Unanswered questions

Hi,FortiClient VPN on Android 16 disconnects immediately after a successful IKEv2 certificate authentication against a FortiGate 101F running FortiOS 7.4.12.FortiGate debug shows:certificate validation succeededsignature verification succeededauthentication succeededmode-cfg assigned IPv4 address 10.242.221.100added IPsec SAtunnel up event assigned address 10.242.221.100 Immediately after that, the Android client sends:received informational requestprocessing delete request (proto 1)deleting IKE SAFortiClient Android only shows:START → STARTED → TUNNELLING → ERROR → DISCONNECTED No useful error is displayed. Logs show:authenticationFailure falseconnectionFailure falsefailureReason null The same VPN configuration works perfectly from Windows.DNS changes, send-cert-chain disable, and fragmentation changes did not change the behaviour. The FortiGate uses a wildcard server certificate. Client certificate authentication is successful.Has anyone seen Android 16 / FortiClient Android immediat

When we use user authentication then we can enable dynamic vlan assigment based on the user group, example user group IT will get vlan IT and user HR will get vlan HR.Now when we switch from user authentiction to computer authentication the primary authentication will use certificate stored in computer and this make dynamic vlan based on user group is not working.Anyone here ever try to combine computer authentication but enabled dynamic vlan based on the user group?

How we can successfully send CoA to gthe endpoint behind ip phone? Now the CoA is success only if the endpoint connect to the port switch.Open case to Cisco TAC and them say FNAC should send SessionId inside the radius attribute but still not work. Has anyone here succeeded?

Could you please let me know whether you have encountered a similar issue or are aware of any possible solutions? We are currently migrating from SSL-VPN to IPsec-VPN. Since the migration, some users have been experiencing significantly slower download speeds when connected via IPsec-VPN. Observed speeds:Download: approximately 50 MbpsUpload: approximately 200 Mbps The speed tests were conducted using the following website:https://speedtest.gate02.ne.jp/ When the affected users switch back to SSL-VPN, the download speed returns to normal and the issue does not occur. Additionally, split tunneling is not enabled in our environment. We would appreciate any insights or recommendations you may have regarding this issue.  

I upgrade our fortigate to v7.6.7 and after upgraded then the web admin gui if use mgmt ip address can’t be accessed from advpn, only can be accessed from local site and from hub only. If i using lan ip (not mgmt) then i can access. Anyone know why?SSH to the both port (mgmt and lan) is working fine.

Running FortiWeb KVM_PAYG on Proxmox (standalone, not a cloud marketplace deployment). Reproduced this identically on two separate fresh installs — 8.0.6 build0116 and 7.6.9 build1133. Running FortiWeb KVM_PAYG on Proxmox (standalone, not a cloud marketplace deployment). Reproduced this identically on two separate fresh installs — 8.0.6 build0116 and 7.6.9 build1133.Setup:Operation Mode: Reverse Proxy, standalone (no HA) port1 (external): static/DHCP IP, allowaccess includes http/https/ssh/ping port2 (internal): static IP, reaches backend fine Server Pool → backend IP:80, enabled Virtual Server → Use Interface IP enabled, bound to port1 Server Policy → links VS + Pool + HTTP Service (port 80) + a Web Protection Profile, status shows Running admin-port moved to 8080 beforehand, confirmed no port-in-use conflict when creating the policy License page: all green (VM License, Support Contract, etc.)Symptom:Client (Kali, same L2 segment) connects to the Virtual Server IP on port 80: curl -v

Hello Guys,I need your insights in a challenge i face with our FortiNAC Deployment.Just a brief explanation of the topology and the case at first. We have a NAC VM Cluster, in which we have enrolled our inventory switches. we want dynamic vlan assignment for the users, based on an the Role attribute that each user has ( attribute 60 = vlan 60). Switches (Cisco) has the respective AAA config and i can see on the NAC that the radius accept is sent when the user is connected to the port. Users have the supplicant configuration for the Radius authentication as well.Issue:In scenarios where a laptop is connected through an IP phone, we’ve noticed that when the laptop is disconnected and reconnected, the IP phone restarts due to a port shut/no shut. Is there a recommended way to prevent the IP phone from restarting during this process? We managed to change some port settings, and the restart is not constant, but if the laptop is not connected to the IP Phone for more than 10 minutes, when we

We recently upgraded our FortiGate firewall firmware from version 7.6.6 to 7.6.7.After the upgrade, we started experiencing issues with several applications, including WhatsApp Web, Canva, Figma, and Microsoft 365 Copilot. Users receive the following error message:"Please check your network and try again."As part of our troubleshooting, we manually added the required FQDNs to the SSL/SSH Deep Inspection profile within the security policies. However, Microsoft 365 Copilot is still not functioning properly.Could you please advise on any additional configurations, known issues, or recommended troubleshooting steps for resolving this problem?

If we use computer authentication then can service connector get record grom device group? I want to make dynamic vlan assigment based on entra id with computer authentication.

