Fortinet Community

Hi guys,I’ve been assigned a project where I need to migrate an existing Fortinet SD-WAN environment BGP on overlay to BPG on loopback, and I would like to gather feedback from anyone who has already dealt with a similar scenario because i did not find documentation about this process to be honest.The current setup consists of a dual-hub architecture where SD-WAN is implemented with BGP running directly over the overlay, using IPsec tunnel interfaces.All routing decisions are tightly coupled with SD-WAN members, and the entire environment is running FortiOS version 7.6.7 on both hubs and spokes.The target design is to move away from BGP on overlay and go to BGP on loopabck.Since I have not found much detailed documentation covering this specific migration path, I am trying to better understand the best approach before proceeding.In particular, I am interested in knowing whether it is feasible to have a parallel environment, i have 100 sites, so is it possibile to migrate a couple sites

How do I Configure server to reject HTTP/1.0 requests with "505 HTTP Version Not Supported" status and enforce minimum HTTP/1.1 protocol version?  I am using Fortigate 60f and I need to make necessary changes so that my Merchant Service PCI Compliance passes.  This is the last setup that I need and would like to make the fix with GUI, not CLI.  Any help would be great appreciated.

Greetings,I am trying to find relevant documentation on how to configure rds nps to communicate with forti authenticator as a 2fa method.Thank you in advance for your support.

Dear Technical Team,I am writing to report an issue regarding TightVNC connections established through FortiPAM when using a guest user account.Issue DescriptionWhen attempting to initiate a TightVNC session via FortiPAM using a configured guest user, the connection fails to establish. "connection has been gracefully closed".Normally we succeeded in web VNC. But we face issue while using TightVNC with guest user.Environment DetailsFortiPAM Version: 1.8Could you please assist in verifying if there are known bugs regarding guest user token lifetimes, or specific configuration policies required to allow guest access for VNC proxies in this firmware version?Looking forward to your guidance.Best regards,Dev Singh KhadayatSystem EngineerGrantha Networks Pvt Limited 

Hi Fortinet Community,I need some advice regarding FortiClient on a Linux server.EnvironmentI am using:OS: Ubuntu Server 24.04 without GUI Use case: connect to an external partner’s VPN The partner only supports clients using Fortinet VPN client Current package: FortiClient VPN-only 7.4 for Linux Previous package: I previously installed the paid FortiClient edition version 7.2 from this page: https://www.fortinet.com/support/product-downloads/linuxPreviously, I installed the paid FortiClient edition, but the VPN could no longer be used because there was no license. Since I only need VPN connectivity to the partner, I replaced it with the FortiClient VPN-only version. I currently connect using a command similar to:forticlient vpn connect vpn-profile -u users-vpn -p -w -a -sThe VPN connection can be established, but I am facing several issues and have some questions. QuestionsImpact from previously installed paid FortiClient Since I previously installed the paid FortiClient version 7.2,

Dear communityI likely have a very specific issue that might be completly "normal", I just want to make sure I have my bases covered... Situation:We have two clusters (four fortigates in total) in two different data centers (dc 1 and dc 2). About a dozen of VLANs are connected to both of these two clusters and we use VRRP spanned over these vlans to ensure usage of both clusters.The first three IPs in each vlan is ours - the .1 is the VRRP IP that is active on the master, .2 is the cluster on dc 1 and .3 is the cluster on dc 2. Now we run into asynchronus routing with a specific use case:There are location specific networks (one for dc 1 and one for dc 2) that access the respective local fortigate cluster and are allowed access to the attached vlans.If you happen to be in the location where the VRRP master is, then everything works. You can access the local fortigate cluster (which is vrrp master) and access the hosts in the vlans. No Problem.If you happen to be in the other

