Fortinet Community

Many internal systems are querying public DNS servers, but it’ll probably take a year before we can address off of these. Consequently, we are investigating if it’s possible to NAT all outbound queries to a pool of 4 different public DNS servers and use something like the health check monitor to ensure the servers are up. I see how to do this for a single public DNS, but I don’t see how to get all the way through the configuration. We’re using central NAT. Thank you.

Hi, i have installed FortiClient 7.4.3.4726, and configure vpn to connect in customer vpn, but the connection don’t works, i have bellow error:[2026-05-27 12:01:21.6932022 UTC-03:00] [12040:11004] [FortiVPN  2041   error] fortivpn::StateMachine::HandleTunnelConnectFailed session 1's (.\josan) vpn connection failed (reason: "Failed Unknown")[2026-05-27 12:01:21.6958494 UTC-03:00] [12040:11004] [FortiVPN  2370    info] fortivpn::StateMachine::HandleTunnelDisconnected "Agrex do Brasil LTDA" is disconnected.[2026-05-27 12:01:21.6968655 UTC-03:00] [12040:11004] [FortiVPN  2406    info] fortivpn::StateMachine::HandleTunnelDisconnected disconnection reason: 13, ("Failed Unknown")[2026-05-27 12:01:21.6968739 UTC-03:00] [12040:11004] [FortiVPN  2432   error] !!! fortivpn::StateMachine::HandleTunnelDisconnected session 1 (.\josan) "Agrex do Brasil LTDA" disconnected unexpectedly![2026-05-27 12:01:21.6973074 UTC-03:00] [12040:11004] [FortiVPN  2446    info] fortivpn::StateMachine::HandleTunnelDis

Hello,While configuring Administrator Profile Mappings on FortiNAC, I accidentally associated all administrator profiles, including local administrator accounts, with a limited “Device Manager” type profile group. Since this change, I no longer have Full Admin privileges.I only created a profile mapping, is there a way to delete this Administrator Profile Mapping from the CLI?I found the following CLI command that allows restoring a previous configuration backup:execute restore config local <backup_name>If I restore a backup taken before this misconfiguration, will it restore the previous administrator mappings and resolve the issue? best regards.

We are planning to migrate from SSL VPN to IPsec VPN using certificate-based (signature-only) authentication.Since the VPN will be used by both employees and contractors, we need to implement group-based policy controls similar to what we currently have with SSL VPN.I have configured the user peer with ldap-mode principal-name, which maps the certificate UPN to the LDAP user. This part is working as expected (if user is disabled, it won’t allow log in).However, I have not been able to get LDAP group-based matching working in firewall policies.I have 7.2.12 version at the moment, maybe newer version has this fixed?

I’m kind of at a loss as to how to make this work. I’m configuring a new FortiGate 90G, and what I’d like to do is connect a cable to an access port on my existing Dell network to a WAN port on the firewall, so it can get a DHCP IP, so I can register it. The problem is that I can’t get layer 1 to work at all. No link lights. I plug a PC into the same cable; it gets an IP just fine. The cable works. The Dell switch works. The FortiGate is brand new out of the box. I had the exact same issue when I was configuring my new 120G firewalls as well. Here’s something weird. I can connect a dumb unmanaged 5 port switch in between the Dell and the FortiGate, and everything connects and works perfectly fine. The firewall gets an IP perfectly fine. I disconnect the unmanaged switch, and go straight from the Dell to the FortiGate, and I get nothing. I’ve been on this for weeks, with no resolution, or even understanding, as to why this is happening. I’ve also tried putting a FortiSwitch inline betwe

We use captive portal for contractor and they should enter the entra id to connect to the network.We have some entra id group, example contractor_IT and contractor_SALES and each group have their own vlan.When the contractor authenticated successfully then the contractor still sit in isolation vlan and not changed to the respective vlan. My fnac vendor say when user authenticated thru entra id captive portal then fnac cannot bring entra group ID, is that true

I had automatic updates turned on on my fortigate 60F. After Installation of OS 7.4.12 none of my VPN-Clients were able to login anymore. No idea why. Reverting to 7.4.11 resolved the problem. Does anyone have an idea what exactly caused the problem? I am not an fortigate expert but that a minor update to the os breaks a basic functionality, at least on my device, doesnt make me happy. First thing i learned was turning off automatic updates. But thats not a longterm strategy.  

Is TPlink wireless controller (Omoda) can be managed by FNAC?

