Fortinet Community

Hello Fortinet Community,I am planning to upgrade my FortiGate 60F, which is currently running FortiOS v7.0.13, to the newest v7.4.8 (Mature) version. My firewall is not managed by FortiManager, and I intend to perform the upgrade locally through the device's web GUI during off-work hours.When I go to the System > Firmware & Registration page, the FortiGate shows me a direct upgrade path to v7.0.17, then to 7.2.X, and finally to 7.4.8. It also has a "Follow upgrade path" option.I have a few questions to confirm the process:Can I rely on the GUI to safely perform all the intermediate steps in the upgrade path? Are there any known issues with this specific upgrade path from 7.0.13 to 7.4.8 that I should be aware of?Will the firmware upgrade automatically back up my configuration, and should I also download a local backup before starting?Since my VPN is on a separate WAN interface, will the firmware upgrade maintain the VPN configuration, and will it automatically reconnect af

Hi teams,I am currently considering adding a non-preferred route for return traffic to make it follow an atypical path. Could you please explain the criteria for selecting routing preference when dynamic and static routing are mixed?My understanding is as follows, but please correct me if I'm wrong:Longest matchDistance ValuePriority ValueSpecifically, I am considering updating the routing table as follows:I am concerned about whether the BGP metric value might affect the route selection when BGP and static routes are mixed.# get router info routing-table allB* 0.0.0.0/0 [20/100000] via XX , [1/0]S 　0.0.0.0/0 [20/0] via XX,port1 [100/0]S 　0.0.0.0/0 [20/0] via XX,port3 [100/0]Thank youKenji

We current to migrated to FrotiVoice from CUCM. We are using FortiFone 380B and 280B. Users doesn't like built in ringtone on the phone and it's only give 5-6 default ring option. I am not able to find the option to add more ring tone. Has anyone able to add custom ringtone?

Hello team!! I hope you are doing well!!We have 2 Fortigates 100F in HA with many IPsec VPNs for FortiClient users.Just one user has a problem to connect from his house.  When he use another internet connection in the same computer this works fine but with his own ISP sometime does it fails (Sometimes work also)When this fails, I can see the following logs on Fortigate: date=2025-09-11 time=12:38:58 eventtime=1757605138121774900 tz="-0300" logid="0101037134" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec phase 1 SA deleted" msg="delete IPsec phase 1 SA" action="delete_phase1_sa" remip=RemoteIP locip=LocalIP remport=18052 locport=4500 outintf="port9" cookies="b77cf798b4edb960/b7f28e5eae0677b7" user="1011" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="IPsec-IT-W3" fctuid="N/A" advpnsc=0date=2025-09-11 time=12:38:38 eventtime=1757605118948074500 tz="-0300" logid="0101037127" type="event" subtype="vpn" level="notice" v

Hi Folks, I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.I hear anecdotally that others using regular Firefox are not experiencing this issue either.I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes.  Any thoughts? I'm at my wits end a bit here.I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place

Hello,I am configuring FortiNAC to work with RADIUS authentication, but I haven’t been able to find anywhere a complete list of available RADIUS attributes.Additionally, when setting up devices for EAP-TLS authentication using certificates, I noticed that NAC allows the use of “pseudo-attributes” such as TLS-Client-Cert-Common-Name or TLS-Client-Cert-Subject-Alt-Name-UPN, and so on.Is there a full list of all available attributes?When I open the dropdown menu, it only shows the first 10 attributes starting with “A.”If I type “TLS” and open the dropdown, it doesn’t show these pseudo-attributes either. Any guidance on where to find a complete list of supported RADIUS and TLS pseudo-attributes would be greatly appreciated.Thank you!

