Recently active topics

FortiAIGate 8.0.2 can see traffic logs that my UI and postman API request were caught but traffic log details show Request Refused 'The gateway refused this request (404, HTTP 404)'ChatUI & Postman API calling to FortiAIGate 8.0.2 following FortiAIGate Administration Guide [Send a normal request]:https://docs.fortinet.com/document/fortiaigate/8.0.2/fortiaigate-administration-guide/531206/appendix-a-api-endpoints-and-request-examples#select-an-api-dialectAny idea?

Hello guys,Issue Description: We recently attempted a firmware upgrade on our GCP HA cluster from v7.4.12 to v7.4.13. The image upload and HA synchronization process completed successfully, and both nodes rebooted. However, immediately upon booting into 7.4.13, the system experienced a false positive on the WAN health-check (Link Monitor). The firewall incorrectly detected the external ping targets (8.8.8.8 and 1.1.1.1) as unreachable. This triggered the automatic removal of the default static route on the external interface. As a result, the cluster lost all outbound Internet access. I got this error message when uploading frimware image : anyone with similar architecture have experienced this issue ??

Hello everyone, I have a few questions about how synchronization works at the HA group level.Virtual IPs (VIPs): Are VIPs synchronized across all the clusters/units that belong to the HA group, or must they be configured separately on each cluster? DKIM keys: Are DKIM keys synchronized across all the units/clusters in the HA group? Or do we need to generate or import them manually on each one? “Action on failure” in the HA group: When this option is set to “Wait for recovery and switch to configured role”, what happens when Site A comes back after being down while Site B was acting in its place? Does Site A resynchronize and apply the configuration changes made on Site B during the outage before switching back to its configured role? Or does it come back with its old configuration, potentially overwriting or ignoring the changes made on Site B? Thanks in advance,BR,

Hello Community, We are currently facing an issue regarding IPSec Remote Access VPN connectivity from Linux (Ubuntu) using FortiClient VPN as the user agent. Our FortiGate is running FortiOS 7.6.6, and we want to allow remote users to connect through IPSec Remote Access VPN. However, after installing FortiClient VPN on Ubuntu, we noticed that the GUI only provides options for SSL VPN and XML configuration, and there is no option available for IPSec VPN.Since SSL VPN is not supported in our current deployment scenario on FortiOS 7.6.6, we intended to use IPSec-based Remote Access. As a workaround, we installed strongSwan on Ubuntu and configured the IPSec connection manually. The VPN tunnel was established successfully using the user created on the FortiGate, and connectivity is working properly. However, we would like to clarify the following points:Is IPSec Remote Access officially not supported in FortiClient VPN Only for Linux?If FortiClient VPN does not support

Hi everyone, I'm trying to set up remote access via IPSec to a FortiGate 60F. Since MS365 SSO is in use already for various services, this should be used also for VPN access. I've been able to successfully implement this and was able to connect from a Windows box with SSO and the FortiClient VPN-only version (7.4.3 hotfix 1.8758). EMS is not in use. However, I'm also looking for a solution for Linux, but each option that I see leads to a dead Open-source IPsec clients like strongswan and libreswan don't appear to support SSO authentication (yet). I tried to add a separate user using static credentials for EAP login, but I also haven't found a way to use these tools with both a PSK and additional EAP authentication.I was able to establish a connection with the regular Linux FortiClient, but it can't be used without an EMS except for a trial.The FortiClient VPN-only version for Linux (7.4.3 build 1736) appears to only support SSL VPN, but not IPSec.SSL VPN is obsolete

Hi All,I have fortigate firewall (OS 7.6.7) with two WAN interfaces (WAN1: 10.10.10.1 & WAN2: 20.10.10.1)And configured IPsec tunnel on WAN1 10.10.10.1), generally we can add another public IP as secondary IP to IPsec tunnel.But now I want to add WAN2 IP (20.10.10.1) as secondary IP to my existing tunnel, which is configured on WAN1 interface. Will it possible?, or in traditional way have to configure two IPSec tunnels?

