI installer. Double-click the MSI installer to install the FortiClient application. For more information about installing the FortiClient application, see the FortiClient User Guide.