Fortinet Community

Hello everyone,We need to replace our Sophos UTM and were thinking of doing so with Fortinet systems.Since we use quite a few Sophos UTM services, I'm wondering which Forti system I can use to map which services, or whether it's even possible to map all services.Here are the “services” I need to provide: Network ProtectionFirewallIPSVPN: IPSec / SSLReporting Email ProtectionEmail receptionVirus protectionEmail encryptionSpam protection (Quarantine , daily SPAM-report) Web ProtectionWeb-ProxyVirus protectionHTTPS-ScanningWebserver ProtectionWAF (Web Application Firewall) for On-Premise Exchange OWA access GeneralActive-Passive ClusterAD synchronizationReportingIs it possible to deploy all services with Fortinet?

Can a realm be set up with a virtual host name (so that the certificate I use for VPN will match the URL set in FortiClient) for SSL VPN?  I found the virtual host under Config vpn ssl web realm.  Is this only for web based VPN connections?

I am looking to implement client side certificates to our SSL VPN.  Does this set up require each client to have their own individual cert or can I use a common cert for users?

Afternoon all,  I have a Fortigate 91G running on 7.4.7 presently as it's still running SSO SSL VPN, linked to EntraID for SAML.With the SSL VPN being deprecated on later versions for this unit, we are trying to migrate to dial-in IPSec VPN but am being given the restriction of using certificates instead of the PSK to implement this.So, is it possible to implement a dial-in IPSec that links to EntraID for SAML, but doesn't require the PSK, and allows me to use a certificate instead?I have so far managed to get the Forticlient to connect and you see the Phase1/Phase2 tunnels on Status/Networks/IPSec but no traffic fails to flow over it.  Forticlient is stuck during the connection phase as well, not displaying the counter and details like it would when connected successfully. Feels like there's a disconnect between the PKI configured and SAML authentication systems, which may be the issue.Sanitised Phase 1 configuration in use---------------------------------config vp

Hi all, I've been working with support on this without any success so far (and they've confirmed all the setup is correct) but I'm trying to move from SSL VPN to IPSEC and have setup SAML with EntraID and this works fine when using the Apple App on iPads but I cannot get it going on a Windows machine. When I try to connect it prompts me to log into Azure and then says "you have successfully logged in" but that window just stays there and the FortiClient just shows as "Disconnect" but it's not actually connected whereas on the iPads it does the Azure bit and then that window disappears and the VPN starts to connect.I've tried it with Windows 10 and 11 and also server 2016 and also with various versions of FortiClient and although I can see the SAML connecting in the logs on the FortiGate there is nothing after that i.e. it doesn't then start to connect the VPN, it's as though whatever should happen after that just doesn't happen.I've got a feeling this is more of a Microsoft thing

Hello I couldn't find any examples with debian linux strongswan using swanctl.conf on the forums, the only examples I've found are for ipsec.conf. Here is what I know we are using: 1. FortiClient VPN -> IPsec VPN2. Pre-Shared Key3. XAuthHere is my non-working strongswan swanctl.conf:connections { thecompanyvpn { remote_addrs = sa.company.com version = 1 aggressive = yes proposals = aes256-sha256-modp1536 local { auth = psk id = "Tunnel-A" } remote { auth = psk } local-xauth { auth = xauth eap_id = worker1 } children { child_1 { start_action = start esp_proposals = aes256-sha256-modp1536 } } } } secrets { ike-company { secret = "our preshared key" } eap-employee { id = worker1 secret = "my secret password" } }This is the logs:Oct 08 21:22:04 nova charon-systemd[116776]: parsed TRANSACTION request 853593004 [ HASH CPRQ(X_TYPE X_USER X_PWD) ] Oct 08 21:22:04 nova charon-systemd[116776]: no XAuth password found

Hello.I have launched the EMS server.Test users are logging in and everything is OK.The problem is as follows: after preparing the VPN client distribution, the system sends an emailto recipients inviting them to download the client and register in EMS.  The issue is that when clicking the link to download ie. Windows FC  [https://myserver.com/installers/default/VPN-Client/FortiClientSetup_7.4.4_x64.exe] the page displays Not Found. The requested resource was not found on this server.The registration link works, the client retrieves the settings and registers in EMS. The problem occurs even in Deployment & Installers. When clicking the download link, it does not download but instead shows the message: Not Found . The requested resource was not found on this server.     What should be done to enable the download? Thank you for your help. 

FortiGate OS 7.4.8 Windows 11 Pro | FortiClient is up to date FortiSASE configurationWe have a handful of users who are unable to stay connected on the VPN while connected to iPhone hotspots. FortiClient will connect, then drop after a few minutes and then reconnect and again drop (loop behaviour). The VPN is stable on fixed (non-mobile) network connections.Anyone know why this happens or has a workaround?

Hi all,I have previously used SSL VPN with SAML auth and users have been assigned ip addressing from specific ranges. I have set up a proof of concept with IPSec VPN and am looking to do the same thing.I understand you can reference a user group in the phase 1 settings of the IPSec VPN, but am struggling to make this work with different user groups on different phase 1 tunnels. Also to mention each user group should have a unique ip range and should not share the range on 1 tunnel.Any ideas please?

Does FortiADC has support for OpenAPI 3.1 ? I see Swagger 2.0 and OpenAPI 3.0 are supported but what about 3.1 and 3.5?