Hello community,Product: FortiGate-90GThe device is currently running FortiOS 7.4.7 build 2731.Its FMWR/support contract expired on 11 July 2025.FortiCloud SSO access is currently being blocked with Attack ID 20000021 because the installed FortiOS version is affected by CVE-2026-24858. I would therefore like to update the device to a security-fixed FortiOS release. However, due to the expired support contract, the FortiGate does not permit the upgrade through FortiGuard and the FortiCare portal does not allow me to download the firmware image manually. I am not requesting access to a newer major/minor FortiOS branch. I would like to remain within the existing FortiOS 7.4.x branch and upgrade only to the current security-fixed patch release, preferably FortiOS 7.4.12.Is it possible for the the official FortiOS 7.4.12 firmware image for this FortiGate-90G to be provided, or can someone from this community enable another supported method of upgrading this device to 7.4.12 for security rem

We have trouble with Forticlient vpn only 7.4.3 on Mac OS 27 Golden State. If we are trying to establish vpn connection, every time we recived time out. Oure Macbook Air is staight from suplier with clean preinstaled Mac Os Golden State. Vpn is configured as IPSec. Firewall is disabled.The same config we are using on Windows and it is working just fine.

Hello Fortinet Community,I have a FortiGate firewall and would like to implement the following requirement in my organization.Requirement: Block WhatsApp Web access through web browsers (Google Chrome, Microsoft Edge, Firefox, etc.). Allow WhatsApp Desktop application on Windows PCs. Users should not be able to access https://web.whatsapp.com through any browser. WhatsApp Desktop should continue working normally, including messaging, voice/video calls, and file transfers. My Questions: Is it possible to achieve this using FortiGate Web Filter or Application Control? Can we block only the WhatsApp Web browser traffic without affecting the WhatsApp Desktop application? Which FortiGate application signatures or URL filtering rules should be used? Is SSL Deep Inspection required for this implementation? Are there any recommended configurations or best practices to achieve this requirement? I would appreciate any guidance, CLI configuration examples, or step-by-step instructio

DescriptionThis article explains how to edit the FortiClient XML file to distinguish multiple IKEv2 IPsec VPN tunnels using Network ID instead of Peer ID.ScopeFortiGate, FortiClient.SolutionWhen multiple dial-up IPsec IKEv2 IPsec VPN tunnels are configured on FortiGate, a unique Network ID must be defined on each Phase 1 configuration. This allows FortiGate to correctly match incoming IKEv2 initiations with the appropriate tunnel.If the Network ID is not defined, FortiGate cannot reliably determine which Phase 1 configuration to use when multiple IKEv2 dial‑up tunnels reside on the same interface. This behavior differs from IKEv1, where Peer IDs were used to distinguish between tunnels. Use the following CLI syntax to define the Network ID for each Phase 1 configuration: config vpn ipsec phase1-interface     edit "<phase1-name>"         set ike-version 2         set network-overlay enable         set network-id <integer>     next end The Network ID must be defined on both t

Hello everyone, Does FortiGate accept two VIP objects with the same external IP ? If so which FortiOS and how is it configured ? Thanks in advance.BR,

authentication code issues, only works with a push notification, code gives 'vpn error'

 HI all,I’ve run into a tricky issue on an IPsec Remote Access VPN connection with Forticlient.my FG version: ’FortiGate-50G v7.4.8,build2795,250523 (GA.M)’, FG can see internet, and here is the configuration of IPsec Phase1:FortiGate-50G # config vpn ipsec phase1-interfaceFortiGate-50G (phase1-interface) # edit IPsec\ RA\ vpn0 FortiGate-50G (IPsec RA vpn0) # show config vpn ipsec phase1-interface edit "IPsec RA vpn0" set type dynamic set interface "lan2" //yes my wan interface name is lan2 set ike-version 2 //also tried ikev1(agressive and main) set local-gw <my public ip> set peertype any set net-device disable set mode-cfg enable set proposal aes128-sha256 aes256-sha256 set dpd on-idle set dhgrp 5 set eap enable //also tried with no eap set eap-identity send-request set authusrgrp "POC_grp" set nattraversal forced //also tried

DescriptionA FortiGate behind a perimeter firewall may be unable to register FortiToken Mobile licenses or send alert/activation email, even after a list of Fortinet IP addresses and ports is allow-listed. The fix is to allow the Fortinet FQDNs the FortiGate actually resolves and connects to (not a fixed set of IPs), make sure DNS resolution works, and point the FortiGate at a custom SMTP server if FortiCare support is not valid.ScopeFortiGate.SolutionThe email test fails:diagnose log alertmail test ... Cannot use fortinet-notifications.com when forticare support is invalid.The logs say the FortiGate cannot find the email server (log ID 0100020002):msg="Can't resolve the IP address of fortinet-notifications.com" msg="Can't resolve the IP address of fortinetvirussubmit.com" msg="Can't resolve the IP address of fortinetipssubmit.com"Token setup fails with error -7500:FortiGate was unable to communicate with FortiCloud. Provision token: FTKMOBxxxxxxxxxx error: -7500.When you add a token

