Fortinet Community

Dear Community, since the upgrade to FortiClient 7.4.8 we have the following problem: For example some User’s use Miro Boards (miro.com). The page works normally but when you open any Miro Board it just loads infinite. When checking the Console it says: “Websocket connection to wss://miro.com/rtc-gateway/mux?client_auth_user_id=CENSORED failed”. We previously had 7.4.4 which just worked fine. Also it works when connected to the VPN or connected to the company network. because then the integrated Webfilter from FortiClient disables itself. So the Network Team made an exclusion for all Miro Domains but it still didn’t fix the problem sadly. And when I disable on my Mac the FortiClientProxy Network Extension it immediately works. Does anybody have problems like this with the new version? I just can’t seem to be able to fix that issue and it’s driving me insane because else the new version is a blessing. Much faster surfing and generally better speed. We use FortiClient EMS for centralized

We have two Fortigate 40F running FortiOS 7.6.8 in A/P HAno dedicated management interface. no ha-direct.Requirement is to poll individual cluster membersusing authenticated and encrypted SNMPv3.Polling cluster IP works.Now I used the “management-ip” feature and configured the LAN Interfaces witha cluster IP and different management-IPs.config system interface    edit "lan1"        ...        set ip 172.16.42.1 255.255.255.0        set management-ip 172.16.42.2 255.255.255.0                         ##  ( 172.16.42.3 on secondary machine)        set allowaccess ping https ssh snmp…With that setup I can accessthe currently active machine using 172.16.42.1 the primary     machine using 172.16.42.2 the secondary machine using 172.16.42.3with pings, https and ssh separately without issues.At the moment,only the snmpd on the active machine answer to queries to IP 172.16.42.1What is needed to make SNMPv3 polling to 172.16.42.2 and 172.16.42.3 work ? 

We are currently in the process of transitioning from SSL VPN to IPSEC VPN, while maintaining certificate-based user authentication. For the IKEv2 VPN between a FortiGate (ver. 7.4.13) and a native Windows client, we are using a RADIUS/NPS server for authentication. The question is: how can we define multiple user groups on the RADIUS server for the same tunnel, allowing us to create distinct firewall policies for different user groups? If we configure a global RADIUS user group (`set authusrgrp "RADIUS"`) in the Phase 1 settings, define a vendor-specific attribute for each group on the NPS, and specify a group with that name as the source in a firewall policy, the users from that group fail to authenticate—or rather, their traffic does not match the policy. Conversely, if we remove the `authusrgrp` setting from the Phase 1 configuration, the tunnel cannot be established. Is there a way to differentiate user groups via NPS?

Hi all,I wanted to see monthly traffic on my FortiWiFi-40F at home, and that grew into a full NetFlow analyzer. Since people here ask about third-party collectors from time to time, I would like to share it and hear what is missing for FortiGate users.  What it shows:  - Traffic by host, service, country and interface, with conversations and new conversations  - Path analysis: how traffic moves through your network  - Application names, if Application Control is on the firewall policies (a monitor-only profile is enough)  - Security events, PDF reports by e-mail, AD/LDAP sign-in and an API  The free Community edition has every feature and two limits: 5,000 flows/s and 30 days of history. A license only raises those limits.  This is the configuration on my 40F (FortiOS 7.4.13):  config system netflow      set active-flow-timeout 60      config collectors          edit 1              set collector-ip <COLLECTOR_IP>              set source-ip <FW_LAN_IP>          next      end

Our municipality and affiliated public institutions have invested in Fortinet equipment and solutions for over a decade. It is extremely disappointing that a mature product branch has been left with a serious, reproducible regression affecting essential public services.Technical details: OS: Windows 11 Pro 25H2 and 26H2 Product: FortiClient VPN-only (IPsec) Affected builds: 7.4.3.4726 and 7.4.3.6002 (probably all versions from ~7.4.1?) Steps: Connect FortiClient IPsec → disconnect → attempt Windows native L2TP/IPsec VPN. Result: Windows VPN fails with RAS errors 789/791. Confirmed workaround: Restarting the Windows IKEEXT service immediately restores connectivity. Network routing and adapter states appear normal after disconnect. This issue has been publicly reported since at least February 17, 2025, with no confirmed permanent fix. Even the latest security-maintenance build, 7.4.3.6002, still reproduces it.Related reports: Feb 17, 2025: https://community.fortinet.com/suppo

