Unanswered questions

Hey everyone, i'm sure the answer always depends but wondering who uses DARRP vs manual channel configuration. I've been using DARRP for a few years now and it works 'fine', but I have noticed sometimes it will over saturate a channel instead of using different ones. We typically reboot the AP and it will pick a different channel and things are fine. I've considered moving to a manual config. The only reason I don't is the obvious, it's manual and would love for DARRP to just work. For a scope we a few campuses and about 250APs. 

I have device profiling rule to move all ipphone to IPPhone group. Test the rule manually for one ipphone and the rule is matches, but why the IPPhone group not have any member?   

Is anyone else seeing a large amount of “Domain was blocked by DNS botnet C&C” alerts for valid URLS?the commonality is that its akamai and the common 5 IP addresses are the following.23.223.209.3223.33.44.22823.44.201.23423.57.90.6823.33.40.7 

if we want tio bulid HA for Fortinac then we need sopecial license? Currently my Fortinac located in on-prem and if i want to build the HA can i use 2nd Fortinac on Azure Cloud?

Hi everyone,I wanted to know if it's possible to manually edit these parameters on the unlicenced FortiClient (VPN Only) version for MacOS ?See the image below:  In particular, I need to be sure whether the <eap_method>2</eap_method> parameter (which corresponds to EAP-TTLS/PAP) can actually be configured.I'd like to know if anyone on MacOS has managed to apply these settings, or if I'm forced to purchase the FortiClient Standalone Edition (the client doesn't have the option to buy an EMS server).For additional context regarding my question: currently, we have an IPsec Remote Access VPN setup using IKEv2 + LDAP + MFA (via SMS).Thank you all in advance.

A FORTINET DEVERIA DE REVER A LIBERAÇÕES DE ATIVOS NAO ADMINISTRADOS POR PARCEIROS E PERMITIR A INCLUSOES EM NOVAS CONTAS E DISPONIBILIZAR ATUALIZAÇÕES PARA EMAIL CADASTRADOS SEM ATIVOS CADASTRADOS.

Hi everyone,I'm trying to integrate FortiWLC 8.6-5 build-8 (FortiWLC-500D) with Aruba ClearPass Guest (ClearPass Policy Manager 6.12.7.308288 on C3010 platform) as an external captive portal.Current setupFortiWLC 8.6-5 build-8 External captive portal: Aruba ClearPass Guest Authentication type: RADIUS Captive Portal External Server Type: Fortinet-Presence External URL:  https://<clearpass fqdn>/guest/guest_register_3.phpThe captive portal profile is configured as:Authentication Type: radiusCaptive Portal External Server Type: Fortinet-PresenceSuccess Redirect URL: https://<default redirect url>Login flowClient connects to SSID.FortiWLC redirects the client to the ClearPass Guest portal.The login page receives all FortiWLC parameters correctly, including:magicusermacuseripserveripapmacapidapnodeidssidpost=https://<controllerip>:8081/vpn/loginUser? User enters username/password.ClearPass successfully authenticates the user against the authentication source.After successf

Hello,I need to grant a specific USER/IP access to a specific path, which is as follows:https://dl.k8s.io/release/v1.36.1/bin/windows/amd64/kubectl.exeI usually use STATIC URL entries, where I typically set the FQDN to “SIMPLE” and “MONITOR” modes—meaning I just use dl.k8s.io—but in this case, I’m required to ensure that only the specified source has access to the URL I’ve provided.Is there anything specific I need to do to achieve this?What are the correct “Type” and “Action” to use in this scenario?Do I need to take the “SSL/SSH Inspection” configuration into account?Thanks for your feedback.

Hi everyone,We are troubleshooting what appears to be a Linux-specific FortiClient Enterprise issue and I would like to know if anyone has experienced something similar.Environment:FortiClient Enterprise Linux 7.4.7 build 5438 FortiGate 7.4.x IPsec VPN (IKEv2) RHEL 9.x and Ubuntu 24.04Behaviour:VPN authentication succeeds. Tunnel is established successfully. Approximately 9 seconds later the VPN disconnects. The timing is very consistent (always around 9 seconds).What we have already verified:Same FortiGate configuration works perfectly with FortiClient Enterprise for Windows. Reproduced on both RHEL 9 and Ubuntu 24.04. Reproduced on both physical and virtual machines. Reproduced on x86_64 (and also ARM64 with 7.4.7 where supported). Client is not registered to EMS. FortiGate logs do not show authentication failures, DPD timeout, IKE negotiation errors or peer-initiated disconnects. The Linux client appears to terminate the session locally after the tunnel has already been established.

