Fortinet Community

Hi there, On entry-level FortiGate models, the SSL-VPN web portal breaks after the update to FortiOS 7.4.8. Update 2diagnose debug console timestamp enablediagnose debug application sslvpn -1diagnose debug application fnbamd -1diagnose debug enable 2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/sslvpn/css/ssl_style.css, /data/migadmin/sslvpn/css, /migadmin/sslvpn/css 2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed. Update 3The issue has been identified as BUG ID 1164811: https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/236526/known-issues

When we build VPN site to site we defince local and remote subnet, and also there are option to add route.When we enable the add route option why we still need make static route?If no static route I'm not able access to the remote subnet.

Hello,We're trying to migrate our Dial-up VPN from IKEv1 to v2 and wondering if its possible to run the new IKEv2 tunnel on the same interface without issues for a transition period?I've read a little about using the PeerID/LocalID to differentiate tunnels but I'm a little concerned about making any changes to the current IKEv1 tunnel and client configurations to accomplish this. Any guidance is much appreciated :)

Hi, I hope you are doing well, can someone provide me the link to report my website as false positive, it is already clean, and I wanted it to be removed from the blacklist.The website is: compratucasaen30dias.com

Hello, I am going to deploy ForiProxy in explicit proxy mode for around 2000 users. What is the recommended authentication method for ForiProxy. Is it Kerberos, NTLM or FSSO?. Please advise. ThanksShabeeb

After upgrading both FMG and FGT to version 7.6.4, every time I push the policy to the FGT, FMG is removing all my global-label, even if they are correctly set in the "CLI Configuration" window.Bug or "feature"?Here I set global-label

Users are connecting to the corporate network with their LDAP credentials and I have configured their roles accordingly. However for some reason, about 1-2 out of every 10 users end up coming to FortiNAC-F with the NAC-Default role, even though they are in the correct LDAP group on AD. The correct behavior and what usually happens is that when a user connects for the first time, if they are a member of group X, they are assigned to the X role. The issue resolves by deleting the host registration from the NAC and when the user disconnects and reconnects to the network they get the correct role. What could be the reason?  

I am currently working on integrating FortiGate with FortiSOAR and facing an issue while installing the FortiGate connector.FortiSOAR Version: [7.6.2]FortiGate Version: [7.0.0]Environment: VM (CentOS/RHEL base)When I try to install the FortiGate connector using the following command: sudo yum install cyops-connector-Fortinet-FortiGate  I get the following error:Errors during downloading metadata for repository 'fsr-app':- Curl error (28): Timeout was reached for https://repo.fortisoar.fortinet.com/7.6.2/fortisoar/x86_64/repodata/repomd.xml [Connection timed out after 30000 milliseconds]Error: Failed to download metadata for repo 'fsr-app': Cannot download repomd.xml an other think that i tried it  is when i google 'repo.fortisoar.fortinet.com' i get web page contain repository . I have already tried the following:Verified network connectivity (ping to 8.8.8.8 and 1.1.1.1 works).Edited /opt/cyops-integrations/.env/pip.conf

Hi! Just checking if someone may have an idea as to why traffic to a remote server is now blocked with forward traffic log showing server-rst. This only happens after FortiGate firmware version was upgraded from 7.0.17 to 7.2.11. If I removed all the security profiles(IPS, DNS, File Filter, certificate inspection, App) attached to the firewall policy, the traffic is allowed. But adding back the security profiles(IPS, DNS, File Filter, certificate inspection, App) without modifying any of them, the traffic is still allowed. But the problem reoccur on the next day. HTTP.Browser.IE is allowed on the AppControl logs. Thank you. 

Hi, I'd like to know what directional antennas are supported by FAP-432G-N. 

I know you can manage FortiAP's for free, but I am finding conflicting information on whether or not you can manage a Fortiswitch for free. From what I can find you either have to pay for a license to manage a Fortiswitch or you can manage 1 Fortiswitch for free. If anyone can clarify which is actually true, I would appreciate it.