I'm trying to get alert mail for configuration changes on fortimail using fortianalyzer 6.4.2 i'm recieving the event log successfuly on the fortianalyer with message indicating the configuration changes i configured the event handler and recieved alert mail but message conatins that configuration modified with no details  so how can i get the full message on mail as event log      

I solved an issue where I was unable to make an IP-Sec connection with my laptop, while others were succesfull. I mention it here, for I solved it, but did not find this solution here. Quick one:Look for other VPN software that capture your local UDP 500 / 4500 ports. Fritz!VPN Troubleshooting log: First discovery: Wireshark does not see any outbound traffic to the VPN gateway. Second discovery: in C:\Program Files\Fortinet\FortiClient\logs\trace\FortiVPN_1_error.log:repeated[2025-09-17 10:03:32.9410049 UTC+02:00] [3032:94940] [FortiVPN 1236 error] fortivpn::IFortiVPN_Impl::LowPowerWakeUp() NOT PBT_POWERSETTINGCHANGE[2025-09-17 10:03:32.9428086 UTC+02:00] [3032:94940] [FortiVPN 1261 error] fortivpn::IFortiVPN_Impl::LowPowerSleep() NOT PBT_POWERSETTINGCHANGE Then I remembered, that IP-Sec (normally/alway's) has a fixed client port. So this should be available.In CMD:netstat -aon | find ":500"TCP 10.10.2.1:50003 52.209.151.231:443 ESTABLISHED 9172UDP 0.

Hi there,has anyone experiences with Forticlient App from Windows Store?Customer has installes it from in Windows 10 notebook an it doesnt work. I tried it on a testsystem an it also doesnt work. It seems that client doesnt try to connect (sniffer log on egde firewall doesnt show any connections to vpn target.Client is configured according to this document: http://docs.fortinet.com/uploaded/files/3034/forticlient-v1.0.0-windows-app-user-guide.pdfThe rating of this app is very poor, but customer wont use the fat forticlient for vpn.Forticlient support doesnt respond yet. 

Hi,We have fortinet firewall.We authenticate via FSSO.Now with Windows Hello, via biometrics or FACE ID, it does not recognize login events, leaving the user without a session on the firewall.Does anyone know how to resolve this?Has anyone experienced something similar before?

Hello We have some problems with slow RDP connections when using FortiClient VPN. Let's say we have laptops added to the Active Directory domain called mydomain.com We are using only VPN connections as we are remote workers. We can connect quickly to all severs in the same domain with RDP without any problems. We have also some other Active Directory domains in our infrastructure, called anotherdomain.com and anotherdomain2.com They are in different AD forests and DNS conditional forwarding is configured. The problem is that it is taking approx. 1 minute to connect via RDP to the servers in these different Active Directory domains - this issue only happens if I use FQDN of the server. If I use IP address the connection is immediate, there is no delay. When connected to LAN in the office, no problems, no delays... Interesting part - this problem happens only when using FortiClient VPN version 7.2.5 and higher. When using FortiClient

Hello,  I was wondering if there was any way to forward the Google Id Token to the backend when using a Google Oauth2.0 Server.Right now, the fortiweb puts in "authorization" header "Bearer + Google AccessToken"But I would like this header to contain "Bearer + Google IdToken"The difference for me is that Google IdToken is a Jwt that can be decoded and verified easily in my backend and so can be used as is to authenticate everything in my backend.On the other hand the AccessToken is opaque and only give me access to GoogleApis. So this means I would need to mint my own Jwt with the infos I get from /userinfos google endpoint.Thanks in advance,  Jules

I have deployed FortiNAC in HA mode. And use its radius server to authenticate users when they are login to the network devices. When the primary unit is active user can login using their name and password only. However when secondary unit become active users should include name@domin name to access it. Can someone explain wh

Hi everyone.I have a question about IPsec phase 2 in FortiGate. I need to create nearly 60 IPsec site-to-site tunnels. At the center site, we have 8 different subnets. Is it better to create a separate Phase 2 for each subnet or use 0.0.0.0/0 as the local and remote site in Phase 2?

