Fortinet Community

I have about 150 computers that are very rarely directly connected to the internal network and connect to the central office via VPN.I am implementing ZTNA connections instead of VPN. Is there a way for a client computer to retrieve GPO policies from AD through ZTNA? When I was using VPN, this problem did not exist.I managed to solve SMB login by installing KDCPROXY, but I don't know how to handle GPO refresh?I use Forticlient EMS 7.2.x

Hi All,I'm working on a business continuity project.My goal is to have a 2nd datacenter where I replicate the Virtual Machines. I'm trying to find the best solution for the network.AS IS:Right now all the buildings and department are connected to the HQ1.The datacenter is in HQ1.DPT-1 is phisically located next to HQ1.DPT-2 is phisically located next to HQ2.Building-3 is phisically separated from HQ1 and HQ1.All the routing is done by Fortigate cluster in HQ1HQ2 at the moment has only a switch that connect that part of the network to HQ1 where the datacenter is located. The link is with a single private fiber link that pass under a street.All the vlan are spreaded across the network and divided by function not by department (es client vlan, server vlan etc) TO BE:I have to avoid interruption caused by fiber issues. We'll replace the current fortigates in HQ-1 with a cluster of 121G.We'll add a cluster of 121G in HQ2.We'll add a new ISP link in HQ2.We can add radio link f

My request : Configuration convert Fortigate 100E to 70FI use this site.https://service.forticonverter.com/https://convert.fortinet.com/forticonverter/index.html"3 Interface Mapping " > "Hardware Switch" I can't click next step because it has 'Unmapped interface' .'Hardware switch' has two space , but three options .Please help me avoid it . 

I plugged my new 50G in before going away for a week. Everything seemed fine in the 24 hours prior to me leaving. When I got back, it seems there are issues, and I notice about 12 hours ago, I was upgraded to 7.4.9 from 7.4.8. It's like there is an MTU mismatch, but I have my WAN set to DHCP and it's auto selected 1500, so I think that looks fine.Are there any other issues that might cause packet loss or intermittent internet issues, esp on wireless devices (connected to the Fortigate by TPLINK AP's).Sorry, it's a bit vague, this is definitely new behaviour since either the switch to the 50G from my 60F (brand new install) or since the deployment of 7.4.9 by Fortinet.TIA for any ideas.

Hey, I customized the pages and save it but it hasn't been affected. I still see the default pages when I get blocked messages. Do I need to do anything else?

We currently have two sites, Site A and Site B, with identical destinations defined over separate VPN tunnels. Each site has a separate SNAT range using different IP addresses, so they know which location/route to send traffic back to. Both of our firewalls are setup as Central SNAT, and they are running 7.4.6. We're about to implement a new solution that requires us to change the destination IP range at Site B, so that the new system can check each path for dropped packets, latency, etc., and then it will send the traffic over the best path. For example, our internal host 192.168.1.1 currently sends to VendorA host 192.168.2.55. Traffic to VendorA is advertised exactly the same to both of our sites, but SiteA is the preferred site. SiteB will only be used if SiteA goes down. This won't work with the new system. What we need to do is to keep the destination for VendorA going out SiteA as 192.168.2.55, but we need to change the VendorA subnet going out SiteB as 192.168.3.55. I

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager? Your answer is very much appreciated :) Thanks in advance <3

We have just upgraded our 100F from 7.0.17 to 7.4.9 with 7.0 going end of support.It upgraded to 7.2 and then to 7.4 Everything seems to work fine with the exception of FortiAnalyzer Cloud. It's refusing to connect and send logs. We did upgrade the FAZ from 7.4 to 7.6.4 however it hasn't seemed to make any difference and both versions seem to support our Fortigate version. I have also removed the device and re-added it to FA Cloud still with no luck.  There's no access issues that I know of # exec ping fortianalyzer.forticloud.comPING fortianalyzer.forticloud.com.geo.fortinet.net (154.52.2.161): 56 data bytes64 bytes from 154.52.2.161: icmp_seq=0 ttl=52 time=20.6 ms64 bytes from 154.52.2.161: icmp_seq=1 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=2 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=3 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=4 ttl=52 time=20.5 ms--- fortianalyzer.forticloud.com.geo.fortinet.net ping statistics ---5 pac

