Fortinet Community

I am using the FortiGate VM version and found that the built-in FortiLink is unable to connect to the FortiSwitch, consistently showing as offline. Could you please advise on how to resolve this issue? thanks!

Hello everyone,I'm having an issue with installing EMS HA with PostgreSQL HA using Bitnami Docker. I followed the installation guide, but I encountered an installation error at step 4.b.ii, as shown in the attached image.Has anyone faced this issue before and can help me resolve it?OS: Ubuntu 24.04 LTSEMS: 7.4.3https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/109604/installing-ems-ha-with-postgres-ha-using-bitnami-docker Thanks.Unpacking python3.10 virtual envusing provided predefined_allowed_hosts2025-04-23T17:50:17.553Z INFO installutils/installutils.go:211 Start installutils2025-04-23T17:50:17.553Z INFO installutils/installutils.go:381 UpdateEMSInstanceID(), installdir=/opt/forticlientems/conf2025-04-23T17:50:17.553Z DEBUG installutils/installutils.go:1004 goEMS.conf path = /opt/forticlientems/conf/goEMS.conf, connector.conf path = /opt/forticlientems/conf/connector.conf2025-04-23T17:50:17.588Z DEBUG manager/pqdb.go:160 Initializing first connection

Is the program that resolves the vulnerability [CWE-427] identified in IR Number FG-IR-25-685 included in FortiClientVPN 7.4.3?

Had Fortigate set to automatic firmware updates. On Dec 11th, last update did three things that no update should do: Changed password settings. Automatically turned on 12 character complex password with no authorization.Disabled AP's from connecting to Fortigate. Manually had to authorized.And the most damaging was to change the IPSec parameters.  Could not remotely connect to even diagnose what was going on. Change the DH Group setting for both Phase 1 and Phase 2 to 14, 20 and 21.The default DH Group when creating a IPSec connection in Forticlient is 5 which is what we were using. Why are you changing my routers settings without my consent? And changing integral settings so as to render VPN connections useless. It took four days to figure out what was going on. Unacceptable in my opinion. It is my hardware. It is my configuration. At least ask me to make those changes for security reasons.

Current Limitation ObservedIn FortiWeb 7.4.11 deployment operating in reverse proxy mode, TLS protocol and cipher suite configuration appears to be global across all protected applications.Operational ChallengeOur goal is to enforce strong TLS protocols and cipher suites on a per-application basis, following a phased rollout approach:Apply strong TLS and cipher suites to one applicationValidate client compatibility and application behaviorIf no issues are observed, roll out the same controls to additional applicationsHowever, because TLS cipher and protocol enforcement is global, any change immediately impacts all applications protected by FortiWeb. This prevents us from safely testing TLS hardening on a single application before expanding enforcement.This is especially challenging in environments where:Multiple applications have different legacy dependenciesSome applications cannot immediately support modern TLSA global change introduces risk of unintended service disruptionClari

When i have dual ISP, let say ISP-A and ISP-B then which ISP will be used for forti DDNS source?

Hi, I'm currently studying for the NSE4 exam in version 7.6. I'm studying by reading the documentation and testing it on Fortigate (I have the opportunity to use this knowledge at work). How did you study for the exam and pass it?

Have a customer that self manages their Fortinet 200F. They recently upgraded to 7.4.8 and have a server plugged directly into one of the ports on the device. They do some lite web hosting on that server and it was super fast until they upgraded. After the upgrade the port 80 and 443 performance has gone into the tank. Fortigate support remoted in and did iperf tests on about traffic and got speeds as expected so they closed the case.Anyone have any good tips/places they can look at to see why performance for inbound port forwarding and tanked?

