Fortinet Community

Hi all, We don't have EMS and I've managed to push out a new IPSEC connection to the machines via group policy but obviously as the pre-shared key is encrypted it then creates a random one on each machine so has anyone found a way to do this using group policy at all. We are using the free VPN from Fortinet and not the Windows native one.Thanks

Fortinet TAC has also reviewed the case and confirmed that they cannot see any SMTP traffic leaving the FortiGate.At this point, it appears that the email notification process is never invoked even though authentication reaches the "Token is needed" stage.Hi everyone,I am facing a very strange issue on a FortiGate 601E running FortiOS 7.4.12 (build 2902).Environment- FortiGate 601E- FortiOS v7.4.12 GA build 2902- Multi-VDOM enabled- Root VDOM hosts the SSL VPN- SSL VPN authentication uses Local User + Email-based Two-Factor AuthenticationSymptomsThe SSL VPN login works normally.After entering the username and password, the SSL VPN client displays:"An email message containing a Token Code will be sent..."The System Event log also records:"Send two-factor authentication token code"However, the user never receives the email.What makes this strange is that FortiGate never attempts to establish any SMTP connection.Troubleshooting performed✓ Local user configured with:set two-factor email✓ E

Hello everyone,We’re currently preparing to deploy a larger FortiSwitch environment and are discussing the best way to get started with Dynamic Port Policies.The environment consists of two FortiSwitch 2048F switches as the core and about 20 access switches. The access switches will connect primarily standard clients, printers, Swyx DECT base stations, Raspberry Pi systems, a total of about 40 FortiAPs, and other IoT Devices. However, the APs are distributed very unevenly across the access switches—some have no APs, while others have five, for example.Currently, network segmentation is still very straightforward. The majority of the servers, clients, printers, etc., are still all located within the same network 172.16.0.0/16. Although there is already an organizational address allocation within this network—for example, servers are primarily in 172.16.0.x and clients starting at 172.16.100.x—technically, it is still the same network.A few true VLANs already exist, for example, for Wi-F

so i just got a free ems cloud license using my fortigate cloud and it gave me 3 endpoint i was asking if i transfere the fgt to another account do i lose the trial license or not or could i just activate it again i hope someone have a clear answer i m doing a demo for a client any help is appreciat

Greetings,Looking for advice on best way to migrate from current Palo Alto in Azure to FortiGate.Can it be deployed into the same subnets, or does it need to be in new subnets same vnet?Thanks!-Greg

So how are we all doing SSO user authentication on InTune/Entra joined clients going through an on-prem Fortigate?For many years we've been using the DC SSO agent to authenticate users on domain-joined devices, but now with clients moving away from local AD and so no longer domain-joined so not authenticating on the on-prem DC, this obviously makes the DC agent redundant.I'd rather avoid a captive portal if possible since that's a bit of a step backwards from the nice slick SSO solution we're used to, so what's the most elegant way to do SSO authentication to an Entra 365 account? 

Hi,Has anyone else experienced traffic issues with FortiOS 7.6.6 on hardware models other than the 201G?On our 201G, we experienced delays and random disconnections, and Support recommended setting no-acceleration on the specific policies where the issue occurred.We are planning to deploy the 701G soon, so I would like to understand whether similar issues have been reported on other hardware models as well, especially the 700G/701G.

We're building a cryptographic-discovery capability that ingests firewall SSL/TLS-inspection logs. The device is a FortiGate 90G (we don't have the exact FortiOS version yet, so please note any version dependencies).Could you confirm:With SSL/SSH inspection enabled, what cryptographic detail do the UTM/SSL logs contain — TLS version, negotiated cipher, key-exchange protocol/curve, auth/signature algorithm, and server-certificate details (subject, issuer, validity, fingerprint, key alg/size)? Which FortiOS version is required for the full SSL certificate/handshake/negotiation logging (the ssl-server-cert-log / ssl-handshake-log / ssl-negotiation-log options)? Do the logged fields differ between certificate inspection (no decryption) and deep inspection, and what is logged for TLS 1.3? Export options for these logs — syslog (JSON/CEF), FortiAnalyzer, and any REST API for pulling logs — plus the field names/format so we can parse them.A sample log line or a link to the field reference wou

I add Fortigate to the Fortinac and why i get below event? Actually the Fortinac connect to the Fortigate using SSH and not telnet. 

