Fortinet Community

We are currently running FortiOS 7.4.12 on multiple FortiGate 200F and 400F HA clusters in a banking environment within the EU.Following Fortinet's recent recommendation to upgrade to FortiOS 7.4.13 or later, we are evaluating an accelerated upgrade plan and would like to gather feedback from engineers who have already completed this upgrade in production.Specifically, have you experienced any of the following after upgrading from 7.4.12 to 7.4.13 (or later 7.4.x releases)?HA synchronization issues Performance degradation Unexpected failovers or cluster instability GUI access problems Routing behavior changes (BGP/OSPF/static routing) IPSec VPN stability issues SSL-VPN related issues Policy installation or FortiManager interoperability issues FortiAnalyzer anomalies Any known bugs affecting FortiGate 200F or 400F platforms specificallyFor those who have already upgraded:What platform/model are you using? Standalone or HA? Any caveats observed during or after the upgrade? Would you cons

Any good automation or are we still hand drawing?What information do you refuse to put on the diagrams and want is absolutely critical?Auditors and leadership love bugging me for pretty diagrams and it kills me to hand drawing them.

Hello,I’m creating this Topic because I’m facing an issue that neither me, Dell or our Forticlient provider faced before and we both have no idea what exactly is going on. We ordered a batch of Dell Computer Pro 3 14260. Those computers are facing kernel boot trap double fault with fortishield.sys. It occurs most of the time when the computer is booting with Forticlient 7.2.15.1309, but also very often when connecting or disconnecting of Forticlient. We also tried with 7.2.14 and 7.2.13 with same issueOur EMS is in 7.2 so we can’t try 7.4 for now it’s ongoing we have to build a linux machine for the upgrade.We don’t have this problem with any other dell computer model Of course if I don’t have Forticlient installed I don’t have any issueI’m trying to compare the components for those computers and see what could be conflicting but extremely difficult  I just know it’s something with fortishield.sys as it is mentioned in the minidumps If anyone faces this (no result on forum search) or h

  our Fortigate 501E, no longer boots, the Power LED only lights up (no Status or Alarm), Serial communication is not possible (nothing comes up in putty with official ortigate 9600 8N1 cord whereas on a product similar to side communication is functional with the same parameters).   Not reset button but an NMI button. When pressing more than 60s as seen here NMI Button for Troubleshooting Kernel Iss... - Fortinet Community nothing happens.   Do you have any final ideas before resorting to Fortinet support?

Hello,Following a support ticket opened for managed FortiClient (EMS), we have managed to resolve an issue—by using a version (8.0.1 GA or later) that fixes the bug—which we were also encountering with the free, standalone FortiClient VPN client.The issue:On endpoints monitored by our SOC that have Bitdefender installed—specifically with its "anti-tampering" module enabled—alongside the FortiClient SSL VPN, the Bitdefender anti-tampering module isolates the device whenever the free FortiClient is updated, uninstalled, or installed. This effectively renders the device unusable.We opened a ticket with Bitdefender, and they informed us that the issue had already been reported to Fortinet.Is there a solution to this problem? We have already tried creating exceptions for FortiClient within the anti-malware console, but to no avail. Furthermore, support has stated that they cannot provide assistance for the free version of the client and have directed us to this forum:" Hello Francisco, N

Hello, team!Today we identified an FSA/RISK_HIGH detection involving Windows PowerShell files, specifically the Get-NetView.psm1 module.We are investigating this issue across three different customers, each with their own independent FortiClient EMS environment. So far, we have identified that the same files and SHA256 hashes are being detected across all three environments.Since the detections started occurring around the same time and across independent environments, we suspect this may be a false positive related to the FortiGuard detection database.We would like to check whether your team has already identified any similar incidents or if there have been any recent updates that could be causing this behavior.We have submitted the information for analysis and look forward to your feedback.Thank you!

