Fortinet Community

Hi, we are changing from SSL VPN to IPsec since our FG90G doesnt support in the next OS the SSl VPN. Right now we are testing with the IT department and I got feedback that the client closes the connection after x minutes, something that with SSL VPN never happened before. We are using unlicensed FortiClient, I dont know if we have option on the client with ALWAYS UP. Is there something we can change on the Remote IPSec configuration on the FG90, maybe Dead Peer Detection? We set it up with the wizzard. Thanks! 

Hello folks, Anyone can explain me what is going on and how to fix this pls!? I just connected 2 separate sites to Fortisase using Secure Private Access.BGP to Forti PoPs are established but the sites are not exchanging routes.Shouldn't the 2 sites reach each other through Forticloud? This is what i'm used to in Velo Cloud and Cato.I only have 2 sites, head office in Europe and another site in the USA. RegardsSaid

Hello Team,    I wanted to know if i have configured my fortigate firewall with source user accounts of user1, user2 and user3, and ip addr1, and ip addr2,and mac addr1, mac addr2, and mac addr3.How firewall will process the source match logic according to the source objects and type mentioned above User accounts, IP addresses, and mac addresses?TIA

I recently upgraded my computer to Windows 11 and since then my VPN has not worked. I uninstalled the previous version and upgraded to the latest, to no avail.I see it trying the connection on the Fortigate, but that's it. Below is the client log.11/26/2022 9:31:00 PM info ipsecvpn date=2022-11-26 time=21:30:59 logver=1 id=96566 type=securityevent subtype=ipsecvpn eventtype=status level=info uid=473E35B610DE464ABDxx5E9F5149E34C devid=FCT8003212200810 hostname=XXXXX pcdomain=N/A deviceip=192.168.0.41 devicemac=b0-XX-7a-72-XX-XX site=N/A fctver=7.0.7.0345 fgtserial=FCT8003212200810 emsserial=N/A os="Microsoft Windows 11 Professional Edition, 64-bit (build 22621)" user=Bryan msg="loc_ip=192.168.0.41 loc_port=500 rem_ip=00.000.00.165 rem_port=500 out_if=0 vpn_tunnel=REPLACED action=negotiate init=local mode=aggressive stage=1 dir=outbound status=success Initiator: sent 00.000.160.165 aggressive mode message #1 (OK)" vpntunnel=REPLACED11/26/2022 9:31:12 PM warning ipsecvpn date=2022-11

From the debug, we can see that there is no problem with the time on both sides. 

Hi, On PSIRT i have now seen a few posts now where the solution for a CVE is to update to FortiOs 7.2.12.For example: https://fortiguard.fortinet.com/psirt/FG-IR-25-026But version 7.2.12 does not exist. Or am i confused?  BR,Arnold 

hello everybody: I installed a virtual machine on my computer (Oracle Virtual Box) to run behavior tests on my network. I noticed that even though it's not loaded, it browses normally. I'd like to know how to prevent any machine running in a virtual machine from browsing. I've tried to detect the virtual machine by MAC or IP, but I can't. How can I block virtual machines? I searched the security profiles and only found VMware. Can you give me some ideas on what to do?Thank you very much.

Hi everyone, Looking for help with a strange API authentication issue on one specific FortiGate. Setup:25 FortiGate firewalls managed via automated backup scriptUsing API v2 endpoint: /api/v2/monitor/system/config/backup?scope=globalSame API user (BACKUP-SUPER_ADMIN) configured on all devicesProblem: One firewall (let's call it FW-TEST) consistently returns HTTP 401 Unauthorized, while the exact same script works perfectly on the other 24 devices. What I've tried:Regenerated API token multiple timesVerified user permissions (identical to working firewalls)Manual test with Postman: same 401 errorGUI login with same account: works fineCompared API settings between working and non-working FW: no differences foundQuestion: Has anyone encountered a situation where one FortiGate rejects API authentication while others with identical config work fine? Could there be hidden settings or firmware-specific quirks that affect API token validation? Using FortiOS version if you k

Hi,i want to replace my Windows 2019 RAS/VPN Server and the AlwaysOn VPN Setup.In this Setup, i define the VPN Tunnels in Intune. One Tunnel is a Device tunnel, the notebook can connect to a few servers only.This is used for remote administration and for a user logon, if the user new to the notebook. A Second Tunnel is for a User tunnel, after the notebook has established a Device tunnel and the user logon´s on, the user get´s his User tunnel. => After all, the machine has two VPN tunnels. Now, i create this VPN/IKev2 tunnels in FortiGate 120G (7.4.9) with help of these articles https://community.fortinet.com/t5/FortiGate/Technical-Tip-Windows-IKEv2-native-VPN-with-machine-certificate/ta-p/278825https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-vpn-with-user-certificate The notebook will connect after reboot with a Device tunnel.As soon the user logons on, Windows 11 gets the user tunnel up. An