The port switch connected to the ipphone and if i plug endpoint to the port of the ipphone then the port switch is shutdown even there are no port security in the port switch. Anyone know why?I can see the log from the switch Jul 20 14:30:13: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet2/0/1, new MAC address (f4a8.0d3d.5aeb) is seen.AuditSessionID  11C8640A000038317E6EAFB7  switchport access vlan 251 switchport mode access authentication host-mode multi-domain authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate 180 mab snmp trap mac-notification change added snmp trap mac-notification change removed dot1x pae authenticator dot1x timeout quiet-period 10 dot1x timeout server-timeout 30 dot1x timeout tx-period 10 spanning-tree portfast 

Hello all,I'm using SSL deep inspection through my Fortigate (FGT70G with FortiOS 7.6.7). It works well. The only problem is when applications do things that can't be allowed by any rule. So I've configured an explicit proxy on the Fort that does not perform SSL inspection. Some apps have no way to configure a proxy for them. For example, Steam. So I've been experimenting with some Bash variables. My startscript:#!/bin/bashexport http_proxy=http://fw66.tux.lan:8081export https_proxy=http://fw66.tux.lan:8081export HTTP_PROXY=$http_proxyexport HTTPS_PROXY=$https_proxyexport no_proxy=localhost,127.0.0.1/usr/games/steamIt works also fine. The firewall log confirms this, too.My question is what do I need to watch out for to make sure that another application doesn't accidentally go through the proxy when it's not supposed to? Are there situations where this could happen?Best Regards :)

When I went from 6.4.1879 to 7.0.0601 last May I ended up with extra accounts that where setup with super_admin access, like the followingforticloud techadmin_vpn_access_workadmin_vpn_accessfortinet_techplus other ones does any one know how these got in there? I have since removed them and replaced the 100F to the 120G 

Hi everyone,I'm currently testing the FortiNAC Persistent Agent in my lab environment. The agent is unable to establish a connection to the FortiNAC server. Below are the troubleshooting steps that I have already completed.Troubleshooting performedConfigured DNS and verified that the client can successfully resolve the FortiNAC FQDN. Modified the Windows registry on the client so that ServerIP, LastConnectedServer, and HomeServer all point to the FortiNAC FQDN (fnac.vss.com). Downloaded and installed the Persistent Agent certificate from FortiNAC on the client. Verified network connectivity: Client can successfully ping the FortiNAC server. FortiNAC can successfully ping the client. Verified that FortiNAC is listening on TCP port 4568. Tested TCP connectivity to port 4568 from the client. Captured traffic on FortiNAC using tcpdump.During the packet capture, I observed that the client sends TCP SYN packets to fnac.vss.com:4568, however FortiNAC never replies with a SYN-ACK, causing th

Hi Community expert, We have issue when connected to FSASE VPN then no internet access at all.Fortinet found the root cause which due to FSASE side had cached the Network ID and when user try reconnect back the VPN, due to different Network ID, it will block the internet connection.Fortinet did not provide workaround for more than 12 days while it affecting our production.We tried to disconnect Telemetry and VPN and reconnect back, but failed.Any expert have home cook workaround on this since Fortinet is not helping? Your kind insight will be really appreciated. Thank You

Hello, how can one edit the names in their profile

We upgraded the firewalls from 7.4.2 to 7.6.6 and accessing anything internally over the forticlient connection is very slow.  Prior to the upgrade everything was good. I have tried changing some of the tcp-mss-send/receive values but nothing seems to work. Anyone have any suggestions on what to look at next other than upgrading to 7.6.7?

Hello, I am working on deploying Data Loss Prevention through our Fortigates in our organization. So far it has worked pretty well, and I was beginning to look at using a EDM template of Medication names provided by the FDA so that we can use it as a possible match of uploaded PHI.Currently I am running into a issue with the EDM template parameters, where it will not match against anything using the edm-keyword data type. Using a test CSV with a fake SSN, the ssn-us keyword does work, but nothing I try with edm-keyword works. I know that the file be checked against the DLP profile by checking the logs. I have tested this with dlptest.ai by Fortinet and also other sites we are wanting this DLP filter on. DLP works otherwise as well, the other rules I make are working, just not the EDM template in the way I want to use it. The Fortigate I am testing with is running 7.4.11, this is temporary though as we are working to move to 7.6.x as we move away from SSL VPN.Am I missing something in t