FortiAIFortiAI 6.1.0: Adds AI Agent Traceability to review every step of an agent run, insight templates for the AI Insights dashboard, quick prompts on the Alert, Case, and Indicator list views, AI verdict and summary fields on alerts, and four MCP servers. Alert Investigation 1.0.1: Records each investigation step for review in AI Agent Traceability. Chat Assistant 2.0.0: Adds a plan mode that hands multi-step requests to the Orchestrator agent, and records agent runs for traceability. Connector Generation 1.0.0: New agent that generates a FortiSOAR connector from a natural language description and API specification, and can import it into FortiSOAR. FortiSOAR Data Access 1.0.1: Adds traceability and improves query efficiency and performance. Identity Context Provider 1.0.1: Includes fixes. Investigation Planner 1.0.1: Adds traceability, and an option to mark data sources as unavailable so investigation questions cover only the sources that can be queried. IOC Masking 1.0.1: Adds tra

DescriptionSteps to resolve the BT-A700G scanner intermittently not seeing or connecting to the SSID on the 5 GHz band on FortiAP WiFi.ScopeFortiAP 7.4.7, 7.6.5 and above.FortiGate 7.4.12, 7.6.5 and above.BT-A700G scanner WiFi clients.SolutionAccording to the KEYENCE European BT-A700G Scanner datasheet, the supported WLAN frequency ranges are as shown below. Therefore, the BT-A700G Scanner supports only these 5 GHz channels (36, 40, 44, 48, 52, 56, 60, 64).2.4 GHz: Channels 1–13.5.2 GHz: Channels 36, 40, 44, 48.5.3 GHz: Channels 52, 56, 60, 64.In this article, the FortiAP-243K is managed by the FortiGate. The FortiAP is assigned to a FortiAP profile with country code "Hungary" and, by default, the FortiAP supports "36" "40" "44" "48" "52" "56" "60" "64" "100" "104" "108" "112" "116" "120" "124" "128" "132" "136" "140" "149" "153" "157" "161" "165" channels on the 5 GHz band.Therefore, when the FortiAP operates on any of these unsupported channels. The SSID does not appear in the BT-A70

Hello Fortinet Community,We are experiencing recurring FortiClient VPN connection issues with one of our customers and would appreciate your advice.System Information:Device: MacBook Pro (Apple M1 Pro) Operating System: macOS 27.0.1 FortiClient VPN: 7.4.3.4323 (Free VPN Version) VPN Type: SSL-VPNProblem Description:The VPN connection works normally for several days. However, after some time, FortiClient becomes unresponsive when attempting to reconnect.Restarting the Mac does not resolve the issue. The VPN only starts working again after reconfiguring the connection, but the problem returns after a few days.Troubleshooting Already Performed:Verified the VPN configuration. Successfully tested connecting and disconnecting the VPN. Checked Fortinet network extensions and background services – all active. Reviewed FortiClient logs without identifying a definitive cause. Verified that the VPN works correctly immediately after reconfiguration.Our Questions:Is FortiClient VPN 7.4.3.4323 offic

DescriptionThis article describes an issue with the default IPSEngine 7.01200 that is being distributed with the installation of FortiOS 7.6.8. The IPSEngine will be installed for FortiOS through the upgrade process or a fresh installation. ScopeFortiOS 7.6.8.SolutionAfter upgrading or installing FortiOS 7.6.8, a FortiGate configured with an IPS profile may face an issue with conserve mode caused by IPSEngine:FGT # diagnose sys top-mem 20 ipsengine (32351): 4935072kB ipsengine (32350): 1898962kB ipsengine (32349): 1341961kB ipsengine (32352): 697470kB node (3604): 94104kB mvl.user (2258): 81701kBThe output for crashlog will show the following:FGT # diagnose debug crashlog read | grep "conserve mode" 2026-10-16 10:26:40 green="13075 MB" msg="Kernel enters memory conserve mode 2026-10-16 10:27:24 green="13075 MB" msg="Kernel exits memory conserve mode" 2026-10-16 12:33:56 green="13075 MB" msg="Kernel enters memory conserve mode 2026-10-16 12:39:56 green="13075 MB" msg="Kernel exits memor

