Support Forum

Hello,I am reviewing the FortiOS 7.6 administration guide regarding inspection modes (pages 233–234), and I need clarification on the following point:The documentation states that proxy-based mode provides more feature configuration options and is security-focused, while flow-based mode is designed to optimize performance.However, it also mentions that flow-based mode can consume more CPU cycles than proxy-based mode in some cases, which appears contradictory: page 233 ..... While both modes offer significant security, proxy-based mode provides more feature configuration options,while flow-based mode is designed to optimize performance .....If security is your priority, proxy-based inspection mode—with client comforting disabled—is more appropriate.If performance is your top priority, then flow-based inspection mode is more appropriate..........page 234 ...... Because the file is transmitted at the same time, flow-based mode consumes more CPU cycles than proxy-based mode. However, depe

Hello Wi-Fi adminsThis tech tip explains how to allow a VPN user change his LDAP password when it expires.I tried do the same for my Wi-Fi (managed FortiAP), same described config on FGT and FAC, but when user with expired password tries to connect it just fails to connect, and FAC shows the following message.Windows AD user authentication from (null) (mschap) with no token failed: user password change requiredThe user password must be changed before logging on the first time. (0xc0000224)Any idea what I might have missed?

Hello, I am reading the FortiOS admin guide and I saw that the antivirus checking order is:Antivirus local database → EMS threat feed → external malware blocklist → FortiGuard outbreak prevention databaseBut I have a few questions.1. What about the other inspection engines?Where do the following fit in the inspection flow?Content Disarm and Reconstruction (CDR) Behavior-based detection CIFS/SMB scanning AI/ML detectionMy question is:👉 If a file is NOT detected by:signature-based AV database EMS threat feed external malware blocklist outbreak prevention / hash reputationthen will FortiGate check the engines above afterwards?Or do these engines run in parallel / separate pipelines?What is the actual processing order?2. Signature-based detection clarificationThe guide says:“Antivirus scan detects viruses that are an exact match for a signature in the antivirus database.”So I want to confirm:Does “signature” here mean a hash value (exact file match)? Or is it a pattern-based rule (byte se

I've been tossing around the idea of doing a series of posts, maybe bi-weekly or monthly, highlighting a Fortinet product that isn't as well known... before I start putting in a bunch of work on this, is there an appetite for it? It would probably be pretty high level, but I run into situations all the time talking to customers about projects/concerns and mention a product in the FortiVerse they didn't know existed.

 Finding a reliable Insta360 discount code can be surprisingly difficult. Many coupon websites continue to promote expired offers, while some discount codes only work for specific products or regions. That's why more buyers are choosing the verified partner code INRSG9HITPA when shopping for Insta360 cameras and accessories.What makes this promo code stand out is its combination of global availability and strong promotional value. Instead of offering a simple one-time discount, the Insta360 couponcode INRSG9HITPA is often linked to official partner campaigns that provide additional benefits beyond standard savings.Depending on the product and current promotion, buyers may gain access to: Up to 15% discount opportunities Up to $120 / €120 / £120 additional promotional savings Free accessories on eligible models Exclusive bundle offers Creator-focused promotions One of the biggest advantages is the potential to receive free accessories that improve the overall value of an order.

 Looking for the best Insta360 discount code during Creator Week? The verified official partner code INRSG9HITPA is currently one of the strongest options available for global buyers. By accessing the Creator Week campaign and using this trusted promo code, customers can unlock an extra $78 discount on eligible purchases while also gaining access to additional promotional benefits. Depending on the selected product and region, the Insta360 couponcode INRSG9HITPA may also help buyers qualify for up to 15% discount opportunities, up to $120 / €120 / £120 additional promotional savings, and valuable free accessories such as Invisible Selfie Sticks, Screen Protectors, Lens Guards, Carry Cases, or Extra Batteries. Because this discount code is associated with an official partner campaign and works globally, it has become a popular choice among creators looking to maximize the value of their Insta360 purchase. Creator Week registration link: https://store.insta360.com/campaign/creator-week?u

 If you're searching for a verified Insta360 couponcode that actually works, you've probably noticed how many websites recycle expired offers. Some promotions disappear without notice, while others only work for specific products or countries.That's why more buyers are turning to the verified Insta360 couponcode:INRSG9HITPAAs an official partner code, INRSG9HITPA is recognized by creators and customers worldwide. It is frequently associated with free accessories, promotional bundles, and discount code benefits that can significantly increase the value of an Insta360 purchase.  Why Use This Verified Insta360 CouponCode?A verified couponcode provides more than just peace of mind.Instead of risking an expired promotion, buyers can use a trusted code connected to official campaigns and partner offers. This becomes especially valuable when purchasing a complete creator setup rather than a camera alone.Many customers also add: Extra batteries Invisible Selfie Sticks Lens Guards Fast Ch

If you're planning to upgrade your daily commute, enjoy weekend adventures, or replace expensive transportation costs with a smarter solution, now is the ideal time to buy. By shopping through https://engwe-bikes.com/?ref=TONYPHAM and applying Engwe promo code: 100SAVE, you can unlock an additional 10% discount on top of current promotions.