Hi Team,I am facing an issue with password expiration on FortiGate.Environment:FortiGate with local users Password policy applied to the users (password expiration enabled) FortiClient on Windows and AndroidIssue:After applying a password policy and allowing the user's password to expire:Windows PC: When the user connects using FortiClient, they are prompted to change their expired password, and the password change works successfully. Android (FortiClient): There is no option or prompt to change the expired password. The login simply fails because the password has expired, leaving the user with no way to update it from the Android device. Is this expected behavior or a known limitation of FortiClient for Android?Screenshot of password policy: Environment:FortiGate Model: 1101E FortiOS Version: v7.4.11 build2878 (Mature) FortiClient Android Version: 7.4.6.0218

Every question you ask, every answer you share, and every piece of feedback you give helps shape the experience for everyone else. That’s why we’re always listening. Feedback isn’t just about fixing what’s not working - it’s how we discover what could be better, what you value most, and where we should focus next. Whether it’s a small suggestion or a big idea, your perspective helps us make the Community more useful, inclusive, and rewarding for everyone. So, if you’ve got a thought, an idea, or even a small suggestion, share it. It all helps us build a Community that works for the people who use it every day.Please take a moment to share your feedback when the survey appears. Your input is greatly appreciated. We’ll make sure you receive the new Feedback badge to display on your profile. 

Does anyone know if the new exam is using Enteroruse Firewall Admin questions?NSE library has enterprise firewall admin and sdwan modules but nothing that lines up with name Network security architect or is it a whole new exam with both modules combined? 

Hello Fortinet Team,I would like to report a False Positive occurring in FortiClient. The antivirus engine is flagging and quarantining legitimate .jar files that belong to Microsoft Power Automate Desktop.These files are required by the Microsoft application to interact with Java-based interfaces for automation purposes.Software: Microsoft Power Automate Desktop Flagged Files: PAD.JavaBridge.jar PAD.JavaBridge.A11y.jar Some of the File Hashes (SHA256) involved: CF531D64F2445BD6149EF018D41C6B6EDC2185461100998DFF8204... 0887F61DB05200C724DF9E0700F63B98145E47C69FB98258323AB6... EB935EB8D28CDBA566CBACDA023E02FCD4A9DB0535893B5B8699E7... I have attached a screenshot ("Captura de pantalla 2026-07-20 110922.png") showing the multiple detections and the exact hashes provided by the FortiClient logs.Could you please review these files and update the definitions to whitelist them?Thank you.

Hi Fortinet Support,We're looking for guidance on deploying and configuring the FortiClient VPN application on Apple iOS devices managed through SOTI MobiControl.Our Android devices are working as expected, where the VPN configuration and authentication are deployed through SOTI. However, the process appears to differ on iOS, and we're looking for the recommended approach.Specifically, we'd like to know:Whether the FortiClient VPN configuration can be deployed automatically through SOTI MDM on iOS. Whether VPN profiles and authentication settings can be pre-configured using Managed App Configuration or another supported method. If there are any limitations on iOS compared with Android regarding deployment or user interaction. Whether there is any official Fortinet documentation or best practice guidance for deploying FortiClient VPN on iOS using SOTI MobiControl.Our environment:MDM: SOTI MobiControl Devices: Apple iPhone and iPad (iOS/iPadOS) VPN Client: FortiClient Android deployment

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

A FortiMail client, who uses the free tier of FortiSandbox SaaS, was informed about new vulnerabilities and intends to identify the version of FortiSandbox in use in order to assess whether there is any risk of exposure.

Hello,I am trying to deploy the FortiFirewall-VM64-KVM v7.6.7 (build 3704) permanent evaluation on Proxmox VE (KVM).After the initial boot, the GUI always redirects to:/prompt/fortigate-setup?viewOnly=1&startup=1but the page remains completely white and the setup wizard never loads.The CLI shows:License Status: InvalidRunning:exec vm-licensereturns:This VM is using the evaluation license.Failed to download VM license.Output of:diagnose hardware sysinfo vm fullshows:valid: 0status: 3code: 0Things I have already tried: Deployed multiple fresh VMs. Factory reset. Tested with multiple browsers. Verified Internet connectivity and DNS. Successfully pinged update.fortiguard.net and support.fortinet.com. Followed the suggestions from this Community post:https://community.fortinet.com/support-forum-92/issue-installing-a-vm-fortigate-223043?postid=223128#post223128 The behavior remains exactly the same.I also found posts mentioning activation via TFTP using a .lic file, but since I