Fortinet Community

 I’m having an ongoing issue with FortiClient VPN on my Mac that only affects my device, even though my configuration matches my colleagues who use the same Wi-Fi network.Here is the issue:I can connect to Fortinet VPN successfully.After some time (even while I’m actively working and the laptop is fully awake), the VPN disconnects automatically.The Mac does not go to sleep, and the Wi-Fi connection stays up.My colleagues using the same network and same VPN configuration do not experience any disconnects.I checked macOS power settings, disabled sleep, and verified network keepalive options — the issue still happens. Even after reinstalling macOS and fortinet to latest version, the problem persists.(FortiClient VPN-only free version)I extracted the FortiClient logs and noticed a repeating pattern: WM_USER_PIPEMSG_VPN_DISCONNECTED failed to load currentvpn ssl_state=0 defaultTunnel=null

I have a four voice FVC – 70 D running the latest firmware build V5.2.5 build 95. I’ve successfully added phones, which are the fortiphone 375, and the phones generally work. However, for some reason, in the extensions when I try to modify the additional settings, including the preferences, call handling, voicemail, and most importantly, key appearances, all of those fields are greyed out, and I cannot edit them.

I have bought a FortiConverter license. I am trying to migrate from 301E to 201G. I am trying to remap some ports via FortiConverter, but i dont see an edit option. What should I do to remap the ports as required?  

We are using FortiNAC Pro (v7.6.5) with an agent installed on a test device (Windows 10 / Persistent Agent) that collects the applications. We marked one application as Untrusted, but the host is not being isolated. Port groups for quarantine are correctly set. What needs to be configured so that the host is automatically isolated when an Untrusted application is detected and the administrator receives a notification.Any guidance on the required policy settings or integration steps would be appreciated.

Hi all, I need to use Forticlient VPN ver 7.2.4, but cannot find else where. how can i get its .deb file for installation?

I am currently working on an educational lab My objective is to integrate a fgt 7.0.12 with a fgm 7.4.8.The recommended step-by-step procedure and CLI commands to add the FortiGate to FortiManager

Good afternoon, gentleman,I'm starting my journey with FortiGate and I'm trying to learn how to set up a IPSec Tunnel Client-to-site VPN with StrongsWan and FortiGate.I made these configurations is a test environment with a FortiGate, but i can't get the connection up with my Linux Mint.Could someone please describe the correct script to insert into /etc/ipsec.conf.d/forti.conf and /etc/ipsec.conf.d/secrets? 

 FortiGate-40F # diagnose debug flow filter saddr 192.168.1.111FortiGate-40F # diagnose debug flow filter daddr 223.6.6.6FortiGate-40F # diagnose debug console timestamp enableFortiGate-40F # diagnose debug flow show function-name enableFortiGate-40F # diagnose debug flow show iprope enableFortiGate-40F # diagnose debug enableFortiGate-40F # diagnose debug flow trace start 20  FortiGate-40F # 2024-09-23 11:35:44 id=65308 trace_id=44 func=print_pkt_detail line=5903 msg="vd-root:0 received a packet(proto=1, 192.168.1.111:1->223.6.6.6:2048) tun_id=0.0.0.0 from lan. type=8, code=0, id=1, seq=15."2024-09-23 11:35:44 id=65308 trace_id=44 func=init_ip_session_common line=6096 msg="allocate a new session-00021434"2024-09-23 11:35:44 id=65308 trace_id=44 func=iprope_dnat_check line=5521 msg="in-[lan], out-[]"2024-09-23 11:35:44 id=65308 trace_id=44 func=iprope_dnat_tree_check line=836 msg="len=0"2024-09-23 11:35:44 id=65308 trace_id=44 func=iprope_dnat_check line=5546 msg="res

I wanted to check with the community whether this statement is technically and officially correct as per Fortinet product design. During a recent discussion with Fortinet TAC, we were informed of the following: “ FortiClient EMS does not disable any third-party or running antivirus software by default. If required, the third-party antivirus must be disabled manually or via Active Directory Group Policy.” Specifically, I am looking for help to understand: As per Microsoft documentation, when a supported third-party antivirus is installed and registered correctly, Defender should automatically move to Passive mode. Is this the expected behavior with FortiClient? If Defender is manually disabled via GPO and FortiClient is not installed properly or becomes unhealthy, would that leave the endpoint without active AV protection? Can anyone please share official Fortinet documentation or KB links that describe the supported and recommended approach? Any guida

Hello, My FortiAuthenticator HTTPS certificate is close to expiring. I generated a new certificate with the same configuration and imported it through the Local Services console. The old certificate was automatically replaced by the new one, but I can see that the Web GUI is still using the old certificate. I cleaned the browser cache, i tried with the incognito browser mode but nothing works, i also waiting for one but still use the old certificate. I would also like to know whether this certificate has any impact on EAP WiFi authentication or any other FortiAuthenticator components. Thank you.

Hello, The Default-Server-Certificate expiration will expire in 5 days. We use FAC for WIFI EAP-TLS and VPN MFA. I can see that the certificat is used in LDAP service, OAuth service and maybe in other services. It is safe to keep using this certificate after the expiration, or should i renew it ? i wanna also the impact if i renew the certificate.   

Hi ,        i am using FortiGate 60 F firewall, i am facing an issue some of users Ip getting Ban in fortigate after this users are unbale to access internet . 