DescriptionThis article explains an issue where the search and filter functionality for IP addresses does not return expected results on the address object list page in the FortiGate GUI.ScopeFortiOS version 7.6.7, FortiOS version 8.0.0.SolutionIn older firmware, for example, version 7.4.11. the filter works normally:In firmware version 7.6.7, the filter is unable to filter the correct result:Filtering by IP address no longer returns the address object, as shown in the above capture.This is a known issue affecting FortiOS version 7.6.7 and version 8.0.0.The fix is available in firmware version 8.0.1 but, currently, no fix is available for 7.6.x firmware.In the 7.6 branch, the issue will be resolved in the FortiOS version 7.6.9 release.For a workaround, use the CLI to search for the address objects by IP:diagnose firewall address list | grep <IP>

If we refer to the Fortinet article below:Technical Tip: Implementing IPsec VPN SAML-based authentication using loopback Interface | Community it states that:IKE with SAML authentication does not support multiple SAML servers on the same interface, as the SAML server is directly bound to the interface and allows only one instance to be configured.What is the recommended design if I have two Internet connections for VPN redundancy?Since the SAML server is bound to an interface, does that mean we cannot enable the same SAML server on the secondary Internet interface?Has anyone implemented IPsec VPN with SAML authentication in a dual-ISP redundant setup?

How do I get FCREMOVE.exe for a free copy of Forticlient I am unable to download the tools and I have a free copy of Forticlient installed and I can not remove it It is not showing in add/remove programs.  We can't uninstall   We can't install.  We are stuck Any ideas?

DescriptionInstructions to resolve the 'This Firmware didn't pass the signature verification.' error when upgrading to FortiOS version 7.6.8.ScopeFortiOS.SolutionWhen upgrading from FortiOS version 7.6.7 to version 7.6.8, it is possible to face an error stating 'This Firmware didn't pass the signature verification.' when the image has finished downloading (or uploading, if not using the file upload function):This is a known issue with the 30/31G platform, and the solution is to upgrade to FortiOS version 7.6.7 STS build 8767 before proceeding. To get this build, open a TAC ticket: Customer Service Tip: How to create a ticket for Fortinet TAC. After upgrading to this build, it will be possible to upgrade to FortiOS version 7.6.8 GA: FortiOS version 7.6.7 GA -> version 7.6.7 STS build8767 -> version 7.6.8 GA.Filenames and checksums:30G:Filename: FGT_30G-v7.6.7STS-build8767-FORTINET.out MD5sum: 53547757b2b9ede1e4be1dd71cefa7b4 SHA512sum: aabf2d78e152e8ffb82102dd741a968b640fca4ba3513

DescriptionSteps to prevent a FortiGate from advertising BGP routes learned from a specific neighbor to another BGP neighbor by using BGP communities and route maps.ScopeFortiGate.SolutionBy default, routes learned from one eBGP neighbor can be advertised to another eBGP neighbor.BGP communities can be used to identify routes received from a specific neighbor and filter their advertisements to another neighbor without maintaining individual prefix lists or relying on AS_PATH matching.Consider the following topology:DeviceAS numberBGP neighbor IPLocalFortiGate6500010.10.10.1, 10.10.20.1RemoteFortiGate16500110.10.10.2RemoteFortiGate26500210.10.20.2RemoteFortiGate1 advertises 172.16.1.0/24, and RemoteFortiGate2 advertises 172.16.2.0/24.The requirement is to prevent LocalFortiGate from advertising routes learned from RemoteFortiGate2 to RemoteFortiGate1 while retaining those routes locally.Before applying the filtering, RemoteFortiGate1 receives both prefixes:RemoteFortiGate1 # get router

DescriptionThe FortiClient/EMS fabric connector on FortiGate version 7.4.12 rejects a valid publicly signed FortiClient/EMS web server certificate with a CA not recognized error. This article describes the incident details, debugging, and solution of the issue.ScopeFortiGate, FortiClient EMS.SolutionAfter upgrading FortiOS, the FortiGate EMS fabric connector may fail to validate a valid EMS server certificate and display the error EMS server certificate is not signed by any known CA. The issue may occur even when the certificate chain is valid, and the required CA certificates are installed on the FortiGate. Also, it might be resolved after revalidating or reinstalling the certificate chain in the FortiGate certificate store. Enable the following debug commands, reproduce the issue by testing the EMS connection, and then disable debugging.diagnose debug reset diagnose debug application fcnacd -1 diagnose debug console timestamp enable diagnose endpoint filter show-large-data yes diagno

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same