Hello Everyone , I Hope Youre WellWe have several web services and APIs that are exposed via an FQDN (Fully Qualified Domain Name) rather than a pool of source server IP addresses. Could you help me understand how to configure a service in FortiWeb that uses an FQDN? Is it mandatory to configure a server pool?Thanks!!! 

Hello everyone,I need assistance with configuring FortiNAC guest self-registration to assign different VLANs based on the location of the Cisco access point.Environment:FortiNAC: Version 7.6.7, deployed at HQ. Cisco WLC: Catalyst C9800 running version 17.9.4a, deployed at HQ. Access Points: Deployed at both HQ and Site A. Guest SSID: Configured for FlexConnect, with local switching at Site A. FortiNAC: Guest self-registration and the relevant policies are already configured.Issue:I want guest clients connecting through APs at HQ to be assigned to the HQ guest registration and guest VLANs, while clients connecting through APs at Site A should be assigned to the corresponding Site A VLANs.Currently, when a guest connects through an AP at Site A and completes the self-registration process, FortiNAC assigns the client to the HQ guest VLAN. I have already created the necessary policies in FortiNAC, but I am unable to get the VLAN assignment to work correctly according to the AP's location.M

Dear Fortinet Team, In Fortiguard Lab, product “FortiOS” and “Fortimanager” are labelled as not affected. Could you please confirm whether these products are not impacted because the affected software/component is not present, or because the version in use is not vulnerable? Thank you for your assistance. PSIRT | FortiGuard Labs

Good day, everyone.I have been experiencing intermittent SPF false positives in **FortiMail 8.0.0**. In some cases, FortiMail reports that the sender's domain does not have an SPF record. However, after verifying the domain manually using both our internal DNS servers and public DNS servers, the SPF record is available and resolves correctly.I would like to know if there is any configuration or best practice that could help reduce these false positives. For example:* Is it possible to increase the DNS query timeout used by FortiMail?* Is it possible to adjust or reduce the DNS cache timeout?* Are there any recommended DNS-related settings for improving SPF validation reliability?One behavior I have noticed is that multiple emails from the same sender domain, received at nearly the same time, may produce different SPF results. Some messages pass SPF successfully, while others are rejected because FortiMail reports that no SPF record was found.Our environment consists of **two FortiMail

Hi,i open this form to understand a case on my FortiGate 7.2.10.This is the IPS attached to a firewall policy:config ips sensor    edit "IPS_WEB-Server"        set comment "Prevent critical attacks."        set replacemsg-group ''        set block-malicious-url disable        set scan-botnet-connections disable        set extended-log disable        config entries            edit 1                set location server                set severity medium high critical                set protocol TCP HTTP                set os all                set application all                set default-action all                set default-status all                unset last-modified                set status default                set log enable                set log-packet enable                set log-attack-context disable                set action default                set quarantine none            next        end  doing a test the following payload (via HTTP POST) is blocked as expected, tri

We are using IPsec VPN with SAML authentication integrated with Microsoft Entra ID. During the SAML authentication process in FortiClient, users receive a certificate warning: NET::ERR_CERT_AUTHORITY_INVALID.I understand that IPsec VPN itself does not necessarily require a public CA-signed certificate. However, since the SAML authentication flow relies on HTTPS communication between FortiClient, Microsoft Entra ID, and FortiGate, I would like to confirm:Can we replace the current certificate with a valid trusted certificate (for example, a public CA-signed certificate) to eliminate the certificate warning during SAML authentication? 

Dear Team, Could you please advise how we can identify the recommended releases for FortiEMS and FortiClient? Similar to FortiOS, FortiManager, and FortiAnalyzer, where Fortinet provides documentation specifying the recommended releases according to model number, is there a similar reference or official document for FortiEMS and FortiClient? 

Per https://www.fortiguard.com/psirt/FG-IR-26-165 we’re supposed to upgrade FortiClient.exe to 7.4.8, but the download links at https://links.fortinet.com/forticlient/win/vpnagent are only for 7.4.7 or lower. What gives? How are we supposed to remediate this if the links don’t work?