Our ZTNA setup suddenly stopped working, possibly after an EMS Cloud update. Everything was working fine before...Setup: FortiGate 200F HA – FortiOS 7.2.14 EMS Cloud 7.4.8 (build 2245) FortiClient Windows 7.4.8 All ZTNA connections fail with No end-point info found, but the actual issue seems to be somewhere between FCNACD and WAD.EMS is connected and verified, WebSocket is up, and the FortiGate receives endpoint UIDs, certificates and ZTNA tags.We've already collected FCNACD and WAD debug logs. Here's what we're seeing:FCNACD:ZTNA record: Exists: true, Complete: falseZTNA record is incompleteMandatory field "mac" absentError updating primary macWAD:DevQueryResp code=NoEntrydev resp is nok:1dev resp tid=0, rsp=(nil)dev tag matching, info=(nil), tag_cnt=0POLICY DENIEDWAD queries by UID and IP also return Response termination due to no more data.Interestingly, the EMS API (/api/v1/report/fct/sysinfo) returns incomplete endpoint data, missing fields like user_name, fct_ver and fct_bui

Hello,I found strange issue with FAC in Azure (from marketplace).When I am trying to do a rollback, using disks created from snapshots (OS and Date), FAC VM doesn’t start.There is an error:“Failed to start virtual machine 'fac-vm-azure'. Error: Creating a virtual machine from a non-Marketplace image does not need Plan information. Please remove the Plan information from VM”And there is no way to fix it (I tried many ways suggested by Copilot etc.).What is the solution for creating a backup (and successful rollback) for FAC in Azure ?Regards,Krzysztof

upgraded my forticlient ems from 7.2.14 to 7.4.7 then 7.4.8 . upgrade was fine. have noticed some forticlient  infomation no longer appears on fortigate yet it was therein 7.2.14. e.g version and owner are blank on fortigate yet populated on ems. how do force sync this? this information was very helpful when analyzing ztna logs on fortigate. 

I have a firewall rule which implements a web filter rule that allows only three domains and blocks all others. I also have an Application Filter which has Monitor action set for Firewall Browser and SSL applications. The firewall rule itself is set to Allow for only HTTP and HTTPS services, just to really tighten things down.The problem is that I’m getting inconsistent results from the rule. It still seems to allow microsoft.com, for example, to occasionally leak past the filter, making the strike rate of the filter somewhat 70% block and 30% pass/leak.This is with FortiOS 7.6.8. I have read through release notes and searched the forum (and other forums) but have not had any luck in finding anyone experiencing the same problem.My web filter is below. Can anyone see anything wrong with it? Are there other parts of my config that I need to post for more detailed information? Thanks in advance!config webfilter profile    edit "No phoning home URLs"        set comment "Block everything an

When I login as the ems cli user to our Fortinet provided OVA Ubuntu instance, I see this message:5 updates could not be installed automatically. For more details,see /var/log/unattended-upgrades/unattended-upgrades.log These logs appear to be hardened and not accessible from the cli.  I can access “execute ls /var/log/forticlientems/*” but not the folder holding the logs mentioned above.  I’d like to confirm what isn’t being updated from a CVE standpoint.  Does anyone know how to access these logs?

Hi All,I have a FortiGate 60F in our environment, we’re using EMS.We have significant issues with the IPSec VPN; when some users disconnect the DNS settings for our environment stick. This then causes issues accessing the general internet or reconnecting to the VPN.It seems like a known bug, but theres no fix for it outside version 8 which doesn’t seem to be available for EMS customers yet.Does anyone know of a suitable workaround for this, or anything that could be causing it? 

What is the narrowest FortiGate web filter exception for a page if the Games category is blocked? I would like to understand whether allowing an exact URL is enough or whether HTTPS inspection changes what can be matched.

Customer has their own ipv6 /48 block not supplied by isp and I am unable to establish a neighbor relationship.  ISP supplied link-local address as a Routing Object. 

Hi all,after upgrading FortiManager to 7.6.8, all installs to our FortiGate-50G devices (FortiOS 7.6.7) fail. FortiManager pushes an attribute to the default profile “custom-deep-inspection” that the 50G does not support:config firewall ssl-ssh-profile edit "custom-deep-inspection" config https set udp-not-quic allow end config dot set udp-not-quic allow end nextend---> generating verification report(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" https:udp-not-quic) remote original: to be installed: allow(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" dot:udp-not-quic) remote original: to be installed: allow<--- done generating verification report------- Start to retry --------[same result]install failedTask status: “verify state: install OK/verify FAIL” → “install and save finished status=FAILED”. No changes are applied.Running the command manually on the 50G:set udp-not-quic allowcom

Hello everyone, As for i know, REST API Administrators should be disabled by default in FIPS-CC mode:1) (REST API admin account option is not avai... - Fortinet Community)2) (Solved: Re: Fortigate 3301E missing API 7.2.11 - Fortinet Community) I'm new to Fortinet, and i'm currently configuring a Fortigate61F with firmware version v7.2.8 build9703 (FIPS-CC-72-5), downloaded following instructions from this article (Extended Support for v7.0 FIPS-CC Certifi... - Fortinet Community). Enabling FIPS mode was done via console following this guide: (How to enable FIPS-CC mode - Fortinet Community)Command "get system status" shows "FIPS-CC mode: enable"Creating an admin from:  System - Administrators - New - REST API Admin, succeed.APIs works as expected. I haven't found anything related REST API in FIPS-CC mode in the FortiOS 7.2.8 Release Note.Is this the intended behavior or i have made some mistakes enabling FIPS mode? Thanks in advance!  