Hello, i got an issue with user's licence on my ems, I should have one license for each user but for some of them I have, for example, "licensed 2 verified 1" and also if I go in the unverified user section I cannot find the same user between them. I'll attach some pictures for better understanding.Thank You

Hi, I have been trying to access the training portal for some hours. I tried login with master account, did not work, sub-user, did not work. I even created different account. I am using my own FortiCloud account. By the way this worked yesterday. Anyone else experiencing this issue?Thanks in advance 

Title - self explanatory.  

I have two VDOMs (excluding root / global). 1 is called VDOM_TP which is the VDOM configured in transparent mode and the other is VDOM_ROUTER. For this case I will not be referring to VDOM_ROUTED. I have an SNMP server which needs to receive SNMP traffic from my firewall. I have added the same management IP which I configured when making my firewall transparent.I am able to use the same management ip for https and ssh and although I have enabled snmp on the same interface as https and ssh, I am not able to get snmp traffic. I have tried using nmap and found that port 161 is  block. So this is not an issue of snmp community/user. I saw a fix but it was applicable to V7.6+ so I was wondering if there's a fix for this specific version?  

I am wanting to change the hostname of our fortigates so they are more self explanitory. However we have a NPS server running and the NAS identifier is set to the present hostname of the fortigate.Is it possible to change the fortigate hostname and then also the NAS identifier on the NPS server? Will this impact anything else? Such as certs of other EAP settings? We are using EAP TLS with cert. for authentication.Also how would you do this for two fortigates with two different hostnames? Can you add a second NAS identifier in NPS under EAP TLS properties and Connection request policies?Thank you 

I plan to implement FortiToken as a Multi-Factor Authentication (MFA) solution to be used on company laptops.However, the current situation is quite unique. The available laptops are limited in number and are shared by multiple users who take turns using them at project sites or during business trips. As a result, these laptops are not dedicated to a specific user.If FortiToken were to be assigned to all users, the implementation would be less effective, since not every user is always working on-site or traveling for business.Therefore, it is necessary to choose a type of FortiToken that can be used flexibly and shared among users, ensuring security needs are met without limiting user mobility. Which type of FortiToken would you recommend that can be used flexibly and shared among users in this scenario?Thank you.

Is it possible to deploy a standalone FortiNDR as a VM in a Hyper-V environment? In the Fortinet documentation, I only found support mentioned for KVM and VMware

Hi everybody,when i try to connect with forticlient vpn i receive a "Connection was terminated unexpectedly."this happens only in my personal hotspot (iphone; telekom). when i try it with a hotspot of my colleague (also iphone; telekom) it works. it also works within our companies wifi.we are not connected to any VPN with our iPhones. apple private relay is also disabledcould any other iPhone setting cause that problem?

Hi everyone,I can't change the password from FortiPAM.In the "Windows Domain Account" or "Windows Domain Account (Samba)" template,instead of the "target" field,  only the "Domain-Controller" field appears.The problem is that if I enter the domain controller's IP address in the field, I can no longer access my destination domain server.So, in the domain controller field, I'm forced to enter the server's IP address because I no longer have the host field.So, I can access the final server, but I can't change the password.RegardsLuca