The demand for electric bikes across Europe continues to grow rapidly, and for good reason. Riders are looking for a smarter, more affordable, and eco-friendly way to travel. If you're searching for a premium e-bike that combines performance, comfort, style, and value, ENGWE deserves your attention.Even better, thanks to Engwe discount code EU: 100SAVE, you can enjoy an additional 10% OFF on top of many of the promotions already available on the official store.

I just installed FortiClient VPN only.But when I press the three-line menu, I only see the interactive option "View the selected connection," so I'm blocked from manually adding or editing connections.I've tried uninstalling and reinstalling it, using administrator privileges, and even deleting any trace of a previous version that might exist for some reason.It still doesn't work.I would appreciate your help. 

initial kb for metadata variables...

Anyone experiencing this issue with FortiClient 7.4.7 and the latest macOS? I had to prep a new MacBook for one of my people and upon installing FortiClient from my EMS (Cloud) installer, it just will not register from the still good invite code bundled in the installer nor will it accept the invite code trying to manually enter and connect. It does not give me an error or anything, it just does nothing. Invite code is still good as I used it with a Windows PC afterwards and no issues. I have went through the release notes for 7.4.7 in regards to macOS and ensure disk permission access and system extension activations were good, etc… and all are on/allowed based on the release notes requirements.

Hi everyone,We are troubleshooting a FortiGate-6000F running FortiOS 7.6.6 build3652 GA.Two FPC blades, slot 2 and slot 3, are stuck in Dead state with:Status Message: "Waiting for configuration sync."Heartbeat Data: FailedThe other FPCs are working normally.Current load-balance statusFortiGate-6000F (global) # diagnose load-balance status==========================================================================MBD SN: F6KF30T018900031  Primary FPC Blade: slot-1     Slot  1: FPC6KFT018900628       Status:Working   Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Good       Status Message:"Running"     Slot  2:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Failed       Status Message:"Waiting for configuration sync."     Slot  3:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data

Hello all, I am looking for some assistance regarding using AD groups in EMS policies. My scenario is as follows: I have created a security group for people allowed to use dropbox and configured the web filter and application filter appropriately. I have also created a security group to be allowed to use certain AI applications only and configured the filters appropriately. Based on what I have read is where I am hitting an issue: “Priority-Based Evaluation: EMS typically allows administrators to assign priority levels to different policies. If a user belongs to multiple groups (e.g., both "Standard Staff" and "Remote Workers"), EMS applies the configuration set by the policy with the highest priority.”If reading this correctly, if I am a member of both security groups, I will use the first policy I match with highest priority. So if I put the “allow dropbox” rule first that also blocks the AI Apps, I will not hit the “allow AI apps profile” that follows. Is there a way to control this

Hello,I have been trying to get into the FortiEDR Workflow, but I can’t seem to create or manage the Collector Groups in the FortiEDR Cloud with a FortiEndpoint license. I know that FortiEndpoint EDR is different from the normal FortiEDR, but I have not found a document which said you can’t manage Collector Groups with FortiEndpoint EDR. Even the Administrator Guide for FortiEndpoint does not mention that you can’t configure Collector Groups.

Hi,FortClient for Android asks for “Overlay permissions” when starting the App during initial setup. For ZEBRA Scanners there is an option to pre-grant this permission via OEMConfig: Enabling Display Over Other Apps Permission via MDM/EMM OEMConfigTherefore, the “Package Signing Certificate Fingerprint” of FortClient App is required. Can you please provide is with this? Since the APK isn’t available for public download, it cannot be extracted via ZEBRA’s SigTools utility by customers.Thanks!

Hi,I've been setting up alot of Forticlient with SSL-VPN but now when it's depricated I've need to set it up with IPSEC.When doing the SSL-VPN option we had the possibility to map different usergroups to different IP subnets with the "SSL-VPN Portals".Is there a way of doing this with IPSEC VPN?What I want to accomplish is to have Forticlient users connected to a central FG and that FG works as the HUB in a HUB n SPOKE topology.At the spokes be able to assign different firewall policys based on source IP subnet.

We are a 100% cloud-based org using M365. We are 85% Windows and 15% Mac. We use FortiClient EMS Cloud to manage/publish ZTNA and VPN connection profiles to users. We have the FortiClient EMS configured with Domain Authentication and connected to our Entra ID tenant. The appropriate groups are assigned, and registration is seamless and it works. I fully understand that Mac OS is very different and does not support  Entra ID authentication with EMS. The Fortinet EMS admin guide says, “FortiClient (macOS) does not support native Entra ID integration with EMS. For the integration to work, macOS endpoints must be managed by Intune or JAMF and enrolled to company portal using Entra ID.” Adding an Entra ID server | FortiClient 7.4.5 | Fortinet Document LibraryThat last sentence says it’s possible to use Entra ID integration for Macs. Our Mac machines are registered to Intune through JAMF PRO and enrolled to Company Portal. Domain Authentication will not work, and I know that. Which registrat