Hi,I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.I'm reluctant to use this method. Is this a well-known workaround?Do you have any advice on a better way to handle this? Hardware: FortiGate 120G OS: 7.4.8Thanks,Kenji

Hi,I'm having issues generating Let's Encrypt certificates on our FortiGate. We have a connection to Let's Encrypts ACME server, DNS was also checked. Our subdomain resolves to the correct IP address. FortiGate also says that the renewal was successful, however the certificate cannot be used in any service (we are generating a cert for SSL-VPN). When you try to view the details of the cert this is what you get:get vpn certificate local details SSLVPN == [ SSLVPN ] ACME details: Status: Unprovisioned Staging status: The certificate for the managed domain has been renewed successfully and can be used (valid since Mon, 08 Sep 2025 12:32:13 GMT). A graceful server restart now is recommended.We also tried restarting Fortigate, no luck.How can we troubleshoot this ?Thank you in advance!

Hi All,We have Azure SAMl configured for VPN client and has a conditional policy as well to only allow login from domain joined devices.This is working as expected, how ever the auto connect with azure ad option is not working.Tried with different documentation and articles still same, logs also doesn’t have much info.

Hello we have Fortimanager giving the Error message appearing every time trying to edit variable mapping."Failed to add per-device mapping to FMG variable"we tried :diagnose dvm check-integritydiag cdb upgrade check objcfg-integritydiagnose cdb check policy-packagesdiagnose pm2 check-integrity alldiag cdb upgrade check reference-integritydiagnose cdb upgrade check +allBut the above commands, unfortunately, didn't workAny Advice?Thanks

Hi, Analytics is currently set to 90 days and Archive is set to 730 days.We have two years' worth of archive logs. What should I do to watch a year's worth of Analytics? Should I change the Analytics period to 365 and then db-rebuild it? Thank you. 

If the Fortigate have multiple vdom, can we directly enter to the vdom global without issuing 'config global'?Currently when i ssh to the fortigate i must enter that command first before i can execute 'get system global'

Hi,I've a corporate laptop that uses Forticlient to establish a VPNconnection to corporate resources.When working at home, when this corporate laptop is connected through the ISProuter, there's no problem connecting to the VPN server. Now, I'm setting up my own router/firewall.Using simple NAT rules, other systems can connect fine to the Internet, also the corporatelaptop can connect fine for everything except the VPN resources.When I try to connect the VPN, Forticlient 2.7.8.1140 returns:"a network error prevented updates from being downloaded". It seems that for this kind of ssl vpn there are some special rules.Can you please tell me what rules, protocols, ports, etc should Iconsider in my router/firewall?If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.Thank you

I currently have two FortiGate 60F devices running in an active-passive HA pair. I am monitoring the active device in N-Central via the management IP, but I am wondering what is the recommended method to monitor the standby unit as there is not a management IP of the standby device. I was planning on monitoring fgHaSystemMode (OID: .1.3.6.1.4.1.12356.101.13.1.1) via SNMP and querying against the OID to ensure that the value of this 3 to match active-passive as I will know if the passive device is down if this value is either standalone or active-active. Currently we are only monitoring the active device so we would not be aware if the secondary goes down 

Hi,We are preparing to migrate from FortiClient EMS 7.2.10 to 7.4.4.We deployed EMS on a Hyper-V VM.Copy/Paste doesn't work in EMS CLI 7.4.4.How can I enable the clipboard functionality? 

Hi everyone! I have this scenario.. FSW124D-POE ---> Ubiquiti NanoStation M5 <---> Ubiquiti Rocket M5 <---Fortigate100EI want to administrate the Fortiswitch from fortigate... i get to authorize the Fortiswitch but Fortilink the CAPWAP tunnel naver came up.Can anyone help me with this?!Regards!

Hello everyone ,  I want to know the number of users each model can support based on your experience.I know that sizing must be based on other metrics: use cases, activated licenses, ISP throughput, interface configuration, etc... But , The number of users can give an idea of ​​the size of the environment, so I want to know how to relate the number of users to the range of fortigate models that might be suitable. I then use these metrics to determine the best model among the other models in this iteration.I'm talking about the F and G series. Thanks for your supportRegards