Hello everyone,we're currently experiencing issues with some users trying to connect to our IPsec VPN. The FortiClient times out during connection, even though the configuration and password are correct.After investigation, I found that the root cause seems to be related to users who are members of a large number of LDAP groups. For those users, the FortiGate fails to process the authentication request and throws the following error: diagnose debug application ike -1 diagnose debug application authd 60 diagnose debug application samld -1 diagnose debug application fnbamd -1 diagnose debug application eap_proxy -1 diagnose debug console timestamp enable diagnose debug enable2025-09-19 11:57:45 1758275865.817240: 2025-09-19 11:57:45 EAP-TTLS/PAP: Correct user password 2025-09-19 11:57:45 1758275865.817297: 2025-09-19 11:57:45 EAP-TTLS: PHASE2_START -> SUCCESS 2025-09-19 11:57:45 1758275865.817396: 2025-09-19 11:57:45 EAP-TTLS: Derived key - hexdump(len=64): 2025-09-19 11:57:45 17

Hi, I have multiple VPN connection installed in my machine. Some are windows native VPN connections and some Forticlient VPN connections. Forticlient version is 7.4.3.1790. Operating system is Window 11 with latest updates. When i connect Forticlient IPsec VPN disconnect it and try to connect Windows native L2TP/IPsec VPN, it does not work, but returns error:The L2TP connection attempt failed because the security layer encountered a processing error during the initial negotiations with the remote computer.I found out, that windows VPN starts working again, if I stop "IKE and AuthIP IPsec Keying Modules" forcibly with command:$ net stop "IKEEXT"So is there some kind of "unclean disconnect" bug in Forticlient? Or could this be fixed with proper settings etc?  

HelloI'm trying to login in the normal way of EMAIL USER and I get an error message that the SAML request has expired. My two-step verification is currently configured via email. But even when I tried to change to an authentication app, I get the same message. when im trying to login via incognito mode im getting the same issue. The error massage is redirect me to the support portal and from there i do can loggin to my account. What a strange issue is that ??  Does someone ever faced an issue like that ?please help !!  

Hello Community,I’m working on configuring Captive Portal on my FortiGate firewall with FSSO integration, and I’d appreciate some guidance.Objective:Domain users should be authenticated automatically via FSSO (or group-based policies) when they are on the corporate network.Non-domain users (not logged into the domain) should be redirected to the Captive Portal.On the Captive Portal page, these non-domain users should still be able to log in using their Active Directory credentials (username/password) to access the internet.Is there a recommended approach or workaround to achieve this setup?Thanks in advance!

If i have 2 SLA performance to monitoring packet loss and latency to google and microsoft and both SLA used in single sdwan rule.Then the when sdwan will switch to the next member? if only one sla is not met, example high packet loss to the google but rest of 3 sla targets is good will the traffic switched?Or sdwan will switch if all 4 targets is not met?

Hi, I have to configure new FortiAPs changing from a configuration with different Ubiquities. Right now they have like 2 SSIDs and they are in different Vlans. Problem is that the FW is in the warehouse and they pass connection from a Cisco Switch to another Switch via VLan. I told the provider who manages the switch that I need ACCESS ports with VLan whatever he wants to connect the FG60F directly to port X on the Cisco Switch and also to connect my new FortiSwitch in port X on the other Switch. From there I have direct connections from the PoE FortiSwitch to the 5 FortiAPs. Now I am not sure what to tell them, do I need the specific VLan also on my new Interface Port 4 in the FG60 which I name FortiAP Zone? I understand that bothe Wifis will have automatically their VLan and network, etc. So it should work having the access connection on both switches, right?Something else I have to consider? Thanks! 

 Dears,We have recently added a new FortiManager (version 7.4.7) to our environment and are working on integrating a FortiGate cluster (version 7.4.8). However, each time we try to add the FGT cluster, we encounter the following error related to an FSSO group:  Command fail. Return code -131: datasrc invalid. object: user adgrp. detail: FSSO_Agent. Solution: data not exist  Could you kindly assist us in resolving this issue?Best regards,

Hello Guys, is it possible that FortiClient can cause problems with drivers? Since we have Forticlient in a company we are facing problems with drivers, mainly audio/video drivers. People report that they are not visible via camera or microphone was not found even day ago it was everything OK.