Fortinet Community

Hi,I am currently experiencing issues with FortiClient version 7.0.0 and FortiClient version 6.4.9 installed on a Windows 7 machine. A group of users is configured to not have internet when connection to vpn. On one of them, when I connect to the VPN, it allows both VPN and Internet connections simultaneously, which should not be happening. This user is on the same group with others. I’ve tested the same user on another PC, and it behaves correctly, not allowing the Internet connection while connected to the VPN, so I am confident this is not a firewall issue.

Can I check is there any connection speed difference between the free VPN only client vs the full client?I have a few users which used to use some older i5 laptops with 16gb ram running the full version FortiClientSetup_6.0.9.0277_x64 because the old full version is free.Now have done a hardware refresh for these few users with newer i5 laptops with 16gb ram running the free VPN client FortiClientVPNSetup_7.4.0.1658_x64.These users are complaining that the new laptops are slower when opening up files from mapped network drives. Says that the older laptops are faster when performing the same task?Is there any speed difference between the free and full vpn clients?Thanks

Hi, before getting crazy with all this (I am nearby) ...  Maybe, someone has an idea.We have a Fortinet EMS with ZTNA support enabled;We registered an Android Device and a Windows 11 Client for testing purposes. a) Android Phone (Android 14) does not seem to receive a cert, it is always shown as revoked. CA was already manually installed on the Phone, no change. b) Software Inventory works now. On the Cloud, we are on Forticlient EMS 7.2.4 and requested an upgrade to 7.2.5, and on the clients, we use the latest available packages for the FortiClient. Any help would be nice. Ronny

Is there a way to block sources by their ISP name? We have an issue with skimmer bots attempting authenticate against our VPN server, constantly locking out accounts that we use. Even though these accounts don't have VPN access, the FortiGate still passes through the login attempt to the DC.  We already have connections geo-blocked, but the geo-block feature is useless now that foreign bots just use a VPN service to tunnel into the U.S. before attacking our firewall.  Grabbing the IP addresses from the logs and running a geo-lookup on them, I found that all of them are coming from different VPN providers. Blocking these by the ISP name or even whitelisting certain ISPs should fix this issue if it's possible on FortiGates.I'm using a FortiGate 100E.  Thanks for any help with this. 

After we upgraded Win10/11 clients to the Forticlient 7.4 version, we experienced the forever connecting issues like others. Additionally, we found that after supplying the fortitoken on the first connection, the subsequent attempt did not prompt for a token/code. This was repeatable behavior on the 7.4 client and occurred after an immediate reconnect and rebooting before reconnecting. We worked with support to troubleshoot and found that backing down to Forticlient 7.0.13 resolved the connectivity and token issues. We do not pay for client support so our tech was unable to reach out to the client team on this MFA/token issue.  Has anyone else experienced this behavior in Forticlient 7.4? Reinstalling the redistributable did not help with these issues either.

 Hi,I am using a FortiNAC-CA 7.2.4 (FortiNAC-OS) with a basic FortiNAC license. Network Infos:The FortiNAC is connected via cable to a switch and terminates on a FortiGate through port6 (0.0.0.0/0) with a VLAN stub and VLAN Isolation. I have configured port1 for MGMT (Layer 3) and port2 in L3 Isolation mode, with an IP on the VLAN stub and a Range Scope for the VLAN Isolation. The FortiGate acts as a DHCP relay towards the IPs of the FortiNAC (both port1 and port2). FortiNAC infos:I created two groups (MAB_VLAN2 and MAB_VLAN3) and two roles (ROLE_VLAN2 and ROLE_VLAN3). I then set up user configurations with the following logic:If the user does not belong to the groups VLAN2, VLAN3, or Registered_Host → Logical Network IsolationIf the user belongs to group VLAN2 and has ROLE_VLAN2 → Logical Network VLAN2If the user belongs to group VLAN3 and has ROLE_VLAN3 → Logical Network VLAN3I am using a test switch and a test PC, and from manual testing, it seems everything

Hi I'm trying to migrate from EMS 7.2.5 to 7.4. I have gone through all the steps in the Admin guide and have now hit a brick wall.  I am getting an error "Authentication (publickey) failed" and "encountered RSA key, expected OPENSSH key" and the migration is failing. I found this article at  https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Getting-an-error-when-performing-EMS/ta-p/328415 which did help with another error I had. However, the article just says to the generate the public key, which I have done and re-done several times with no effect.  Has anyone had this issue? Can anyone help please? ThanksRoy

Hi,Good day everyone.I would like to seek your assistance as networking is the least of my professional skills :(Currently, I need to transition the current Internet Line from existing different ISP to another one for one of our remote office but at the same time, let the other old Internet Connectivity up for the time-being.The old Internet Line (A) is connected to WAN1 of the firewall, and has existing site to site VPN.The new Internet Line (B) is connected to WAN2 of the firewall. The Internet Line (B) connection has it's own router and the PublicIP is NAT'ed to 192.168.1.2 - connected to WAN2 which now has 192.168.1.3 IP.My question is, what is the best approach for this? I would like to set-up WAN2 (Line B) as the main line and also set-up site-to-site VPN but at the same time, retain the existing line A as the backup temporarily in case for 2 months before totally discontinuing it if all works well. ...How can I do this? Thank you!!! FortiGate 