Rhino USA Promo Code JENY - Extra 10% Off Reliable Recovery Tools (2026)Looking for dependable recovery tools built for real off-road challenges? The Rhino USA Promo Code JENY unlocks Extra 10% OFF premium towing and recovery gear designed for durability, safety, and dependable performance. With rhinousainc.com, you can access heavy-duty straps, D-ring shackles, and tie-down systems engineered for tough recovery situations and long-lasting outdoor use. 🚙🔥⏳ Why Reliable Recovery Tools MatterWhen you're driving off-road or handling heavy towing tasks, having reliable equipment is essential. Low-quality tools can fail under pressure, but well-built recovery gear ensures safety and performance when it matters most.Here’s why Rhino USA gear stands out:Heavy-duty construction for demanding recovery jobs 🛠️ High-strength materials built for long-term durability 💪 Reliable performance in mud, sand, snow, and rough terrain 🚜 Weather-resistant design for outdoor conditions 🌧️ Trusted by of

We are working on replacing Aruba switches with FortiSwitches. We have HA firewalls and currently use a VLAN on the Aruba to pass the ISP link to the WAN ports on the firewalls. We've run into an issue at a couple of sites where the ISP device refuses to communicate with the FortiGate when passing through an unnumbered VLAN configured on the FortiLink connection.  If we put the Aruba back in, the WAN links can then talk to the ISP gateway again. It's only happened at a couple of our sites, so I suspect it's specific to certain brand ISP devices. At the first site it happened at, we resolved it by moving the WAN IP to the VLAN Interface under Fortilink and eliminated the uplinks to the WAN ports. At the current site we're working on, there are hundreds of IPSec tunnels and policies tied to the WAN interfaces, so moving to a VLAN interface under  FortiLink would be a time-consuming endeavor.  Any idea on what may be causing this?  

Hi,Recently we upgraded our FGT 200F from 7.4.7->7.6.4->7.6.6. In the new version we noticed that we lost Packets(sent/Received) and Errors(sent/received) FILTER options in FortiGate firmware version 7.6.6? we had this filter option in previous version 7.4.7.Can someone help/clarify why this happened, which we don't have any more this option and how we can add this feature back? I checked the known issue for 7.6.6 and changes in default behavior. Please find the attached photo which indicate that Packets(sent/Received) and Errors(sent/received) FILTER option disappeared.​​​​​Thanks in advance! 

Hello fellow networking folks,I'm curious if anyone has had to pivot from FortiClient with the new Remote Access VPN setup on 7.6.x since they are basically forcing everyone to purchase EMS. Unfortunately we have to ask for $$ from the higher ups so I wonder if anyone has used / knows of a good alternative. I know that there is a free version but it seems that it is in the process of being grandfather'd out 

I work for a school that is requesting us to block the Fornite game from being played. However it appears using the Web Filter and reclassifying the Epicgames.com URL only solves users from browsing to that website. I am trying to block the Fortnite game from connecting to the EpicGames servers, It appears they use Amazon Web services which seems to be tricky when blocking applications. I do see that Fortinet has Epic.Games listed as an Application finally. I have blocked this under application control, now half of the students that try to play cant and the other half still can. I'm new to this stuff so this has been a fun experience. Any one have any luck blocking this? If so what did you do to achieve this? 

Hi All, I have issue with F50G automatically upgrade to the latest patch 7.4.11 to 7.4.12 while the contract is expired.It keep sending Email with message “This installation is forced and cannot be cancelled”. It has failed to install multiple times and keeps rescheduling. I checked the system events, which show that the download failed. Do you have any ideas on how to fix this?I tried with this guide , and no lucks.https://docs.fortinet.com/document/fortigate/7.4.11/administration-guide/320693/required-firmware-upgrades-for-fortigate-appliances-with-invalid-support-contracts-or-that-have-reached-eoesDiagnose log:[989] fds_load_upg_matrix_map_img_id: Same major.minor: Patch 11 leads to Patch 12[999] fds_load_upg_matrix_map_img_id: Auto-upg chooses patch 7.4.12 (b2902)[1002] fds_load_upg_matrix_map_img_id: This upgrade will not be forced upgrade[989] fds_load_upg_matrix_map_img_id: Same major.minor: Patch 10 leads to Patch 12[1013] fds_load_upg_matrix_map_img_id: Auto-upgrade has chosen

Servus Community,I'm trying to add a FortiGate-VM HA cluster (A-P) running FortiOS 7.4.11 to a FortiManager VM running 7.4.11. Both FortiGate VMs and the FortiManager VM are running in evaluation/trial mode.The cluster itself is healthy and synchronized. Network connectivity is fine and TCP/541 is reachable. I have also enabled:config system global set fgfm-allow-vm enableendWhen I try to add the FortiGate to FortiManager, the device discovery fails with "Probe failed".After enabling FGFM debugging, I noticed that the TLS handshake actually completes successfully. The FortiGate then sends its authentication information including the serial number:serialno=FGVMEVO4T9J2-XXXAt that point FortiManager rejects the session and logs:serial number (FGVMEVO4T9J2-XXX) in 'get' message doesn't match the subject CN (FortiGate) in peer's certificate.I then checked the certificates on both HA members.Both nodes have the same Fortinet_Factory certificate:Subject:CN = FortiGateThe certificate fingerpr