Hallo, ich habe in Azure bzw. in meiner Fortigate (7.2.10) ein site2site VPN ipsec erstellt. Ich habe auch eine Connection laut Protokoll haben die Policys auch eine Verbindung. Ich habe dann eine virtuelle Maschine erstellt, diese mit einer NSG eingerichet und dann eine Verbindung zu meiner Domain bekommen. Somit war der Rechner Mitglied meiner Domäne. Ich hatte Zugriff auf Laufwerke und Ping usw. ging ohne Probleme. Nach einem Update der Fortigate auf 7.2.12 geht nun kein Ping mehr und ich bekomme keine Verbindung! Weiß jemand um Rat

Have a customer that self manages their Fortinet 200F. They recently upgraded to 7.4.8 and have a server plugged directly into one of the ports on the device. They do some lite web hosting on that server and it was super fast until they upgraded. After the upgrade the port 80 and 443 performance has gone into the tank. Fortigate support remoted in and did iperf tests on about traffic and got speeds as expected so they closed the case.Anyone have any good tips/places they can look at to see why performance for inbound port forwarding and tanked?

Hi all. I am using Trial copy for version of 7.2.0 running on both Forti Manager and FortiGate NGFW. I am trying to test a Single Hub topology, have created three Normalized Interfaces "LOCAL_LAN_INT"MPLS_INT and INET_INT" having per device mapping to Port2,3 and 4. I believe have done the correct configuration but getting the error as shown below for HUB Device "error :131 - datasrc invalid. object: vpn ipsec phase1-interface.VPN1:interface. solution: datasrc invalid I guess it's trying to fetch this value from "VPN Manager" which is empty, any help will be much appreciated.Someone told me the issue is fixed in Version 7.2.1    

Hey forum. Real life issues has risen in our short time with fortigate and IPsec.Boss man had issues connecting to the VPN while at a car dealer. Tried on the old ssl Palo Alto and connected right away.How is the issue of many places block IPsec traffic? I think we had our marketing guy get blocked at hotel but he didn’t complain until he came back.

I connected the FortiAP (FortiAP-FP431F) to the lan, and the firewall is a FortiGate VM (v7.4.9 build2829 (Mature)). I found that the FortiAP can obtain an IP address from the DHCP LAN port of the firewall, but the FortiAP device is not discovered in the WiFi controller's "Managed FortiAP" menu. What could be the issue, and how can it be resolved?

Good day all. I have been able to setup captive portal with email collection using FAP and FGT, but now, due to "security" stuff. I need to change the mode from email collection to something with OTP. Does anyone knows a guide or where can I find information on how to setup the captive portal so the Fortigate sends OTP to the email using email collection?Like, a client comes to the site, connects to the wifi, and from there I want the fgt to send an otp so the client can login.or this kind of setup is too complicated and I should look towaards using authentication with otp only?

Today I encountered an issue. I am using FortiClient EMS, and I installed FortiClient on my servers to be able to use the AV MW SB profiles.However, the following happened.When I connect using the user1 account I used to install FortiClient, there is no problem. However, when user2 RDPs to the same server, the EMS Telemetry connection automatically disconnects and redirects to the invitation code entry page.I found a case related to this issue on the Fortinet community, as linked below.https://community.fortinet.com/t5/Support-Forum/FortiClient-on-RDS-Server/td-p/395858However, I didn't understand how to configure it. Could you help me?

In the last few days the access to my firm VPN dosesn't succeed. I log to VPN trough SSO method. Initially it seems all works fine ( credential correct, MFA accepted ...) but at the end I will receiv this dialog:  I am on updated Windows using client fortinet  7.4.2.1737

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's. In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this.  I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too.  Looking for some suggestions on how to tackle this one?Denny    

Hello Community,When FortiNAC is in proxy mode, the PC authenticates successfully but the IP phone MAB requests are always forwarded to Radius Server and rejected.I  tried to create an authentication policy to override this behavior and force local MAB authentication on FortiNAC, but it did not work.Is it possible to handle MAB locally while FortiNAC is running in proxy mode?

Hello, We have two questions:Is there a guide to make virtual IPs work on SSL VPN interfaces?May hairpin NAT work using secondary IP interfaces?We are trying to make hairpin NAT work on 3000F. Any help will be much appreciated. We followed this KB on hairpin NAT (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448#M2442). Our use case is similar to Example 1. Campus1 (VPN / LAN IPs) --- FW (WAN IPs) -- internalServer (VIP). At the FortiGate side, the VPN tunnels land on an SSL interface (ssl.root); ssl.root is defined on a WAN interface (port35). Two firewall policies are defined:a NAT ingress rule, from ssl.root to port35, allowing internal users (VPN admin pool) to reach the virtual IP (defined as destination address object) balancing on an internal server.an egress rule, from port35 to a DMZ, allowing the NAT'ed requests to reach the load balancer virtual IP.This translates into these policies: # show firewa

