Fortinet Community

Good day all. I have been able to setup captive portal with email collection using FAP and FGT, but now, due to "security" stuff. I need to change the mode from email collection to something with OTP. Does anyone knows a guide or where can I find information on how to setup the captive portal so the Fortigate sends OTP to the email using email collection?Like, a client comes to the site, connects to the wifi, and from there I want the fgt to send an otp so the client can login.or this kind of setup is too complicated and I should look towaards using authentication with otp only?

Today I encountered an issue. I am using FortiClient EMS, and I installed FortiClient on my servers to be able to use the AV MW SB profiles.However, the following happened.When I connect using the user1 account I used to install FortiClient, there is no problem. However, when user2 RDPs to the same server, the EMS Telemetry connection automatically disconnects and redirects to the invitation code entry page.I found a case related to this issue on the Fortinet community, as linked below.https://community.fortinet.com/t5/Support-Forum/FortiClient-on-RDS-Server/td-p/395858However, I didn't understand how to configure it. Could you help me?

In the last few days the access to my firm VPN dosesn't succeed. I log to VPN trough SSO method. Initially it seems all works fine ( credential correct, MFA accepted ...) but at the end I will receiv this dialog:  I am on updated Windows using client fortinet  7.4.2.1737

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's. In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this.  I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too.  Looking for some suggestions on how to tackle this one?Denny    

Hello Community,When FortiNAC is in proxy mode, the PC authenticates successfully but the IP phone MAB requests are always forwarded to Radius Server and rejected.I  tried to create an authentication policy to override this behavior and force local MAB authentication on FortiNAC, but it did not work.Is it possible to handle MAB locally while FortiNAC is running in proxy mode?

Hello, We have two questions:Is there a guide to make virtual IPs work on SSL VPN interfaces?May hairpin NAT work using secondary IP interfaces?We are trying to make hairpin NAT work on 3000F. Any help will be much appreciated. We followed this KB on hairpin NAT (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448#M2442). Our use case is similar to Example 1. Campus1 (VPN / LAN IPs) --- FW (WAN IPs) -- internalServer (VIP). At the FortiGate side, the VPN tunnels land on an SSL interface (ssl.root); ssl.root is defined on a WAN interface (port35). Two firewall policies are defined:a NAT ingress rule, from ssl.root to port35, allowing internal users (VPN admin pool) to reach the virtual IP (defined as destination address object) balancing on an internal server.an egress rule, from port35 to a DMZ, allowing the NAT'ed requests to reach the load balancer virtual IP.This translates into these policies: # show firewa

Hi guys, Is there any way to restore FortiClient VPN profile automatically on computers in my domain with powershell script or bat file?We are using FortiClient v5.2.6 and need to update to v7.2.2.I have a backup profile made with FortiClient v7.2.2, and I want to restore the profile on computers in my domain.I have nearly 1000 computers in my domain, so I can't just restore the profile manually.Thank you in advance for your help. current version: FortiClient v5.2.6new version:FortiClient v7.2.2 (The VPN-only version)

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:FortiGate-120G HardwareI am looking for advice and community experience regarding the possibility of implementing a port knocking mechanism on a FortiGate firewall.My goal is to restrict access to specific services and dynamically allow connections only after a predefined sequence of connection attempts (port knocking).I have reviewed the official documentation and forum discussions, but I would appreciate clarification from those with hands-on experience:1. Is native port knocking supported on FortiGate?Scenario:• 4 ports in a specific sequence• 2–3 seconds timeout between each attempt• Final goal: open a real port (e.g. SSH, RDP, Web) only for that IPStep-by-step process1️. Initial state• The firewall completely blocks the real port (e.g. SSH 22).• It only listens for connection attempts on the knocking ports.Example ports:• Port 1 → 4000• Port 2 → 5000• P

Hi all, I have a FG80 with Automatic updates enabled. Last Saturday it upgraded from version v7.6.2 build3462 to version v7.6.5 build3651 (Mature).Almost everything works fine but our vpn clients (using IPSec VPN) can no longer connect.Normally they connect and will get the question to provide the MFA token but that no longer comes.After a few minutes they will get the error "Connection was terminated unexpectedly.". In de Logs I see:IPsec phase 1 error with:ActionnegotiateStatusnegotiate_errorReasonpeer SA proposal not match local policy a reason "peer SA proposal not match local policy"andProgress IPsec phase 1 with:ActionnegotiateStatusfailureResultERROR  Clients are macOS devices running FortiClient VPN 7.4.3.1761. I have already tested it with MFA disabled and that makes no difference.And yes I have also rebooted the Fortigate. Anyone else experiencing this problem and somebody found fix for it? RgdsRob 

Is it possible to block DoH (DNS over HTTPS) without using deep packet inspection? This would be for a guest network, so devices cannot be configured with the cert needed for DPI to function. 