Hello, I am working on deploying Data Loss Prevention through our Fortigates in our organization. So far it has worked pretty well, and I was beginning to look at using a EDM template of Medication names provided by the FDA so that we can use it as a possible match of uploaded PHI.Currently I am running into a issue with the EDM template parameters, where it will not match against anything using the edm-keyword data type. Using a test CSV with a fake SSN, the ssn-us keyword does work, but nothing I try with edm-keyword works. I know that the file be checked against the DLP profile by checking the logs. I have tested this with dlptest.ai by Fortinet and also other sites we are wanting this DLP filter on. DLP works otherwise as well, the other rules I make are working, just not the EDM template in the way I want to use it. The Fortigate I am testing with is running 7.4.11, this is temporary though as we are working to move to 7.6.x as we move away from SSL VPN.Am I missing something in t

Hi All, VersionFortiGate-81F v7.4.8,build9191,260511 (FIPS-CC-74-8)FIPS-CC mode: enableFortiSwitch-148F-FPOE v7.4.8,build0929,250909 (GA)Security mode: none In our environment, Federal Information Processing Standards (FIPS) is required due to the contract we have. I have been running into the following issues while testing FIPS mode on our equipment.The FortiSwitches appear under Managed FortiSwitches. I can see the firmware version, status, and join time, but I cannot SSH into the switches from the GUI. It also does not show the Connecting From status or the switch IP address.Under FortiSwitch Ports, the port connecting the FortiGate and the FortiSwitch shows as down. When I assign a VLAN to a FortiSwitch port, the VLAN assignment is accepted, but it does not actually take effect on the connected device.However, from the FortiGate CLI, I can SSH into the switch without any issues. The switch status is visible, but it appears that the configuration is not being fully synchronized to t

I believe when we add the switch to the fnac for 1st time then fnac inventory will collect below data such as Name, Default Vlan, Current Vlan from the switch. When we have changes on the switch, example i make port description and change the default vlan then why in the fnac is not updated? Resync the interface is not helping  

Hello, I would like to clarify the expected FortiGate behavior when a FortiGuard/UTM license expires. Our FortiGate 81F had a UTM contract that expired on August 6, 2026. A new license contract was purchased/renewed on Friday, but the new contract has not yet been activated. After the previous contract expired, Internet traffic through one of our existing firewall policies was blocked. Basic websites could not be accessed. The affected firewall policy had the following security profiles enabled: - AntiVirus - Web Filter - DNS Filter - Application Control - IPS - File Filter When we disabled these security profiles, Internet connectivity immediately returned to normal. Fortinet Customer Service stated in the support ticket: “internet connectivity will not be affected due to the absence of a license.” They also stated that basic firewall policies that do not rely on subscription-based security services should continue to function. Therefore, I would like to understand the technical behav

Hello, I am able to configure OSPF over IPSec tunnel, but: - I have another OSPF interface (through a physical interface) with lower cost that is Up and routes in the routing table are using this preferred link with correct cost.- When the IPSec tunnel comes Up, the routing table is modified; routes are now using the IPSec interface although I have defined a higher cost for the VPN interface... looks like something is forced. Has anyone come across a similar situation?  Thanks, Monty.

Hello PAM adminsFortiPAM 1.4.1.I'm very new in FortiPAM and I have questions regarding Web launcher.When I'm in company's local network all works fine, Web launcher, RDP launcher and SSH launcher.However when I'm outside and connect from public IP and try run Web launcher it doesn't work, while SSH launcher and RDP launcher still work fine.I noticed that for both RDP and SSH launcher, PAM opens the browser tab with address bar contains a public address like https://pam.mycompany.com/someaddress.While for Web launcher it opens the private IP of the target, which naturally can't work from WAN without some proxy on the client.If I'm not wrong I think it needs FortiClient in order to work, right?So my question:Does it work with FortiClient for Windows, Linux & MacOS?Does it require EMS?Is there a plan to make it work in future release without FortiClient? (other PAM products can do it without agent)

We encountered some issues accessing some URLs after upgrading from 7.2.12M to 7.4.12M using FGT401E on HA.applications like MS Teams get disconnected suddenly and users reported that access to some external portal become very laggy.upon checking the traffic log, we noticed that the Application name was classify as 2x which is a service group in our firewall.under this group, there is HTTP, HTTPs, TDP, 2X publishing agent port and 2X terminal server agent port.due to the many issues encountered, we have rollback to 7.2.12M 