How can we register Fortinet devices under our client's Fortinet Support Portal account instead of our Partner Portal? Could you please share the registration procedure and required documentation?

Hi everyone,After upgrading our FortiGate 201E from 7.4.13High CPU to FortiOS 7.6.8, CPU utilization consistently increases to around 90%, with the httpsd process identified as the primary contributor.Restarting the httpsd daemon temporarily resolves the issue, but CPU utilization gradually increases again.Has anyone experienced the same issue after upgrading to FortiOS 7.6.8? Is this a known firmware bug, and are there any recommended workarounds or permanent solutions?Thank you for your help.

Hello everyone,I am experiencing an authentication issue with my FortiGate-VM64 running on VMware Workstation.System Information: Device: FortiGate-VM64 (Virtual Appliance) FortiOS Version: 7.6.8 Build: 3744 Virtualization Platform: VMware Workstation Deployment Type: Virtual Machine Physical Hardware: No physical FortiGate device is being used. This is a virtual lab environment. License Status: Invalid Description of the Problem:I can successfully log in to the FortiGate CLI through the VMware console using my administrator account and password. However, when I try to access the web-based GUI using the same credentials, I immediately receive the following error:"Authentication failure"The login page itself loads successfully, but authentication fails immediately after submitting the credentials.Additionally, when I try to change the administrator password through the CLI, the operation fails with the following error:"Command fail. Return code -30"Troubleshooting Steps Alre

In FortiManager, how do you create a single shared policy package that contains firewall policies only gets installed on a particular device? For example, I want firewall policy 1 only gets installed on device 1 and firewall policy 2 only gets installed on device2. Both firewall policies are in the same policy package. The installation targets seems to apply to the whole policy package. Help!

Dear Community, since the upgrade to FortiClient 7.4.8 we have the following problem: For example some User’s use Miro Boards (miro.com). The page works normally but when you open any Miro Board it just loads infinite. When checking the Console it says: “Websocket connection to wss://miro.com/rtc-gateway/mux?client_auth_user_id=CENSORED failed”. We previously had 7.4.4 which just worked fine. Also it works when connected to the VPN or connected to the company network. because then the integrated Webfilter from FortiClient disables itself. So the Network Team made an exclusion for all Miro Domains but it still didn’t fix the problem sadly. And when I disable on my Mac the FortiClientProxy Network Extension it immediately works. Does anybody have problems like this with the new version? I just can’t seem to be able to fix that issue and it’s driving me insane because else the new version is a blessing. Much faster surfing and generally better speed. We use FortiClient EMS for centralized

We have two Fortigate 40F running FortiOS 7.6.8 in A/P HAno dedicated management interface. no ha-direct.Requirement is to poll individual cluster membersusing authenticated and encrypted SNMPv3.Polling cluster IP works.Now I used the “management-ip” feature and configured the LAN Interfaces witha cluster IP and different management-IPs.config system interface    edit "lan1"        ...        set ip 172.16.42.1 255.255.255.0        set management-ip 172.16.42.2 255.255.255.0                         ##  ( 172.16.42.3 on secondary machine)        set allowaccess ping https ssh snmp…With that setup I can accessthe currently active machine using 172.16.42.1 the primary     machine using 172.16.42.2 the secondary machine using 172.16.42.3with pings, https and ssh separately without issues.At the moment,only the snmpd on the active machine answer to queries to IP 172.16.42.1What is needed to make SNMPv3 polling to 172.16.42.2 and 172.16.42.3 work ? 