Hello Community,our FortiGate blocks access to Dropbox by the Category "File Sharing and Storage", this is ok.However, I need access to Dropbox from my PC. So I created a Firewall-Rule to allow Dropbox-Web from my PC.But this rule didn´t work.When I try to access Dropbox, I still get the message that the access is blocked by Category.Can anyone help me?Kind regards,Christian 

I have log lines that I want to parse to JSON using Regex. I can now parse 99% of all logs, but the regex failes on a few log lines! I need help to complete the regex.RegEx so far: <(?P<priority>\d+)>(?P<timestamp>[A-Za-z]{3} \d{2} \d{2}:\d{2}:\d{2}) (?P<hostname>[^\s]+) date=(?P<date>\d{4}-\d{2}-\d{2}) time=(?P<time>\d{2}:\d{2}:\d{2}) devname=\"(?P<devname>[^\"]+)\" devid=\"(?P<devid>[^\"]+)\" eventtime=(?P<eventtime>\d+) tz=\"(?P<tz>[^\"]+)\" logid=\"(?P<logid>\d+)\" type=\"(?P<type>[^\"]+)\" subtype=\"(?P<subtype>[^\"]+)\" level=\"(?P<level>[^\"]+)\" vd=\"(?P<vd>[^\"]+)\" srcip=(?P<srcip>[^\s]+)(?: srcport=(?P<srcport>\d+))?(?: srcintf=\"(?P<srcintf>[^\"]+)\")?(?: srcintfrole=\"(?P<srcintfrole>[^\"]+)\")?(?: dstip=(?P<dstip>[^\s]+)(?: dstport=(?P<dstport>\d+))?)?(?: dstintf=\"(?P<dstintf>[^\"]+)\")?(?: dstintfrole=\"(?P<dstintfrole>[^\"]+)\")

How to convert the FortiGate firewall logs in csv format, please provide the solution.

Hi,we play around with ZTNA and I am not sure, if I am to silly ;) or I have a single point of missing knowledge or misconfiguration. Our Setup:2 x FGT (HA) -> Fortiswitch (VLAN) <-- fiber, with transfernetwork --> FortiSwitch (VLAN) -> 2 x FGT (HA) Some hints:- we use a Fortiswitch on each site, we have a highspeed fiber ($$$) and this is just in place once, so for HA purposes on the FGT, we use this Fortiswitch,- the VLAN is configured with same ID on both sites and dataflow works - we need at both site a full FGT cluster, to setup local ip settings, manage the local switches and can run both sites without interruptions if one site fails (we have a fallback route on site A to reach site B)- first idea was, to manage *ALL* switches and networks from site (B), this would work, but then, we can not manage the setup on site (A) if there will be any problem with site (B). And now, the fun begins...We setup a simple EMS Cloud to fulfill ZTNA. a) Normall

Hello everyone, I'm facing an issue after enabling VXLAN over IPSEC and creating software switches on my FortiGate. I have several scripts that connect to various Microsoft services (e.g., Office 365, Azure), and they were working perfectly before these changes. However, since enabling VXLAN over IPSEC and configuring the software switch, the scripts are no longer able to connect to the Microsoft services. If I remove the VXLAN from the software switch, the scripts start working again, which suggests that the problem is directly related to the VXLAN configuration or software switch. Does anyone have suggestions or insights on what to check in the VXLAN over IPSEC or software switch configuration that might be causing these connection issues? Thanks in advance for your help!

Hi there, What is the default timeout for ipsec vpn users. How can I set timeout for vpn users if user is doing any activity from the vpn.  Note - we are using dialup vpn in fortigate firewall.

For example, for TLS 1.2, i want to enable / use only these cipher suites and in order / priority. Meaning that all other TLS1.2 not in the list below, will not be accepted / allowed. Is there any possible way to do so, if so how? If not, what would be the best / closest method in achieving something like this or similar. THANK YOU SO MUCH!!! I really appreciate any sort of help.TLS1.2 Ciphers1 TLS_DHE_RSA_WITH_AES_256_GCM_SHA3842 TLS_DHE_RSA_WITH_AES_128_GCM_SHA2563 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA2565 TLS_DHE_RSA_WITH_AES_256_CBC_SHA2566 TLS_DHE_RSA_WITH_AES_128_CBC_SHA2567 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA3848 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA2569 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA10 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA    

Hi So we had a test AP setup in Fortigate under a physical interface with a guest and a staff WIFI setup - all worked correctly and correct DHCP IP assigned. I have since connected a Fortiswitch, i have created a new VLAN and took the IP address and range from the existing physical guest VLAN and used that on the new fortiswitch VLAN (then changed the address on the physical)the AP is up + online, I can see both SSID's, but when I attempt to connect to the guest WIFI I get a random IP address on the wrong subnet an the device never connects.....log states 'Wireless station DHCP process failed with no server response'  I have adjusted all policies to allow traffic as far as I can see. Any ideas? Thanks.  