I have MAC OS I get permission denied error through the forticlient console. The crdentials are correct and so the VPN settings such DG, port,etc...I tried connect through web too by enter the getway connected succesfully to the portal but "launchforti"button doesnt response

Hi, We are observing that traffic is being routed to the internet unexpectedly. To restore connectivity, we need to manually clear sessions each time, which is not normal behavior. What would be the root cause of why the traffic is being forwarded to the internet instead of the intended path. Suggest a permanent fix to avoid the need for manual session clearing. Expected Route: Port3Source: 10.1.17.0/24 & 10.1.24.0/23Destination: 10.201.0.0/16  Here is the sniffer. diagnose sniffer packet any "host 10.201.11.149" 4 0 1interfaces=[any]filters=[host 10.201.11.149]0.094933 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9780.151538 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9790.197107 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9800.200285 port3 in 10.202.11.149.5065 -> 10.1.24.78.5060: udp 9780.320295 port3 in 10.202.11.149.5065 -> 10.1.24.78.5060: udp 9760.381149 port3 in 10.201.11.149.5065 -> 10.1.24.78.5060: udp

I have to migrate configuration from two Fortigate 100F units in HA (active/passive), currently in production, to two new Fortigate 120G already purchased. In the configuration of the 100F units there are:15 IPSEC lan2lan vpn tunnelmany users (local) IPSEC dialup vpn (non-SSL) By loading the configuration file of the 100F into the 120G (after pre-configuring them), the shared secrets of the LAN2LAN VPNs, the passwords of dialup VPN users will be preserved or will they have to be reinserted again? Thanks for support.

In the sdwan what mean of 'failures before inactive' and 'restore link after'?Example if i set failure is 5, this mean sdwan will decided the link down if there are 5 consecutive sla target excedeed the threshold, or if there are 5 sla target above the threshold (non consecutive ) in the last 100 poll for packet loss? Also if the check interval set to 1000 ms and the protocol using ping this mean every second the fortigate will send only one icmp request to the server?

Currenlty i have alert to send sdwan health to the email by using this parameter     and i got this message date=2025-10-13 time=20:18:25 devid="FG1234567890" devname="FGT1" eventtime=1760361505429374908 tz="+0700" logid="0113022923" type="event" subtype="sdwan" level="notice" vd="Internet" logdesc="SDWAN status" eventtype="Health Check" healthcheck="teams.microsoft.com" slatargetid=1 member="11" msg="Member status changed. Member out-of-sla."  But that information is not enough, there is no information about which which SLA target was exceeds the threshold and what the the value of that time. Anyone know how to add that information?

Problem:I am experiencing an issue with my VPN connection using FortiClient. The connection successfully establishes, but it disconnects after 25-30 seconds.Symptoms:- After clicking "Connect," the VPN connection is established successfully.- Data traffic begins with approximately 35KB sent, but received traffic remains at 0KB.- After 25-30 seconds, the connection drops with the message "SSL VPN Connection is down."FortiClient Version:- FortiClient VPN Only 7.4.0.1658Logs:- sslvpndaemon_1_error.log: [2024-08-04 11:01:10.7069198 UTC+03:00] [12232:12956] [sslvpndaemon 540 error] CListener::_ReceiveMessage() Could not read from pipe(0x0000000000000544) client. Error=109 [2024-08-04 11:01:13.5362518 UTC+03:00] [12232:20528] [sslvpndaemon 569 error] CListener::_ReceiveMessage() ERROR_BROKEN_PIPE [2024-08-04 11:01:13.5363023 UTC+03:00] [12232:20528] [sslvpndaemon 590 error] CListener::_ReceiveMessage() ERROR_BROKEN_PIPE [2024-08-04 11:01:14.4208549 UTC+03:00] [12232:13988] [sslvpndaemon

I have been looking through the Fortimanager API documentation and there is a section mentioning running CLI commands against managed devices: https://how-to-fortimanager-api.readthedocs.io/en/latest/007_device_management/007_device_management.html#how-to-run-cli-commands-against-a-managed-device However, there is a warning message saying it is not yet supported and 'Caught in #1155085, #1072897 and #1133627.' I have tried it myself and get the same result as the example, so it definitely isn't working at the moment. I'm wondering if there is anywhere we can see where the progress of this is at- I have tried searching those aforementioned numbers which I assume are case tickets, but haven't found anything. It would be useful to have a timeframe on when this functionality might be made available.