We are currently in the process of transitioning from SSL VPN to IPSEC VPN, while maintaining certificate-based user authentication. For the IKEv2 VPN between a FortiGate (ver. 7.4.13) and a native Windows client, we are using a RADIUS/NPS server for authentication. The question is: how can we define multiple user groups on the RADIUS server for the same tunnel, allowing us to create distinct firewall policies for different user groups? If we configure a global RADIUS user group (`set authusrgrp "RADIUS"`) in the Phase 1 settings, define a vendor-specific attribute for each group on the NPS, and specify a group with that name as the source in a firewall policy, the users from that group fail to authenticate—or rather, their traffic does not match the policy. Conversely, if we remove the `authusrgrp` setting from the Phase 1 configuration, the tunnel cannot be established. Is there a way to differentiate user groups via NPS?

Hi all,I wanted to see monthly traffic on my FortiWiFi-40F at home, and that grew into a full NetFlow analyzer. Since people here ask about third-party collectors from time to time, I would like to share it and hear what is missing for FortiGate users.  What it shows:  - Traffic by host, service, country and interface, with conversations and new conversations  - Path analysis: how traffic moves through your network  - Application names, if Application Control is on the firewall policies (a monitor-only profile is enough)  - Security events, PDF reports by e-mail, AD/LDAP sign-in and an API  The free Community edition has every feature and two limits: 5,000 flows/s and 30 days of history. A license only raises those limits.  This is the configuration on my 40F (FortiOS 7.4.13):  config system netflow      set active-flow-timeout 60      config collectors          edit 1              set collector-ip <COLLECTOR_IP>              set source-ip <FW_LAN_IP>          next      end

Our municipality and affiliated public institutions have invested in Fortinet equipment and solutions for over a decade. It is extremely disappointing that a mature product branch has been left with a serious, reproducible regression affecting essential public services.Technical details: OS: Windows 11 Pro 25H2 and 26H2 Product: FortiClient VPN-only (IPsec) Affected builds: 7.4.3.4726 and 7.4.3.6002 (probably all versions from ~7.4.1?) Steps: Connect FortiClient IPsec → disconnect → attempt Windows native L2TP/IPsec VPN. Result: Windows VPN fails with RAS errors 789/791. Confirmed workaround: Restarting the Windows IKEEXT service immediately restores connectivity. Network routing and adapter states appear normal after disconnect. This issue has been publicly reported since at least February 17, 2025, with no confirmed permanent fix. Even the latest security-maintenance build, 7.4.3.6002, still reproduces it.Related reports: Feb 17, 2025: https://community.fortinet.com/suppo

Our ZTNA setup suddenly stopped working, possibly after an EMS Cloud update. Everything was working fine before...Setup: FortiGate 200F HA – FortiOS 7.2.14 EMS Cloud 7.4.8 (build 2245) FortiClient Windows 7.4.8 All ZTNA connections fail with No end-point info found, but the actual issue seems to be somewhere between FCNACD and WAD.EMS is connected and verified, WebSocket is up, and the FortiGate receives endpoint UIDs, certificates and ZTNA tags.We've already collected FCNACD and WAD debug logs. Here's what we're seeing:FCNACD:ZTNA record: Exists: true, Complete: falseZTNA record is incompleteMandatory field "mac" absentError updating primary macWAD:DevQueryResp code=NoEntrydev resp is nok:1dev resp tid=0, rsp=(nil)dev tag matching, info=(nil), tag_cnt=0POLICY DENIEDWAD queries by UID and IP also return Response termination due to no more data.Interestingly, the EMS API (/api/v1/report/fct/sysinfo) returns incomplete endpoint data, missing fields like user_name, fct_ver and fct_bui

Hello,I found strange issue with FAC in Azure (from marketplace).When I am trying to do a rollback, using disks created from snapshots (OS and Date), FAC VM doesn’t start.There is an error:“Failed to start virtual machine 'fac-vm-azure'. Error: Creating a virtual machine from a non-Marketplace image does not need Plan information. Please remove the Plan information from VM”And there is no way to fix it (I tried many ways suggested by Copilot etc.).What is the solution for creating a backup (and successful rollback) for FAC in Azure ?Regards,Krzysztof