Hi is anyone have try Fortiswitch Stack on 7.6.2 (Not MCLAG) https://docs.fortinet.com/document/fortiswitch/7.6.2/fortiswitch-stacking-deployment-guide/383494/introduction I want to use FS648 as core switch, Is it better to use Fortiswitch stack or MCLAG?The Fortiswitch will be used as Gateway for VLAN, OSPF Routing ( i have advance license) if using MCLAG i need to use VRRP will consume 3 IP at least, but i dont see much documentation or review for Fortiswitch stack

Hi, I did a less-than-thorough search on the web, but was wondering if Fortinet has plans to integrate Wireguard VPN in their Fortigates?  We've all had some sports with IPSEC tunnels that drop and never come back - might be time to embrace the future. :)  Thanks! 

Hello Everyone,  We are migrating from Fortinet Antivirus to another product. This is the scenario: On our endpoint we do have FortiClient installed with both Antivirus and VPN SSL components (not managed with EMS) we want to keep the VPN functionalities but we need to disable the Antivirus component. Is there a way to interact with CLI in order to disable the Fortinet Antivirus? I've been looking for this kind of solution but I can't find anything useful. Thanks in advance

Hi everyone, after updating our FortiAnalyzer from 7.4.3 to 7.6.0 i noticed that our FortiGates 400F stopped displaying the Summary Tab under Log&Report.The FortiGate is still on 7.4.3 Has anyone else noticed this behavior?   

Dear all,  we configured SSL VPN - on windows laptops/tablets and on android tablets it is working, BUT on ipad devices in the authentication step (when user writes microsoft credentials) session is terminating and it is repeating in every sign-in attempts.  authentication is going through Microsoft sign-in client version - 7.4.10.0196 

We are currently running a Meraki MX84 in a university library.There are about 50 APs behind it and around 150–1000 wireless clients depending on time.MX84 seems a bit undersized for peak hours.We’re thinking about moving to a FortiGate F-series, but budget is tight.What model would make sense in this kind of environment?Any real-world experience would be appreciated-

I have two ISPs: Tata and Airtel, and I am able to establish an IPsec VPN with each ISP individually. Additionally, I have an APNIC IP pool (x.x.x.0/24) allocated to our company, and this same IP pool is being advertised by both ISPs.I've set up a loopback interface on the firewall with the IP address x.x.x.1/255.255.255.0, and named it BGP-pool. Now, I want to create an IPsec VPN over the BGP-pool interface, so that the IPsec VPN users do not experience interruptions if one ISP goes down.To clarify, BGP is functioning correctly, meaning if ISP1 goes down, the traffic is automatically rerouted to ISP2, and vice versa.I am using a Fortigate 600F running OS 7.4.9, and FortiClient version 7.4.3 with Hotfix 1.8758.Could someone please advise on how to achieve this setup.

Can we hide some of firewall policy from GUI?

Hello everyone, is anyone experiencing issues with FortiClient 7.4.5?After the update, ZTNA TCP forwarding using a wildcard stopped working. For example: if I have a destination set to google.com, it works normally. But if I use *.google.com and try to access pictures.google.com, the site returns ERR_CONNECTION_TIMED_OUT.In version 7.4.4 everything works fine. The configuration on the FortiGate remains the same, and it is resolving names normally.

Hello Fortinet Community Team, We are facing an issue while trying to block Google Search AI Mode (google.ai) on a FortiGate firewall. Scenario: - We have blocked the domain google.ai using a Web Filter profile.- The domain appears to be blocked successfully when accessed directly. Issue: - When users open google.com and perform a search, the Google AI Mode option still appears in the search bar/taskbar.- Users are able to access and use Google AI Mode even though google.ai is blocked.- The blocking is not working completely when traffic is coming via google.com. Requirement:We want to fully block Google Search AI Mode, including: - AI Mode access from google.com- Any backend domains or applications related to Google AI Search Request:Kindly suggest: - The correct domains, URLs, or FortiGuard categories to block- Whether Application Control signatures are required- Any specific SSL inspection or DNS filter configuration needed Regards,V

I am using the FortiGate VM version and found that the built-in FortiLink is unable to connect to the FortiSwitch, consistently showing as offline. Could you please advise on how to resolve this issue? thanks!

Hello everyone,I'm having an issue with installing EMS HA with PostgreSQL HA using Bitnami Docker. I followed the installation guide, but I encountered an installation error at step 4.b.ii, as shown in the attached image.Has anyone faced this issue before and can help me resolve it?OS: Ubuntu 24.04 LTSEMS: 7.4.3https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/109604/installing-ems-ha-with-postgres-ha-using-bitnami-docker Thanks.Unpacking python3.10 virtual envusing provided predefined_allowed_hosts2025-04-23T17:50:17.553Z INFO installutils/installutils.go:211 Start installutils2025-04-23T17:50:17.553Z INFO installutils/installutils.go:381 UpdateEMSInstanceID(), installdir=/opt/forticlientems/conf2025-04-23T17:50:17.553Z DEBUG installutils/installutils.go:1004 goEMS.conf path = /opt/forticlientems/conf/goEMS.conf, connector.conf path = /opt/forticlientems/conf/connector.conf2025-04-23T17:50:17.588Z DEBUG manager/pqdb.go:160 Initializing first connection

Is the program that resolves the vulnerability [CWE-427] identified in IR Number FG-IR-25-685 included in FortiClientVPN 7.4.3?