We have identified duplicate endpoint entries in our EMS console and, to manage them, we created two separate groups: one group in Domain and another group in Workgroup.We are able to delete the endpoints that are listed under the Workgroup group without any issues. However, for the endpoints that are present in the Domain group, we do not see an option to delete them. Additionally, we are unable to move these endpoints from the Domain group to the Workgroup group.Could you please let us know:Is there a way to delete the endpoints that are currently listed under the Domain group in the EMS console? What is the recommended process for moving endpoints from the Domain group to the Workgroup group?Any guidance or best practices to resolve these duplicate entries would be greatly appreciated.Thank you.

When i have a new ipphone connected to the network then fnac will move this ipphone to registration vlan before device profiling is running. After device profilling run then i can see the ipphone move to host role ‘IP Phone’ and registered’But after the devices was profiled then how the vlan can be changed automatically to voice vlan? The only way the ip phone get the voice vlan after the ip phone registered by profiling is reboot the ip phone.

Hi everyone,I am attempting to set up a new IPsec VPN connection using the standalone FortiClient VPN only v7.2.1.0779 app, but several configuration options appear to be missing from the user interface: Missing Single Sign-On (SSO): When creating an IPsec VPN profile, there is no option or toggle for Single Sign-On (SSO / SAML) anywhere in the GUI. Missing Mode Config Parameters: Under Address Assignment, selecting Mode Config does not reveal options for Encapsulation, IKE UDP port, or IKE TCP port. Any insights or guidance would be greatly appreciated. Thanks!Missing option in my appSSO setting i expectedMode configuration setting i expected 

My Fnac license 106 is in use, how we can know detail which endpoint is consume the license? 

hello everyone,i am setting up a home lab and recently acquired a fortigate 60d rugged.i tried to reset it using coolterm on my mac and after the proccess it just got stuck on system halted, now its “bricked”i am trying to find a way to get it back up and running and i am fully aware that this product is an end of life model. tried also customer service and dident help. any help will be great!

Hi, we were an on-prem only company. Earlier this year we went hybrid with 365.For VPN earlier we had our clients connecting through forticlient with AD credentials leveraging RADIUS. No MFA.We then configured a parallel setup using IPSec ike v2 and authentication with EntraID, adding the MFA feature then.My question is: is this the natural approach that most of the former on-premise companies adopt once moved to Cloud or are there other suggested setups, maybe leveraging already existent on-premise RADIUS infrastructure? 

We can select 802.1x authentication set to user or computer if we use wired. How about for wifi? There is no option to select that option on the wireless card properties.

Hello Community,We are currently encountering a known limitation with the standalone (unlicensed) FortiClient app on Android. When attempting to connect to an IPsec IKEv2 VPN using a Pre-Shared Key (PSK) alongside EAP user authentication, the client fails to render the username and password prompt during the connection sequence.This behavior aligns with the issue documented in the following Fortinet Knowledge Base article:Troubleshooting Tip: FortiClient VPN without license on Android has missing username and password promptDeploying FortiClient EMS or reverting to deprecated IKEv1 for a single mobile endpoint is not feasible for our environment. As a result, we are looking for advice on the following: Alternative Client Apps: Are there recommended third-party IPsec IKEv2 clients for Android (e.g., strongSwan, native Android VPN setup) that can successfully handle PSK + EAP/XAuth user authentication against a FortiGate without modifying the core gateway configuration? Configuration W

This week's updates center on new solution pack content in FortiSOAR™, extending automation into network operations and virtualization management alongside a set of new and updated connectors.Three new solution packs arrive this week. NetOps - FortiManager ZTP v1.0.0 brings zero-touch provisioning workflows into network operations scenarios, while VM Lifecycle Management v1.0.0, paired with the new Proxmox VE Hypervisor connector, establishes automation coverage for virtual machine provisioning and lifecycle tasks. A further remedial pack, Outbreak Response - WP2Shell RCE v1.0.0, extends the Outbreak Response framework to help teams counter this vulnerability.On the connector side, Fortinet FortiSIEM v6.2.0 continues the refinement of Fabric integration for security monitoring workflows. Two additional integrations join the ecosystem, Forcepoint NGFW SMC for firewall management and the Ping connector for network reachability checks within playbooks. Updates across mobility management,