I try to install the FortiNAC on Azure for my HA but i try search FortiNAC on the marketplace and i didn’t find fortinac as documented in thisarticle FortiNAC Azure Deployment GuideHere available images from Azure Marketplace. 

Hi everyone,We are experiencing persistent performance degradation and connection drops (client-rst) when downloading apps from the Apple App Store, updating iOS/macOS, or streaming Apple Music across our multi-WAN enterprise environment running FortiGate.Network Architecture:Firewall: FortiGate (Multi-WAN SD-WAN deployment) WAN Links: 1 Gbps Fiber, Metro Ethernet, RadioLink Clients: macOS and iOS devices across multiple enterprise LANsThe Issue:During Apple-bound downloads, Apple devices initiate multi-stream parallel connections. While 17.0.0.0/8 traffic matches our designated Apple SD-WAN rules, traffic destined for local/global CDN nodes—specifically Fastly (151.101.x.x) and Akamai (185.158.x.x)—fails to match ISDB / FQDN objects.As a result, these CDN flows hit our default multi-WAN load balancing rules, splitting packets across different WAN interfaces (port1, port3, port4). This IP switching mid-session breaks SSL/session persistence and triggers action="client-rst" on the Forti

Hello everyone,I am facing an issue with a FortiLink deployment over a RADWIN 5000 Point-to-Multipoint (PtMP) wireless network and would like to know if anyone has experienced something similar.TopologyFortiGate |FortiLink |RADWIN 5000 HBS / \ SU-1 SU-2 | |FortiSwitch1 FortiSwitch2The RADWIN network is operating in Layer 2 Bridge mode. No routing or NAT is configured between the FortiGate and the remote FortiSwitches. The wireless network transports the required VLANs correctly.Current behavior If only one remote site is powered on, the FortiSwitch is discovered and managed successfully through FortiLink. If I power on the second remote site, both remote FortiSwitches appear as Offline in the FortiGate. Despite this, all end-user devices connected to both FortiSwitches continue to pass traffic normally on their VLANs. Data connectivity is not affected. In other words: FortiLink management fails. User traffic continues to work without issues. Additio

Hi everyone,I’d like to clarify something regarding the Intune deployment using the official bash script as it seems to be a bit problematic.I was following during configuration → Deploying FortiClient using a shell script | FortiClient 7.4.0 | Fortinet Document Library  We are updating from 7.4.2 to a higher version. Issue I encountered are the following:  *If the EMS is connected, the service does not run at all. No errors are show shown in the Intune portal. Which leaves me with the impression that the devices are not being reached. *Some newer OS versions -> macOS 26.5.2, assigned to the same group are not added to the list of “pending” (invisible, not in the list). And I don’t understand why. I am unsure if the script is even reaching them. The person in question had the older version, we removed it manually, and then we were waiting for the script to be executed. The person’s device was synced a few times (and restarted once) - no changes. *In some occasions, the script does n

Hello,Can someone clarify/confirm if the deployment/install of FortiClient via EMS still works in EMS 7.4.7 running on top of Ubuntu 24.04 w/ local DB, when AD is used as Authentication Server with LDAPS to connect and the user in question is part of Domain Admins and the prerequisites for remote installation in regards to ports / services ( https://docs.fortinet.com/document/forticlient/7.0.6/ems-administration-guide/12424/preparing-windows-endpoints-for-forticlient-deployment ) on the Windows computers are configured.Last time I used it was in EMS 7.2.X and it worked and since version 7.4 I’ve done only manual installations of FCT on workstations so far, so this is the first time hitting this and not working.The deployment policy is done properly, but no installation starts and also I cannot find any logs or I am not looking where I should.

Hello everyone,I am currently working on a production firewall migration from a FortiGate 500D (FortiOS 5.6.x) to a FortiGate 1000F (FortiOS 7.6.x).After migrating the configuration, we are facing an issue where public traffic reaches the FortiGate 1000F but does not reach the internal server. If we reconnect the old FortiGate 500D with the same network topology, everything works normally.EnvironmentSource firewall: FortiGate 500D (FortiOS 5.6.4) Target firewall: FortiGate 1000F (FortiOS 7.6.6) Same public IP addresses Same ISPs Same internal servers BGP is used for routing VIPs are used for inbound servicesWhat has already been verifiedWe have carefully compared the configurations of both firewalls and checked the following:VIP configuration Firewall policies Address objects and address groups Static routes BGP routing Interface mapping Central NAT and Policy NAT Security policies Traffic logs diagnose debug flow Routing tableWe also disabled Central NAT and tested Policy NAT, but the

Hi,I’m using fortimanager provisionning template to manager my IPSec VPN.I’m create a template.In this template I create a IPSec tunnel (Phase 1 and phase 2) with a name like myipsec_model.To create a second Ipsec tunnel, I’m click on clone option. A new tunnel it created with this name : clone_myipsec_model.I can’t rename the new IPSec configuration. I cleck on rename button change the name but this one is not change.I’m use fortimanager 7.6.7.Thanks you for your helpRegardsStéphane 