Although we have had Fortigates for over four years now, I had the pleasure to ask for an RMA recently.Went well, got the device quickly, replaced it, when I went to print the return label it said I have to pay for shipping the device back. I don’t know about you guys, but I have never seen this with any other vendor. It really caught me by surprise.I don’t have access to a company card, they are really not common here, so for me, as just a network engineer, it means that I have to pay for shipping put of my pocket. We pay Fortinet around 20k/year for support, how can they not cover this?The only solution I got from their support was to change our contract to RMA Plus and we could then keep the broken devices (to do what with them?).It really left such a bitter taste. I will for sure propose to change vendors in the next upgrade cycle, arguing that Fortinet is not serious enough.

HiIs there any way to add a secondary radius server on Fortimail 400F running code 7.2.6, for Admin authentication?Thanks in advance. 

Hello everyone,I'm requesting your assistance and suggestions regarding the type of IPsec tunnels.In a hub and spoke architecture configured in ADVPN mode, we need to size the central hub that will be deployed within the hub.Each spoke connects and initiates communication with the hub in VPN dial-up mode to subsequently enable spoke-to-spoke communication.Are all of these tunnels destined for the hub considered site-to-site or client-to-site VPN tunnels in Fortinet terminology? Thanks for your assistance Regards

Hi, I'm trying to configure an IPSEC VPN dial-up with saml and fido2 (yubikey) using the External Browser as User-agent for SAML Login option - it's not working. It works for SSLVPN, but not for IPSEC. The client version is 7.2.12. Could it be that it's not working? It works without problems using credentials via Microsoft Authenticator with the External Browser as User-agent for SAML Login option disabled, but when I enable it and use the FIDO2 key method, the browser displays a message that I've logged in, but the tunnel doesn't establish. The tunnel is configured based on ike2 with the networkid parameter. Has anyone else encountered this problem?Regards 

Hi Guys,I need to migrate from 600E (HA A/P) to 200G (HA A/P). I created a FortiConverter service today and mapped only the up interfaces but did not select the HA interface (only ports 1-7). The other ports are down on the 600E.I already configured the new 200G pair as HA A/P. I want to know what will happen when I restore the FortiConverter config file? If I don't choose to copy the HA settings there, will it destroy the current HA on the 200G??Please advise!Thanks,

Hi, does anyone experience problems with the FCT webfilter and Chrome/Edge v144 (in Beta until jan/2026)?Either with FCT version 7.2.8 and 7.4.4, web traffic gets blocked....  Note: the issue seems to be EMS 7.4.4 related

Dear Concern, I have purches VON/ZTNA on premise deployment and it is working fine standalone. But I want to need HA configure, at the moment required another license or existing one is enough. How to configure HA any suggestion.We have purchased FortiClient VPN/ZTNA (on-premises) deployment, and it is currently working fine in standalone mode.Now we are planning to configure High Availability (HA) and would like clarification on the following: 1. Licensing:Is an additional license required for HA, orCan the existing license be used for both primary and secondary nodes? 2. HA Configuration:What is the recommended HA architecture for on-prem VPN/ZTNA?Any best-practice guidelines or official documentation for configuring HA? Any suggestions or real-world experience would be highly appreciated.Thank you in advance. ForticlientEMS os version: 7.4.4 #FortiClient #FortiEms @support 

Which firmware version of 7.4.x is not going to support SSL VPN?

I'm trying to create a Local-In policy on a member interface of the SD-WAN (virtual-wan-link), but when selecting the source interface, i get the error on the right side. I don't have the option to select port1 from the list as its one of two member of the virtual-wan-link group.  Tried this in both GUI and CLI. Running 7.6.5. Any ideas on how to apply this policy to a member interface of an SD-WAN group?WAN group. 

Hi all,I manage a network with FortiGate firewalls running firmware versions 7.0.15 and 7.4.4. I have attempted several methods to block access to YouTube Shorts:Used youtube.com/shorts, youtube.com/shorts*, youtube.com/shorts*. *.youtube.com/shorts*, and *youtube.com/shorts* with wildcards in both Content and URL Filters.Attempted to block *.shorts* in the DNS filter.Despite these efforts, I can still not effectively block YouTube Shorts content. What is the recommended and most effective approach to achieving this using both URL and Content Filters, ensuring that only YouTube Shorts content is blocked without impacting other aspects of YouTube usage? Any detailed guidance or specific configuration examples would be greatly appreciated. Thank you in advance for your assistance!

Does anyone know what is the server specs for Forti collector ????? i cannot find any document that says its requires OS ... CPU...Memory any thing ??

We are trying to get detailed information for where our users are going.  Say we have a user that goes to their facebook page and then to the company facebook page and then back to their own.  The detailed "User Detailed Browsing Log" only says they went to facebook.com.  Is there a way to see more details that might show if they are doing company business or personal?

Hello, we are trying to get SCEP certificate enrollment working between FortiAuthenticator and Google MDM (mobile device management).We will push out a Google MDM wifi profile to all mobile devices requesting a SCEP certificate from FortiAuthenticator. It is not working for us and there is very little (if any) documentation on this.Has anyone got FAC SCEP working with an MDM of any kind ?Thank you kindly.

hi,i got a brand new FGT and it got a default OS 7.4.8M.i need to downgrade to 7.2.10M to be consistent in our environment.per checking the upgrade path tool, it is a direct path.since this is a brand new chassis with no config yet, can i safely downgrade directly from 7.4.8M > 7.2.10M?  

Hello, I’m looking to confirm if there’s a way (and I believe there probably is) to limit the number of authentication attempts for regular FortiMail (in server mode) users (local users), not administrators. Essentially, I want to apply something like a temporary lockout: for example if a user fails authentication 5 times, their login should be blocked for about a minute (or any configurable time) before they can try again.Does FortiMail support this for end-users? If yes, where can I configure it? Kind regards,