Hi everyone! I have problem with content filtering which block PDF files with act.js  and obj.js  detected by Content Filter, filetype application/javascript filename obj.js Is any suggestions to prevent this? How to resolve problem with minimal security impact? 

H Everyone,One of our office users is experiencing an SSL VPN disconnection issue. After a successful login, the VPN disconnects automatically within 30 seconds.The FortiGate device is functioning as the VPN server and is running FortiOS version 7.2.11. The user is using FortiClient version 7.2.8 on a Windows 11 PC.Interestingly, the same user has another SSL VPN connection configured on the same laptop, and that connection is working fine.At this point, I also suspect the issue might be related to the user’s laptop.We are actively looking for a solution, so if you have encountered a similar issue before, your insights would be appreciated.Regards,Azarudeen

Dear Concern, Users are trying to access a website, but the website is not opening. Instead, a 'Website cannot be opened' page is displayed. I am unable to determine whether this issue is being caused by my FortiGate firewall blocking the site or if it is an issue on the ISP's end. Kindly guide me on how to troubleshoot whether the firewall is blocking the website or if the problem lies with the ISP. Please also provide troubleshooting steps and CLI commands to help resolve this issue. Additionally, I have allowed the website in the web filter under security using the FQDN type, but I am unsure whether the web filter policy is functioning correctly or how to verify it. Please explain this as well. Website: https://english.nmpa.gov.cn/     Please help me to troubleshoot the issue. I just want find that the issue is at my firewall end or ISP end.

Error message:/saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>__samld_sp_login_resp [826]: Failed to process response message. ret=-111(Failed to verify signature.)samld_send_common_reply [91]: Code: 1, id: 539, pid: 5739, len: 64, data_len 48samld_send_common_reply [99]: Attr: 22, 12,samld_send_common_reply [99]: Attr: 23, 36, Failed to verify signature.samld_send_common_reply [119]: Sent resp: 64, pid=5739, job_id=539.[5739:root:0]epoll saml recv resp error.[5740:root:216]Timeout for connection 0x7f7ebad000. My SAML IDP uses Casdoor, which is an open source identity authentication system. I made sure my certificate is the public key certificate imported from the Casdoor system.

Hi, Ive configured ipsec ikev2 for remote access vpn users (with radius group auth). The FortiClient VPN Only keeps prompting for token, even though MFA is not configured on FGT. The only workaround I've found so far is to reinstalling the FortiClient, which resolves the issue. Has anyone experienced a similar problem or found a permanent solution for this behavior?FGT 7.2.12 and 7.4.9FC 7.4.3.1761 and 7.4.3.1790

 Hello everyone,I ran into a tricky issue upgrading FortiClient EMS from 7.4.0 → 7.4.4. The installation failed with the following PostgreSQL / Sqitch error:  ERROR: insert or update on table "software" violates foreign key constraint "fk_software_software_icons" DETAIL: Key (icon_id, vdom_id)=(5800, 1) is not present in table "software_icons".  Even though the upgrade script tried to rollback, it left the DB in an inconsistent state. The installer log showed it reverted to version 7400 and aborted.Here’s how I resolved it::white_heavy_check_mark: Steps I tookConnect to the correct EMS databaseThe problem tables were in fcm_default, not fcm. sudo -u postgres psql fcm_default Check schema of software and software_iconsI confirmed software had icon_id and no vdom_id, and software_icons had id.Clear orphaned icon_id referencesI ran: UPDATE software SET icon_id = NULL WHERE icon_id IS NOT NULL AND icon_id NOT IN (SELECT id FROM software_icons); Verify no inval

We currently have a cisco FTD1140 as the main firewall but are now planning to add a Fortigate 100F in front, between the ISP and Cisco. Not exactly sure how to configure the IP's of the Fortigate 100F to allow traffic to passthrough. The Fortigate will serve as a filter in order to reduce the load on the Cisco. Any ideas on how to configure the Fortigate. Eventually we will setup the fortigate as SD-WAN. Here's a picture of what I believe it will look like. 

Hi, I've configured a ZTNA Server + Rule + Destination for RDP Session to a certain server.Therefore I configured a PROXY Port  which is then TCP Forwarding to Port 3389. Anyhow no RDP connection can be established.Any ideas? KR Chris

Just noticed that my setting of: # config system settings # set gui-object-colors enableDoesn't seem to enable per-interface changeable colors in 5.6.5 (FortiGate 300D and 100D). I can still set colors for the FortiSwitch VLAN interfaces. Anybody know if the functionality can be enabled somewhere else, or if this feature was dropped or is broken?