Hi community,I am setting up a KMS (Key Management Service) host on a Windows Server 2025 VM in an on-premises environment behind a FortiGate firewall. The KMS host VM sits on the internal network and needs outbound internet access only for the initial KMS host key activation against Microsoft.Our environment:- FortiGate firewall managing outbound internet access- KMS host: Windows Server 2025 VM (static IP on internal network)- KMS clients: 3 other Windows Server VMs on the same internal network - We want to restrict internet access to the minimum required — only the KMS host VM should be allowed out, and only to the specific Microsoft endpoints neededMy questions:1. What specific FQDNs / IP addresses need to be whitelisted in the FortiGate policy for KMS host activation? I understand port 1688 TCP is involved — is kms.core.microsoft.com the only endpoint, or are there others ?2. Should this be a one-time firewall rule, or does the KMS host need periodic outbound access (e.g. for the

Since deploying FortiClient 7.4.7  some users are reporting that external USB scanners and web cams are no longer working. In device manager we are seeing  error code 19. We are assuming that this is linked to the known bug around the 3M PRF UMDF USB driver, however there doesn't seem to be a fix or published workaround for it.As we do not use the specific protection element that would allow us to maybe whitelist the affected driver/USB device we have found that  a lower filters driver FortiRMA.sys seems to be the culprit located at the following place in the registry for usHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f}Deleting the local filters from this area does then allow the affected USB attached device to work ( following hardware rescan, device reboot or disconnecting and reconnecting affected  USB device) and as we do not believe that this filter is anything we actually need we believe its safe to do so. Have anybody else come w

Hi everyone,I am attempting to set up a new IPsec VPN connection using the standalone FortiClient VPN only v7.2.1.0779 app, but several configuration options appear to be missing from the user interface: Missing Single Sign-On (SSO): When creating an IPsec VPN profile, there is no option or toggle for Single Sign-On (SSO / SAML) anywhere in the GUI. Missing Mode Config Parameters: Under Address Assignment, selecting Mode Config does not reveal options for Encapsulation, IKE UDP port, or IKE TCP port. Any insights or guidance would be greatly appreciated. Thanks!Missing option in my appSSO setting i expectedMode configuration setting i expected 

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

Hello everyone,Equipment:Model: FortiSwitch 124F-FPOE Firmware: 7.4.3 (Build 830) GAIssue:A CMK15 intercom/communicator device connected to a PoE port on the switch is not receiving any power. The device does not power on.Already checked:The Ethernet cable has been tested and is working correctly. A Wi-Fi access point connected to another port on the same switch receives PoE power correctly and works normally. The same phone device (CMK15), when connected to a different Fortinet-brand switch running the same firmware version, works correctly. It also works correctly when connected to a switch from a different brand.Could this be a hardware issue, or is there a missing configuration on the FortiSwitch? If not, what should my next step be?Thank you. 

After successfully log in via web. The browser gets redirected to login screen and it keep doing this forever. When asked for a license i chose evaluation license and fill the Form with my Fortinet account. Different commands gives me different outputs, i.e get system status shows:FGxxxxx # get system statusVersion: FortiGate-VM64-KVM v8.0.0,build0167,260420 (GA.F)First GA patch build date: 260420Current Security Level: HighFirmware Signature: certifiedVirus-DB: 1.00001(2026-04-02 13:48)Extended DB: 1.00001(2026-04-02 13:48)Extreme DB: 1.00001(2026-04-02 13:48)OCR DB: 0.00000(2001-01-01 00:00)AV AI/ML Model: 0.00000(2001-01-01 00:00)IPS-DB: 6.00741(2015-12-01 02:30)IPS-ETDB: 6.00741(2015-12-01 02:30)IPS-MLDB: 0.00000(2001-01-01 00:00)APP-DB: 6.00741(2015-12-01 02:30)AIAP-DB: 0.00000(2001-01-01 00:00)Proxy-IPS-DB: 6.00741(2015-12-01 02:30)Proxy-IPS-ETDB: 6.00741(2015-12-01 02:30)Proxy-APP-DB: 6.00741(2015-12-01 02:30)Proxy-AIAP-DB: 0.00000(2001-01-01 00:00)FMWP-DB: 0.00000(2001-01-01 00

Good day, i have block instagram from application Control. it works in laptop or pc that connected through this network. but for user who using mobile phone with Wifi access, still able to access Instagram application smoothly. my question is, how to block instagram for user access from mobile phone Iphone or Android. Thank you for Help  

Hi Everyone,How can I configure HA on FortiClient EMS 7.4 devices? The device I will run as Passive will be in the FKM (Disaster Recovery Center), so they will not be on the same network. Is this possible? How does the licensing work? I couldn't find a document for the 7.4 version on the Fortinet side; there is only one for 7.2. Can anyone provide information on this?