We are looking at FortiAPs and FortiSwitch(es) as alternatives to other hardware vendors we currently have deployed in our environment. Specific use case is residence hall wireless utilizing hospitality-style APs along with switch replacement. I'm curious about your experience with deploying Fortinet's APs and switches in a large-ish environment.In our case, around 900 APs and 50 switches. What's your deployment size?If you replaced/migrated your environment from another vendor, how do you think the Fortinet hardware/software/management compares?Is there anything you miss that a Fortinet solution doesn't provide?How reliable have your switches/ap been?How have firmware updates gone?Do you also utilize FortiManager for switch/ap management?What are your major pain points with a Fortinet switch/ap solution?Thank you in advance for any feedback on this.    

Hello everyone!  I am trying to get a better insight on how to set up Authentication Isolation in a more efficient way for my network. One issue that I currently have is the time that it takes for host to be moved to the authentication VLAN. From the configuration options, 1 minute is the least for "Time in Production Before Authentication" you can set up, so I usually get faced with the following situation:- The user logs in to the PC and for whatever reason the logged on user can not be passed to FortiNAC, the user starts browsing for a few seconds and gets moved to Authentication VLAN and prompted with the web captive for authentication and the Persistent Agent Pop-UP asking for credentials. After following the requests the user gets redirected to the appropriate VLAN.The thing is, a user has to go through this process daily before starting to work: Turns on the computer, gets moved from default registration to the access VLAN, then after 1 minute is moved back to Aut

I’ve configured FortiNAC-F as a local RADIUS server and successfully joined it to my Active Directory using Winbind.Currently, I have a network access policy that places all 802.1X users into the LAN Network, and it’s working as expected. Now, I’d like to set up access policies that dynamically assign VLANs based on the user’s Active Directory group membership:If a user belongs to AD IT_GROUPE, they should be placed in the IT Network.If a user belongs to AD USERS_GROUPE, they should be placed in the LAN Network. 

Hello,Fort Im currently using FortiClient EMS cloud version. We encountered issue where if device has been turned off for a long time after initial start up the EMS is disconnected and I need to manually enter Invitation Code again even if the device was authorized beforehand. Ive found out that there is a setting called persistent connection in EMS settings but is missing in my console. Any ideas if this was removed or am i doing something wrong. Thank you

Hi all, Scenario:Two site, each with a fortigateSite A and Site B connected via BGPSite B gets main internet access through a default route advertised by Site ASibte B also as a Fortiextender (4G) for backup WAN with a Public IP (static route with higher Administrative Distance than BGP)Mail goal is remote host's to do VPN directly for Site B Fortigate, even when dafult route is being imported from the BGPSite B Fortigate 61F FortiOS 7.2.11 Setup is proven to be working as when I do a specific static route to my public IP I can reach site B Fortigate (ping and VPN).I tried to acomplish this with Policy Based Route however traffic was being dropped by RPF, even with src-check disabled in the interface. For test purpose I did a PBR as less strict as possible. config router policy edit 1 set input-device "WAN-BACKUP-5G" set src "0.0.0.0/0.0.0.0" set dst "0.0.0.0/0.0.0.0" set gateway <Fortiextender next-hop> set output-device

Hello!Since September 16, 2025, several customers with Fortigate 40F have been experiencing problems with SSL VPN in tunnel mode on mobile devices. The problems occur on iOS devices.According to the Fortigate dashboard, the client is authenticated, connected, and has received an IP address. The Forticlient VPN app continuously displays “Connecting.” After several minutes, the process then aborts.Customer uses Let's encrypt certificate ACME details:Status: The certificate for the managed domain has been renewed successfully and can be used (valid since Tue, 19 Aug 2025 10:17:20 GMT).Staging status: Nothing in stagingIssuer: C = US, O = Let's Encrypt, CN = R11 FortiOS: 7.4.8Forticlient iOS App Version 7.4.8iOS 18.6.2 The bug with ID 1164811 occurs for the customer.Fortigate was updated from 7.2.11 to 7.4.8 two months ago. Any help would be appreciated. 