Has anyone successfully setup FortiToken Mobile Push authentication with an IPsec VPN.  It works fine with a SSL VPN connection, but when using an IPsec VPN connection, you receive the push request, but Approving/Denying the request from the FortiToken app does nothing.  You are still able to login by providing the token manually (if you enter it BEFORE choosing Accept/Deny), but this behavior is confusing and a pain for our users.  Is it simply not supported by FortiNet yet?  It worked without issue with our older Cisco/DUO setup.  We are on the latest FortiClient 7.06 (doesn't work with previous versions either) and connecting to a FortiGate running FortiOS 7.06.  I see in the release notes for the newest FortiOS vs 7.2 that having ftm-push enabled does not allow IPsec VPNs to connect at all, so I don't want to update to 7.2 at this point. Thanks!

■Customer Environment・FortiGate 400E・PC1 (RDP executor)・PC2 (RDP receiver) ※Both PCs are windows 10.※The firmware for the fortigate400E is v7.2.5. Also, the FortiClient firmware is v7.0.7.※SSL-VPN connection is used.※A policy has been added to allow communication from the internal segment to the VPN terminal segment. ■InquiryI want to make an RDP connection from inside the company to a remote access terminal outside the company.However, when I RDP from an in-house terminal(PC1) to a remote access terminal(PC2), the FortiClient disconnects.The forticlient notice states that the tunnel "SSL-VPN connection" has been disconnected because another user has logged in to this computer.The screen on the PC1 side showed the RDP screen, but remained dark. I would like to know why forticlient disconnects when I do RDP. If anyone knows the cause of this, please let me know. FortiGate  FortiClient  

Newbie here with Fortinet/Fortigate. We recently upgraded our firmware to 7.49. Are there any instructions/advice on how to change our static IP (ISP paid service) to a free / low cost DNS service? I'm very new with DNS also. An IT tech set up 4 offices for a family member with Fortigates somewhat unnecessarily, in that they never used a separate firewall device for 10 years - has since been unreachable, and I am trying to learn on the go to assist the family member in lowering running costs where possible i/e cancelling her static ip's if possible.   Additionally, the tech had set up 2-3 workstation cloud backups at each of the 4 locations. Could someone please advise what settings in a Fortigate 60e/f I'd need to make so each of the 4 offices could see a shared network folder?   Many thanks, AJ

I installed the FortiGate VM and im experiencing issues when logging in for the first time. After entering the username=admin and then entering the password. The FortiGate prompt for the password to be changed. It prompts for a new password and then just after entering the password the Prompt doesn't go to Confirm Password it instead skips and prompts for a new password again. The system does not allow me to confirm the password. Any idea?  FortiGate-VM64-KVM login: admin                                                                                    &nbsp

All my Android clients running FortiClient VPN 7.4.3 (ipsec/ikev1 + psk + xauth connection type) are unable to connect to my FortiGate after upgrading it's OS from 7.6.4 to 7.6.5.The client fails with "could not estabilish session on ipsec deamon" message. Using "diag debug app ike -1", I can see that phase 1 is completed, user authenticated, tunnel is up (visible on firewall ipsec monitor, but 0 bytes), but phase 2 is never completed. After "negotiation result" is ok and a few lines more, it says: ike V=root:0:VPN-IPSEC_6: tunnel up event assigned address 10.201.109.168ike V=root:0:VPN-IPSEC_6: EMS: FCT UID not ready then the firewall starts a loop of "retransmission" (R-U-THERE/R-U-THERE-ACK), until the client quits.Nothing was changed on the firewall except the OS update.Testing with other clients (not FortiClient) everything works fine.Any idea on the cause/solution?