I have guest ssid on the cisco wlc9800 and if there are user want connect to this ssid then the user will authenticate by captive portal with entra id.After the authentication successfull the client should be move from isolation network to guest network, in my case the client was moved to guest network if i see from fortinac policy but the client itself still connect to isolation network.Already ask to cisco support then they said the cisco not receive the coa to change the vlan. Anyone know here how to change thje vlan to teh cisco wlc9800?

Hi all,Looking for input from anyone running FortiADC-220F in production. We are on a new active-passive HA deployment and we are seeing what looks like hardware-related problems on two different units, which is starting to worry us.Environment:- FortiADC-220F, HA active-passive- FortiADC OS 7.6.5- Brand-new deploymentWhat is happening on the original unit:- One node intermittently goes completely unresponsive — no GUI, no SSH, and the console is also dead (no output, no reaction to keystrokes)- Only a physical power-off / power-on recovers it- After the power-cycle it runs fine for around a day or more, then it freezes again the same way- This started showing up after we upgraded to 7.6.5, but we have not been able to confirm whether the upgrade is actually the triggerWhat happened with the RMA:- We opened a TAC case — no proper RCA so far- The RMA replacement unit Fortinet sent arrived faulty as wellQuestions for the community:1. Has anyone seen a similar complete freeze (including c

Hi ,I would like to ask for some clarification regarding Flow-Based Antivirus behavior and architecture on FortiGate.I reviewed the Administration Guide and several technical documents, but I could not find detailed explanations for some internal Flow AV processing behaviors.I would highly appreciate it if you could clarify the following points or provide any related technical documentation, KB articles, technical tips, or architecture references.In Flow-Based Antivirus mode, is there still a file size limit / oversize handling mechanism similar to Proxy-Based AV, or is the oversize behavior only applicable to Proxy mode? In Flow mode, when scanning large files, does FortiGate bypass scanning after reaching a specific internal threshold, or can it continue scanning regardless of file size? Does Flow-Based Antivirus use the same Antivirus databases (Normal / Extended / Extreme) as Proxy-Based AV, or does Flow mode use a different AV engine/database architecture? If Flow mode does not fu

Hi everyone, do you know if it's possible to downgrade FortiClient from 7.4.5 to 7.2.10 directly from ForticlientEMS v7.4.5?Unfortunately, a colleague of mine accidentally pushed the 7.4.5 update and now we lost compatibility with all our ikev1 vpn.Thanks

Why oh why does Fortinet make all this so difficult, it seems like they actually don't want people to even use the trials… I finally have a FortiGate trial VM and a FortiManager trial VM, but can I get them talking? No! Lots of commands that are no longer valid etc... FortiManager reports a probe fail, from online searches, I have tried lowering the encryption settings and allowing VM registration on the FortiManager. I have tried registering from the FortiGate side also.Now it transpires that my FortiGate trial VM does not have the right factory cert because it is does not contain the serial of the virtual appliance, just a generic "Fortinet". I have tried regenerating the certs, tried re-execting the VM commands but it does not accept them either… To be honest it feels like a battle just to make the trials work, which is hardly a good starting point.

Hi everyone,I need to upgrade a FortiGate-VM64 currently running FortiOS 7.0.19.Relevant output from get system status:Version: FortiGate-VM64 v7.0.19, build0696, 260129 (GA.M)License Status: ValidVM Resources: 2 CPU / 2 allowed, about 4 GB RAMCurrent HA mode: standaloneRelease Version Information: GAFortiOS x86-64: YesI also checked the active firmware image with diagnose sys flash list:Partition Image Active1 FGVM64-7.00-FW-build0696-260129 YesMy doubt is about the Fortinet Upgrade Path Tool.In the product list I see several similar VM options, such as:FortiGate-VMFortiGate-VM-KVMFortiGate-VM-HVFortiGate-VM-AWSFortiGate-VM-AZUREFortiOS-VMFortiOS-VM-HVFortiOS-VM-KVMFor this firewall, should I simply select FortiGate-VM in the Upgrade Path Tool?Also, for a manual upgrade, should the correct firmware image be from the FGT_VM64 family, for example:FGT_VM64-vX.X.X-buildXXXX-FORTINET.outThis one to be precise in this case:FGT_VM64-v7.2.13.M

Fabric contains a FortiGate cluster and managed FortiSwitches for internal and external purpose. Is there any solution to shut down all the devices from the downstream connected device such as a desktop. As per my understanding, the challenge is the FortiGate is the brain here. so I am facing a chicken and egg problem. Please let us know if there is a good solution for this. Thank you