Hello everyone, We’re looking for guidance on an issue with FortiGate IKEv2 + SAML (Microsoft Entra ID). Below are the key details and symptoms. EnvironmentAppliance: FortiGate 201GFortiOS: v7.6.4 build3596 (Feature) SymptomsFortiClient opens the Microsoft Entra sign-in page and we receive the MFA push.After approving MFA, the client returns “Firewall Authentication Failed.”We are not able to access the ACS URL from the web. We get this page can’t be reached. What we didWe followed the community article for Microsoft Entra ID SAML with FortiGate IPsec (IKEv2) and Fortinet’s official IPsec+SAML guide step by step, but the issue persists.  Note: Before switching, we were using RADIUS for authentication and it was working. Any advice on additional checks or known caveats with FortiOS 7.6.4 for IKEv2 + SAML would be appreciated. Thank you!

Hello!I've been operating a Fortimail as a VM now for a little over a year, and I'm wondering if there's any way to issue any 'TRIM' commands to the virtual drives to keep the underlying storage freed up? I'm very interested if there's a way to script it and run a cron job, or if there's a built in feature to do this already.Can anyone elaborate?Thanks!! :)

Hello AllI already have sdwan with advpn+bgp at Site A, my question is how to config Site B but its isolate, i wanna Site A and B cant talk each other Thx u 

I'm trying to set up a network environment where a FortiGate centrally manages a FortiSwitch. In the existing environment, all endpoint devices are assigned to different VLANs (such as 101, 201, 301, etc.), and all endpoint device IP gateways are configured on the core switch. After successfully creating the FortiLink over a Layer 3 network to manage the FortiSwitch—following the reference link and documentation—I am able to manage and assign VLANs to the FortiSwitch from the FortiGate. However, I found that user traffic and DHCP assignment are also failing on the FortiSwitch. It seems the FortiSwitch cannot receive or forward any Layer 2 or Layer 3 traffic to the core switch. Please advise if there is any misconfiguration or if you have any suggestions. Thank you very much! Current Network Environment/HLD:Internal Firewall (FortiGate) <-> Layer3 Core Switch (Cisco, H3C, Juniper, etc) <-> Access Switch (FortiSwitch) <-> User/Endpoint Devices Refer

Hello,we have a couple of FAP231F with v7.2-build0424 and FortiGate 7.2.11 Firewalls.We use a few Samsung QM55C and QM98N Display, that offer Samsung Screen Mirroring (Miracast). These Wifi-Direct Feature is problematic. Very often, the Windows 11 24H2 Enterprise Notebook can´t connect to the Screen Mirroring properly.Most of the time, it takes about 10-20s before a connection fails oder can be established. Is there any whitepaper or recommendation, how to configure the FAP231F with a profile?And what should i configure here to get a blazing fast user experience.Lets say, the user click on *connect* and kazam, the screen is online? Is there any information how i could debug these problem? Thanks in advance!   

Hello,I would like to clarify how FortiMonitor licensing works with FortiGate HA clusters. If I add a FortiGate HA pair to my FortiMoAnitor instance, will this consume two licenses (one per device) or only a single license since the cluster is treated as one entity? Additionally, does the licensing behavior change depending on whether the cluster is Active-Passive or Active-Active, and does it make a difference in the licensing if the FortiGates are added via Security Fabric or SNMP? This is all to properly bill clients to know how many license does each client haveThank you in advance for your help.

Hello Fortinet Community,I am currently managing a FortiSwitch 148F-FPOE running firmware version 7.6.1. Each port on the switch is configured with two VLANs: one for data and one for voice.I would like to enable port security similar to Cisco, so that if someone connects a different PC to a port, it will be blocked or restricted.Could someone provide guidance or configuration examples for enabling port security in this scenario on a FortiSwitch?Thank you in advance for your help

Hi all I’m looking to adjust the priority of IKE routes, which according to CLI guidance should be a command under ipsec phase1-interface, set priority x.But the command/option doesn’t seem to exist. This is an advpn / bgp on loopback configuration on the spoke side. Im looking to amend the priority of IKE routes for the hub loopback when learned over a cellular overlay to avoid BGP establishing in that direction.I’m assuming another command is required as a pre req but my brain is drawing a blank on this one.Any help much appreciated.Thanks