Fortinet Community

Hello, I am with multi VDOM : external, root, internalMy management Vdom is the root, it is good or not ? thanks

Hi everyone,I’m currently running a FortiGate VM NGFW and considering a move to a physical FortiGate appliance for performance and reliability reasons. I’d like to know if there’s any supported method to migrate or transfer my existing VM license to a physical device.From what I understand, Fortinet licenses are tied to the device type (VM vs. hardware), but I’m hoping someone here has experience with this kind of transition. Is there any workaround, trade-in program, or support path that allows reusing the VM license on a physical unit?Any insights, official guidance, or personal experience would be greatly appreciated. Thanks in advance!

I have conditional access policies requiring compliant devices when connecting to Fortigate SAML SSL VPN.I'm trying to connect my Intune registered and compliant iPhone to Fortigate SSL VPN via the free IOS client. I get a message stating the device isn't compliant and needs to register.Does anyone have a working setup with Azure compliance or is this not supported in the free (IOS) version? On Windows it works like a charm. Can't find anything in the documents. Note i'm talking about Azure Compliance, not the Fortinet host check.

Hello Sir, I am currently testing FortiClient EMS for our client.They would like FortiClient to pre-populate the username and password for the IPSec tunnel,without requiring any action from the end user. Unfortunately, I have not been able to find any option in FortiClient EMS for this,and I am not aware of any FortiClient command that would achieve it. Is there a way to achieve this? Thank you for your support.

Dear Sir,I am encountering an issue while configuring SAML integration between FortiAuthenticator and FortiGate IPsec VPN, and I would like to request your assistance.Current requirements:FortiAuthenticator as IdPFortiGate as SPConfiguration steps taken so far:1.Enabled SAML-related service ports on FortiAuthenticator2.Configured SAML IdP General settings on FortiAuthenticator and exported the certificate3.Configured Service Providers on FortiAuthenticator4.Configured Single Sign-On on FortiGate5.Created a User Group6.Established an IPsec Tunnel7.Test result: IPsec connection shows failureI would greatly appreciate it if you could review the configuration steps above to check for any omissions or errors, and provide recommended troubleshooting methods to help complete the SAML and IPsec VPN integration.Thank you very much for your support!

We are looking to migrate to an IKEv2 Dialup VPN with Duo Proxy for MFA and integrating with NPS.  Does anyone have a working config they can provide for this configuration?  I can't seem to find anything online.

I am attempting to setup an ipsec Ikev2 VPN using the Windows Native Client. The attempt to connect fails immediately with the "IKE authentication credentials are unacceptable" error. I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKE-authentication-credentials-are-unacceptable/ta-p/382297. However, I am using our publicly signed Wildcard certificate, so  should not need to upload the CA certificate to the client as stated in the article. I have also found this article which is a similar but not exact configuration: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IKEv2-IPsec-VPN-MS-CHAPv2-with-Windows-Phone-8-1/ta-p/195470#:~:text=As%20for%20Internet%20connection%2C%20change,the%20rest%20of%20the%20settings. This video is also similar but not exact: https://www.youtube.com/watch?v=a0W-NyI6m10Lastly this is an official guide from FortiGate that's also similar: https://docs.fortinet.com/document/

Dear Team,I am interested in taking the FCP - FortiGate 7.4 Administrator exam, which expires on September 30. If I pass it and then take the FCP - FortiManager 7.6 Administrator exam after September 30, will I be able to get certified as a Fortinet Certified Professional in Network Security?Thank you

Hello everyone, I have requirement to allow only YouTube for one device. What is the best method to do it? can anyone confirm this method is right? 'How to allow YouTube videos while blockin... - Fortinet Community'

hi,i can't seem to monitor the IP NAT pool utilization both from the 'IP Pool' section and adding widget in dashboard. i waited more than 10 mins but still no output.does it need a fortianalyzer to make monitoring work?  ip pool GUI section:  dashboard widget:

Hi All,I am running FortiClient ARM64 on my Windows CoPilot+ PC (Lenovo). I have gone through the wizard on the firewall to setup my FortiClient IPSec connection and all seems well there. When I try to connect, FortiClient tells me that the connection timed out. However, on the Firewall itself (60F), I see that the negotiation failed with "peer SA proposal not match local policy" listed as the reason. I followed the wizard to create a FortiClient IPSec tunnel, verified the policies were added to allow access to my local network, added a policy to allow access to the internet (I don't want split tunneling). Any thoughts on what I might have done incorrectly?

Regarding the VRRP-redundant network device (FortiGate 60F) connected to the HA-configured FortiGate 200F (7.0.5), the setup involves the primary 200F connected to the master 60F, and the secondary 200F connected to the backup 60F. Ideally, when the master 60F experiences a failure, communication should occur between the secondary 200F and the backup 60F. However, according to the 200F management interface, the relevant interface appears to be down.Attempts to enable/disable the interface and static routes have not resolved the issue. Could you please advise on possible solutions?