Hi guys, Is there any way to restore FortiClient VPN profile automatically on computers in my domain with powershell script or bat file?We are using FortiClient v5.2.6 and need to update to v7.2.2.I have a backup profile made with FortiClient v7.2.2, and I want to restore the profile on computers in my domain.I have nearly 1000 computers in my domain, so I can't just restore the profile manually.Thank you in advance for your help. current version: FortiClient v5.2.6new version:FortiClient v7.2.2 (The VPN-only version)

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:FortiGate-120G HardwareI am looking for advice and community experience regarding the possibility of implementing a port knocking mechanism on a FortiGate firewall.My goal is to restrict access to specific services and dynamically allow connections only after a predefined sequence of connection attempts (port knocking).I have reviewed the official documentation and forum discussions, but I would appreciate clarification from those with hands-on experience:1. Is native port knocking supported on FortiGate?Scenario:• 4 ports in a specific sequence• 2–3 seconds timeout between each attempt• Final goal: open a real port (e.g. SSH, RDP, Web) only for that IPStep-by-step process1️. Initial state• The firewall completely blocks the real port (e.g. SSH 22).• It only listens for connection attempts on the knocking ports.Example ports:• Port 1 → 4000• Port 2 → 5000• P

Hi all, I have a FG80 with Automatic updates enabled. Last Saturday it upgraded from version v7.6.2 build3462 to version v7.6.5 build3651 (Mature).Almost everything works fine but our vpn clients (using IPSec VPN) can no longer connect.Normally they connect and will get the question to provide the MFA token but that no longer comes.After a few minutes they will get the error "Connection was terminated unexpectedly.". In de Logs I see:IPsec phase 1 error with:ActionnegotiateStatusnegotiate_errorReasonpeer SA proposal not match local policy a reason "peer SA proposal not match local policy"andProgress IPsec phase 1 with:ActionnegotiateStatusfailureResultERROR  Clients are macOS devices running FortiClient VPN 7.4.3.1761. I have already tested it with MFA disabled and that makes no difference.And yes I have also rebooted the Fortigate. Anyone else experiencing this problem and somebody found fix for it? RgdsRob 

Is it possible to block DoH (DNS over HTTPS) without using deep packet inspection? This would be for a guest network, so devices cannot be configured with the cert needed for DPI to function. 

Has anyone successfully setup FortiToken Mobile Push authentication with an IPsec VPN.  It works fine with a SSL VPN connection, but when using an IPsec VPN connection, you receive the push request, but Approving/Denying the request from the FortiToken app does nothing.  You are still able to login by providing the token manually (if you enter it BEFORE choosing Accept/Deny), but this behavior is confusing and a pain for our users.  Is it simply not supported by FortiNet yet?  It worked without issue with our older Cisco/DUO setup.  We are on the latest FortiClient 7.06 (doesn't work with previous versions either) and connecting to a FortiGate running FortiOS 7.06.  I see in the release notes for the newest FortiOS vs 7.2 that having ftm-push enabled does not allow IPsec VPNs to connect at all, so I don't want to update to 7.2 at this point. Thanks!

■Customer Environment・FortiGate 400E・PC1 (RDP executor)・PC2 (RDP receiver) ※Both PCs are windows 10.※The firmware for the fortigate400E is v7.2.5. Also, the FortiClient firmware is v7.0.7.※SSL-VPN connection is used.※A policy has been added to allow communication from the internal segment to the VPN terminal segment. ■InquiryI want to make an RDP connection from inside the company to a remote access terminal outside the company.However, when I RDP from an in-house terminal(PC1) to a remote access terminal(PC2), the FortiClient disconnects.The forticlient notice states that the tunnel "SSL-VPN connection" has been disconnected because another user has logged in to this computer.The screen on the PC1 side showed the RDP screen, but remained dark. I would like to know why forticlient disconnects when I do RDP. If anyone knows the cause of this, please let me know. FortiGate  FortiClient