Dear Technical Team,I am writing to report an issue regarding TightVNC connections established through FortiPAM when using a guest user account.Issue DescriptionWhen attempting to initiate a TightVNC session via FortiPAM using a configured guest user, the connection fails to establish. "connection has been gracefully closed".Normally we succeeded in web VNC. But we face issue while using TightVNC with guest user.Environment DetailsFortiPAM Version: 1.8Could you please assist in verifying if there are known bugs regarding guest user token lifetimes, or specific configuration policies required to allow guest access for VNC proxies in this firmware version?Looking forward to your guidance.Best regards,Dev Singh KhadayatSystem EngineerGrantha Networks Pvt Limited 

After a change in the provider of wan2, I try to login to the fortigate direct with the ip adres of it.I get the login page with user and password after that i get the token login screen. (wan 1 adres)But then nothing autersation error that is all.But i log in as always eff was logt in this morning but now…...nothingI really do not want to reset.If anybody got a id plz.BTW login with forticoud is also not working now

Hello everyone, We have been trying for weeks to establish a stable connection between two data centres. Our router is the Sophos Appliance and the remote site uses the Fortinet cluster. The connection is established successfully. Ping works, but then timeouts occur, meaning ping is no longer possible – for 2 minutes, then it works again for 30–40 minutes, then a timeout for approx. 10 minutes, then it works again for 30–40 minutes, then a timeout for approx. 20 minutes, and so on. We have established that Phase 2 seems to be causing the problem here during ‘re-keying’. We have already tried all possible settings here. Without success. Does anyone here have any idea what the problem might be, or has anyone perhaps encountered a similar scenario before? I would be grateful for any assistance. Peter

HiDue to the reduction in the maximum certificate lifetime, we need to frequently upload local certificates to FortiWeb in the future.My environment uses a true transparent proxy mode, can I change it to use Let's Encrypt? If I do so, the certificates used on FortiWeb and the real server will be different. Will this cause any connection issues?Or is there a way to upload a local certificate and have it automatically applied to all server pool members?Thanks.

Hi,we have such problem that fortigate fortios 7.4.11 is blocking copilot.microsoft.com the error we get in the browser is:net::ERR_CERT_AUTHORITY_INVALIDSubject: Fortiguard SDNS Blocked PageIssuer: Fortiguard SDNS Blocked PageWhat we did:1.in DNS profile --> static filter we created:- wildcard name *.microsoft.com and allowed it-allowed regex .*bing\.com-allowed regex .*trafficmanager\.net2.In the deep ssl inspection profile, we created the exempts:-wildcard *.microsoft.com-wildcard *.bing.com-*.trafficmanager.netBut all the time, this site is blocked by SDNS, any help?

Hello Fortinet team and community,I am looking to install FortiClient VPN version 7.0.12.0572. Could you please help me with the official download link for this release? Since this is a free VPN-only version, I would appreciate guidance on where I can access it directly from Fortinet’s site or repository.Thank you in advance for your support.

Creating a bridge SSID with dynamic VLAN assignment. So far so good. Two wireless clients in that network. For the first period (some minutes) everything works ok, but then arp requests for the 2 devices are not answered. Setup:-FG61E 6.4,-FAP221E 6.4- FGT and FAP are connected over hw-switch internal,- FGT has VLAN interfaces on internal defined Troubleshooting:brctl showmacs br.2020 - lists all 3 MACs and their interfacesping from FAP works in the first perioddiag_sniffer br.2020 none - shows the arp requests from FAP or from FGT default gateway, but is not answered.  Pinging from one WLAN Client to the other WLAN Client also seems to be affected, but sometimes it works for them but it does not work from FAP or FGT, or it works for all again for a period of time. Pinging IPv6 local-link addresses work without any issue? Last: If all WLAN Clients are put back into the standard Bridge SSID, this behavior does not happen.  Strange is also tha

Hi,I am using a personal account, as the company I work for has lost access to the forticloud portal. This is because we requested a transfer from the master account to another existing account.   The transfer was approved but it looks like something went wrong along the way.  Nobody within the company that had access can access the forticloud portal. So access to fortimailcloud, asset manage etc.  I have been emaling cs@fortinet.com but so far without any response.Can you some provide a procedure, a link, phone number I can call to rectify this?Advice will be greatly appreciatedKind regards 

Hi all, on our infrastructure we have a forti Manager on 7.4.10 version. We have multiples Fortigate on 7.4.11 release.We tried in different ways to set expiration date on Polici Packages but the feature does not work. Either on forti manager and fortigate firewalls. A collegue of us works for another company with the same infrastructure. Same issue. Does someone know if it is a known issue? I checked on documentation, and the issue was not mentioned.We also opened a ticket to Fortinet support. They did not know about the isue and they don’t know how to resolve it. Maybe updating to the last relase solve it? Thanks for your help