Hello All,Could you kindly assist with a document or guide from Fortinet outlining best practices and recommendations for hardening the configuration of a FortiGate firewall, specifically for the 60E model? I'm particularly interested in configurations involving services such as Malware Protection, IPS, Antivirus, URL filtering, DNS filtering, VPN, Policies and other security features.Your assistance is greatly appreciated.

Hi, After configuration, I would try to login to the Forticlient VPN 7.4.0 with my account. But the sign in pop-up is redirecting to the email login again and again. My PC is Windows 10.What should i want to do. Redirecting pop-up Thank you,Chaniru Manamperi

Dear All,I would like to migrate to a stacked vdom with the root learning a BGP default and relaying this to around 10 sub-vdoms via an inter-vdom link with an iBGP peering across the inter-link. I need to get around 10-15 Gbits though the platform as a whole with Jumbo frame support and I'm running the v6.0.3 train. Having prep'ed the config, then I read that my 1500D platform would not be hardware accelerating any more than 2x links.  As an alternative, I believe I can patch fibres between some of the physical ports and land these into different vdoms using 1.q subinterfaces. For resilience and improved speed, I would also like to make this a LAG. Could anyone tell me please:1. Is this approach of trunking multiple vlans across a physical cable for the physical inter-vdom link viable?2. Is LACP possible between the vdom and are there any concerns like mac address or system id?3. I use FGSP (and have a longer AS_PATH via the standby unit), is this compatible? 

Dear Hi,Fortimanager 7.4.4 VPN manager Portal settings changes are not shown in the install wizard the changes are not shown in the install wizard unless I remove the SSL VPN portal from the device in the SSL VPN settings edit the portal then add it again to the firewall. 

Good morning, We have an issue that showed up this week (Tuesday) with two users VPN'ing from home.  They are getting a "The server want to connect to requests identification, please choose a certificate and try again. [-5]" error.  Interesting thing is that I don't require nor have we set up client certs for SSL VPN and it's only 2 users out of about 15 right now that are getting the error.  We are running a mix of Forticlient versions (6.0.9, 6.0.10 and some 7.2 versions) and don't have a support contract on the clients.  Another interesting thing is if we uninstall and remove it completely from their PCs  (Windows 10 and 11 are the two OS's) and install a new version as a test, it gets the same error.  Also...using a different Windows profile fails as well.I found this article and followed the instructions and it's still not working: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-solve-The-server-you-want-to-connect-to/ta-p/1

This is lab work. I'm clustering 2 VM to simulate a customer environment. I have some 60day licenses of FGWhen I bring them together, they do not sync due to some config differences on the new unit ( dns and a few interfaces ).1) is the a way to force the established unit just to overwrite the new one ?2) In accordance with FortiGate's guidelines, I factory defaulted the new unit, but at this point, the serial number changed and the licence was lost. Any attempt to restore the licence now fails ( probably as a result of the new serial number ).  Any guidance on how I can progress is much appreciated. FortiGate-VM64-KVM # execute ping service.fortiguard.netPING guard.fortinet.net (208.184.237.61): 56 data bytes64 bytes from 208.184.237.61: icmp_seq=0 ttl=45 time=146.8 msRequesting FortiCare license token:xxxxxxxxxxxxxxxxxx proxy:(null)Forticare response error 58.Failed to download VM license.

I can not get this figured out.  I’ve got a FortiGate running v7.2.9 (also tried with v7.2.8) and I’m trying to configure our SSL VPN to use an external DHCP Server to assign our clients IP addresses.  I followed the instructions outlined here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 The SSL VPN Clients are able to connect to the VPN and do successfully obtain an IP address from our DHCP server, along with the correct DNS servers, however, the clients are not able to access anything at all once connected.  The clients get assigned the proper routes to get to our internal LAN and WAN (confirmed by checking print route on the clients), so no problem there.  I have firewall policies in place to allow traffic from the SSL root to the LAN and WAN.  Nothing is showing up in the firewall logs as being blocked and the hit count/bytes are increasing (indicating the policies are being hit).  If I d

I have a Fortigate F2K60FTK21900432 Fortigate proxy.We have explisit-web-proxy policies that we normally use and its logs are sent to FortiAnalyzer . example : But we also have the Implicit Deny policy found in Firewall Policy. My problem is that the logs of the latter (Implicit Deny - Firewall Policy) appear in FortiAnalyzer and I do not want to have them because they generate confusion when analyzing the traffic in Fortinalizer.Question: how can I prevent these logs from not being sent to Fortianalyzer.Thanks for your help team