Some office users have been experiencing intermittent Wi-Fi connectivity issues in some areas during peak hours.Affected users may lose access to network resources for a couple of minutes when it happens.Users are being disconnected randomly from the wifi while sitting and are unable to connect again unless they move their location My setup is:1*FirewallForitgateFG201F22* ForitgateFortiAP431GNot Assigned1*SwitchForitgateFS-148F-FPOE  The logs : date=2025-09-04 time=13:52:14 eventtime=1756979534438448503 tz="+0400" logid="0104043581" type="event" subtype="wireless" level="notice" vd="root" logdesc="Wireless client WTP disconnected" sn="FP431GTY23046095" ap="AP-YM-AP14" vap="WLAN-USERS-SSID" ssid="My-SSID" radioid=2 user="N/A" group="N/A" stamac="1e:da:47:7b:8e:67" authserver="N/A" srcip=0.0.0.0 channel=36 radioband="802.11ax-5G" signal=0 snr=0 security="WPA2 Enterprise" encryption="AES" action="client-disconnected-by-wtp" reason="4-Way Handshake timeout" mpsk="N

Bonjour à tous . Je me prépare pour la certification Fortigate Administrator 7.4. j’aimerais avoir des conseils, des dumps (si possible). c’est ma première certification et je veux la réuissir

Helloi'm tryng to set active all log to see the traffic outbond the lan.I have set how you see in image but all log view are clear.I'd like to set the logo on USB device (if possible)I have a fortigate 60FThanks

HiI have a new Public Certificate and need to upload it to FortiManager VM 7.4.5I select the certificate and private key, enter the certificate name, enter a password and click OK.  Then the certificate page refresh but the new certificate it's not there.  No error message appear. I was able to upload the same certificate files to FortiAnalyzer, so the certificate is good.

Hi All, Going to push out a policy on one of our FortiGates running 6.0.8. Our FortiManager is running 6.2.3 but this FortiGate is in a 6.0 ADOM. This is the error I get: 2020-03-19 11:22:43:post commit check fail: members volume-ratio- 2 0 - out of range - prop[volume-ratio] : value 0 out of range (1,255)2020-03-19 11:22:43:post_vdom copy error:members volume-ratio- 2 0:(errcode)-999 - out of range - prop[volume-ratio] : value 0 out of range (1,255) Thanks!

Good morning, everyone! I have a FortiGate model 100F, version 7.4.7. I configured an IPsec VPN on it for employees to connect via FortiClient. I created the FSSO connector, which brought the groups, and I created the LDAP connection (tested and validated). What happens is: in the VPN policy I created, when I add the group from AD, when I try to connect, it displays an error and won't connect. Looking at the logs, I saw an error called FNBAM_ERROR. What could this error be? Thank you.

Greetings, I'm working for an IT system house, and we are currently in the transition from SSL VPN to IPsec. The biggest issue we are currently facing is that we have used the SSLVPNcmdline tool integrated in our support software to connect to our numerous customers. Now I'm wondering if there are any alternatives we can use with IPsec?

Currently using the latest Forticlient version 7.4.3.1790. Connection established but after a second the Forticlient application crashes/shutdowns automatically.

Hi,I have 3 FortiExtenders (FXT311F-v7.4.6-build25) connecting to my FortiGate 100F (7.4.7 build 2731)via their lte1 interface. They are all showing in the FortiExtenders section - can see their wan ip address and perform basic diagnostics. The are all using the default lan extension profile and ipsec tunnel.I have policies configured to enable them to access my local lan etc.The problem is that the IPSEC Tunnel just never comes up  - there is very little information out there relating to the Extenders so hoping someone on here can shed some light on how to fix this issue. Regards

Hi everyone,Perhaps somebody has the same problem or know how to deal with it. I have a used FortiAP 321c. I also have FortiKey and registered device in FortiCloud. It should be connected directly to the Ethernet. To set up the connection, router need to remember the username and password of the network. I tried to find such options, but without any result.It doesn’t work through Wi-Fi too. When it is connected to the Ethernet at first, all indicators are becoming green, after that LAN indicator is still green, but the Wi-Fi is turning for another 15–20 seconds yellow, and then stops gloving. Wi-Fi can’t be found by searching. So, I can’t set it up all.Could you please help us to set up this router and the Wi-Fi connection through it?Thank you in advance.

Hello, We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group). We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts. Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-

After upgrading the firmware of a Fortigate 200F in an HA configuration from 7.0.5 to 7.2.2, the HA synchronization was lost. Ideally, we would like to upgrade all the way to version 7.4.3. Please advise on how to resolve the issue if synchronization breaks, and whether there is an upgrade path that avoids this problem.

After upgrading the firmware of the FortiGate 200F in an HA setup from 7.0.5 to 7.2.2, the VPN tunnel configuration was lost. Ideally, we would like to upgrade all the way to version 7.4.3. Please advise on how to prevent the VPN tunnel settings from being erased during the upgrade, and whether there is a recommended upgrade path that avoids this issue.Additionally, the FortiGate 200F is connected to a media converter (ONU) provided by the ISP on the WAN side. Before the upgrade, the device was able to automatically obtain an IP address even with the interface set to 0.0.0.0. However, after the upgrade, it no longer receives an IP address.We reverted the firmware to the previous version and restored the backed-up configuration, but the IP address is still not being assigned. Although the configuration matches exactly with the pre-upgrade state, we suspect that some internal setting may have changed.We would greatly appreciate your guidance on how to ensure the VPN tunnel settings are p