Hi, I have an issue with use of VRFs.I configured the FGT like descriped in the following instruction: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/752950 The FGT has two IPsec tunnels, one for primary and one as backup.All traffic has to go through the tunnels, which means there are two default routes with exit interfaces of the VPNs.If I don't use VRF routing, I have to route each specific IP addresse or range e.g. IP of the peer, LDAP or TACACS+ servers and so on via WAN interfaces...So I configured a VRF for the customer intranet, which contains tunnel interfaces and LAN.The other VRF is for the two WAN interfaces primary and secondary. At the end I have multiple (default) routes:- two default routes through the tunnels in VRF1 (different AD)- two default routes through the physical WAN interfaces in default VRF (different AD)- two blackhole routes for each VRFconfig router staticedit 1set device "VPN-RZ"set comment "VRF=1"nextedit 2set dis

What are some of the ways you can place rogue hosts in a isolation vlan ? I know that you can choose a managed switchport and set the port to Forced Remediation/Registration/Default. But that doesn't seem scalable. What happens if a rogue host shows up on a port that is set to "Role Based Access".  In my case, it doesn't pass a Device Profiling Rule so it's just connected, potentially on a production vlan. I would like to create a User/Host Profile that identifies a rogue, and a corresponding NAC Policy to move it to the desired isolation/registration VLAN.  Any ideas ?

I need the installer for the las version of Forticlient VPN 7.0.x (for Windows and MacOS). Is there anywhere I can find it? I've seen some posts within this community that contained a link, but they were all expired. 

Hi , Fortinet Community, I want to install Fortiweb 600F in my Client Infra. I want to install it in Reverse Proxy Mode. Client Network design is this1. Server->Distribution->Core Switches->FortiWeb->Fortigate FW-> ISP Internet + MPLS Links Client has multiple branch offices in country hospital which run erp/web applications from remote locations which will be sitting behind Fortiweb.  Please suggest me either reverse proxy mode is perfect for it?And Suggest what will be network topology and subnets/VIPS.Lets Suppose my server form is using 20.20.20.0/24 subnet and Fortigate firewall working as edge firewall running 10.10.10.0/24 subnet.needs experts and seniors help. Kindly suggest better approach. Can be vips subnet different, how it will route , how other traffic will route, currently gateways of servers configured upon fortigate firewall 

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:1. FortiGate-120G Hardware2. FortiSwitch-1048E4. FortiSwitch-148F-FPOE5. FortiAP-234FWhat concerns me is that, for some of the offices, the only available option for a SSTP VPN tunnel is, due to the fact that the providers block our other VPN solutions.From forums, documentation, and various sources, it is stated everywhere that SSTP cannot be used.Is it true that it is not possible to use SSTP at all?The other question is whether it is possible to control Layer 2 traffic between computers.By this I mean: if one computer attempts to attack another computer, and both are connected to the same switch, is there an integrated tool on the switch that would allow me to detect and block such an attack?Thank you in advance for your time.

Hello Fortinet Community,I Am experiencing an issue with Security Posture Tags on FortiClient EMS Cloud.Environment:FortiClient EMS CloudVersion: 7.4.4 build 2034 (Feature)Client OS: Windows 11Feature tested: Security Posture TagsTag type: OS VersionRule configured:OS Version = Windows 11 (Latest update within 30 days)Issue description:The posture tag is not applied consistently.Sometimes the rule is correctly evaluated and matched, but shortly after, the same endpoint becomes non-matched, even though the system remains compliant (Windows 11 fully up to date).  Tag is matchedTag is not matchedObservations:The endpoint remains compliant (Windows 11 + recent updates)The tag Is sometimes matched, then later not matched without any OS change (always)Questions:Is this a known issue or bug in EMS Cloud 7.4.4?Is There any workaround or recommended fix?Are there specific EMS or FortiClient settings that should be adjusted?Thank you in advance for your help and feedback.

Hello everyone,I noticed today that our EMS sends the message "ZTNA Certificate signed" to all registered clients every 10 minutes. We do not have ZTNA installed and we have not activated it on the clients. Is it because the feature was also installed? Or is there any way to avoid the "spam notification"? Regards.

So, I am having the following issue:I just recently had 2 offices merge in another state and when they brought over the VOIP devices they now have the following issues.- Call will ring and someone will pick it up and it will keep ringing.- Call will jump from one persons phone to another.- Calls will constantly drop voice data (at a very specific time around 11am to 1pm est)We have talked to our provider and they have claimed up and down that it is our network ( issue never happened until we merged these two office locations physically). I talked with some of their support and they asked for a pcap when the issue was happening, but now they are saying that the pcap does not contain "SIP or UTP" data. Is there any way to filter this on the FortiGate 60E? Any Help is appreciated!

Hi all,Regarding the newly published CVE-2025-62631 (https://www.fortiguard.com/psirt/FG-IR-25-411), I was unable to find any information about a fixed release for FortiOS 7.2.x. Not sure whether a fix for 7.2.x branch is planned, and if so, when it is expected to be released?

hi all,may i know the difference creating new vlink with this method compare to using vlan. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-new-npu-vlink-for-NP7-model/ta-p/302817 is there any limitation or things to note when creating new vlink with this method ?thank you.