Welcome to the FortiAnalyzer SOC Automation integration guide with Cisco Meraki MX device. This project provides procedures to properly configure the FortiGuard SOC Automation third-party log parser, set up a Cisco Meraki MX device to export syslog messages to FortiAnalyzer, and deploy a custom parser designed to accurately translate and map Meraki MX event types and parameters. Comprehensive documentation is included to walk you through the entire deployment process. https://github.com/ibrugnolli/meraki-fortianalyzer-soc-integration 

We are looking to replace our current Aruba switches with FortiSwitches.  Is it really required to have an active FortiCare subscription in order to just update the switch firmware?  These switches would be mangaged by our ForitGate (which does of course have an active subscription)?  We only have 2 switches and really don’t need phone support (it’s a really simple setup) or the RMA benefits FortiCare may provide. If FortiCare coverage on the switches is required just to be entitteld to update the firmware, we’ll likely just stick with an updated Aruba offering.  I haven’t been able to find a clear answer, since these would be maganged by our FortiGate (with FortiLink), if seperate FortiCare coverge for both switches is still required. Thanks!

HelloI’m new to networking and have got to start configuring Juniper switches. We already have FortiNac up and running.I know each port needs some VLAN tagged to if.So could I set all the ports at VLAN 1 (for example), then get Forti to manage the port and change the VLAN for the attached device?

Since yesterday morning a lot of websites give a 400 Bad Request ( see screenshot) when DeepInspection is enabled.Disabling DeepInspection fixed the problem.I also saw other issues relating DeepInspection(https://community.fortinet.com/support-forum-92/some-website-not-loading-with-deep-inspection-230891) But this seems to be other. We already have policy in Proxy mode en disabling AV is also not working.We use firmware level 7.4.13. More people have issues with this? 

I'm facing a strange issue with a new FortiGate VM instance running on Proxmox.EnvironmentHypervisor: Proxmox VE FortiGate: FortiGate VM Disk image: fortios.qcow2 Access: Web GUI over HTTPS Version: FortiGate-VM64-KVM v8.0.0.build0167.260420 (GA.F)IssueI created a new FortiGate VM using the fortios.qcow2 image.The VM boots successfully, and I can access the FortiGate GUI login page. I can also enter the admin credentials and authentication is successful.However, immediately after successful login, I am logged out and redirected back to the login page.So the behavior is:FortiGate GUI Login ↓Enter credentials ↓Authentication successful ↓GUI starts loading ↓Immediately logged out ↓Redirected back to Login pageThere is no normal session timeout involved because the logout happens immediately after login.Troubleshooting already attemptedI also tried increasing the administrator timeout:config system global set admintimeout 30endHowever, this did not res

We have a user with the following admin profile that is not able to push Fortiswitch config from Fortimanager We first thought that maybe the firmware was an issue since the move to Fortigate 7.4.13, but my admin account and other’s works just fine. The error message from the non working user doensn’t tell much neither. We haven’t changed any config before it stopped working for them. The user does changes manually to switch ports and isn’t using any template for them.  Fortimanager is on 7.6.8 if that’s relevant. Any tips would be very appreciated!

Can a FortiExtender managed by a FortiGate and configured as a WAN extension, also be managed by FortiManagement Cloud and provide out-of-band management (OOBM) access to the FortiGate?If not, do I have any other options for OOBM via 5G?

After upgrading a FortiGate HA cluster to FortiOS 7.6.8, the HTTPS GUI was no longer accessible. Browsers returned ERR_SSL_PROTOCOL_ERROR, while curl reported SEC_E_DECRYPT_FAILURE.The GUI worked when TLS 1.2 was explicitly enforced. The issue was resolved with:config system global    set admin-https-ssl-versions tlsv1-2    set tls-session-cache disableendA reboot was required for the TLS session cache change to take effect. After the reboot, the GUI was accessible again.Is this a known issue in FortiOS 7.6.8?

I'm in an awkward position where our pair of 1000D's goes end of Life in April 2028 so I need to look at a replacement soon.My issue is that I need a Fortigate which can do more than 50 VDOMs and as such despite being more powerful the 900G series won't work.So with there being no announcement for a 1000G what is the alternative for replacing the 1000D? The 1000F is now marked end of sale and has an end of support date of 2031 so I definately don't want to go down that route.Is the only option to get more of the smaller units?

Created new IPSec Tunnel (remote access)Client directly connected to internet able to connect to IPSec VPN.Client connected to internet but behind CGNAT, failed to establish and connect to IPSec VPN.Forticlient 7.4.3.6002Fortigate 7.6.8 Is it possible for clients behind CGNAT to connect to IPSec VPN?