My organization has been using FortiClient free version for the past 5-6 years. I have been following the semi-official deprecation of the free version for the past few months. We have been using 7.4.3 now for a few weeks.Now FortiClient 8 has been released and I see no free version (what I assumed would be the case).Quantum Cryptography is becoming front and center in planning for our future with Google and Microsoft saying they should be fully or mostly using PQC by end of 2029. Naturally, FC 8 has PQC support.I wonder what everyone else who is or recently was using the FC free version is planning to do.I know we could get a license for on-prem EMS (but that would be another server to setup and maintain for our small team and there were just two high profile vulnerabilities in it just a couple months ago), or get Fortinet Hosted EMS (but not sure of the price with that), or drop FC altogether and go with a different VPN solution or SASE option etc.We have two dialup IPsec tunnels rig

Hi Fortinet Team, FortiClient EMS certificate not authorized..I am experiencing an issue connecting my FortiGate-90G to an On-Premise FortiClient EMS server via the Fabric Connector. The connection fails with certificate verification errors.Environment Details:FortiGate Model: FG-90G FortiGate and EMS Location: Both devices are in the same local subnet (192.168.2.x). DNS Setup: Configured via a Local DNS Database entry on the FortiGate, pointing the FQDN to the local EMS IP. Pings to the domain name resolve correctly. EMS Certificate: A valid Public Domain Certificate issued by RapidSSL / DigiCert (Domain: winxsfp.com). Symptoms & Errors Observed:The Fabric Connector GUI shows an "Untrusted Certificate" status. I have disabled strict common name checking using the set trust-ca-cn disable command under config endpoint-control fctems, but the issue persists. Running the verification command in the CLI results in the following error output: text FortiGate-90G # execute fctems verify 1

I had automatic updates turned on on my fortigate 60F. After Installation of OS 7.4.12 none of my VPN-Clients were able to login anymore. No idea why. Reverting to 7.4.11 resolved the problem. Does anyone have an idea what exactly caused the problem? I am not an fortigate expert but that a minor update to the os breaks a basic functionality, at least on my device, doesnt make me happy. First thing i learned was turning off automatic updates. But thats not a longterm strategy.  

Hello,we have upgraded our FortiClient EMS Cloud instance to 7.4.7 recently, and we can’t seem to upgrade our FortiClients, because we are unable to choose a FortiEDR engine.The dropdown menu to select an engine version for the FortiEDR feature has nothing to select. Even when dropping down to other FortiClient versions we can’t pick any FortiEDR engine version. The fabric connection between the FortiEDR Cloud and FortiClient EMS Cloud instances are up. The installer is for regular Windows Clients.The same problem goes for our customers FortiClients EMS Cloud instance. So it seems to be a problem with the 7.4.7 version of FortiClient EMS Cloud?Also, the docs page for FortiClient EMS is currently down with the code 500 internal server error. So we can’t even look up known issues for the new FortiClient EMS version.

we have recently deployed a new FAZ300G analyzer to replace our old 200D.For internet traffic for the analyzer, what are the recommended URL or internet service that is required/permitted for the analyzer to work properly.

I've got a user whose IPsec Remote Access VPN won't ping out when connected. It can access a file server via IP address (despite failing to ping it), but it's not able to get DNS, nor can I ping the DNS server or anything external.The FortiGate is a 90G on 7.4.12, using the latest FortiClient VPN Only version (7.4.3.8758). There are a dozen or so other users currently using the same VPN connection, and I've confirmed that the policies haven't changed.As soon as we disconnect VPN, normal web traffic resumes, including the ability to ping.Any ideas? 

 FortiToken Mobile (FTM) push notifications provide a convenient MFA experience, but many organizations want additional controls to ensure push authentication is only available from trusted network locations.A simple way to reduce the attack surface is to route FortiToken Mobile push traffic through a dedicated loopback interface and then control access using firewall policies. This allows administrators to limit where FTM push requests can originate, such as corporate Wi-Fi, internal LAN segments, or approved VPN networks. Step 1: Create a Loopback InterfaceCreate a loopback interface that will be used exclusively for FortiToken Mobile communication.config system interface edit "FTM-Loopback" set type loopback set ip 10.255.255.1/32 nextend Step 2: Configure the FTM Push ServerConfigure the FortiToken Mobile push service to use the loopback address.config system ftm-push set server-ip 10.255.255.1endThis forces FTM push traffic through a dedicated interface that

Trying to get FortiGate VM 7.6.7 registered and controlled by FortiMan VM 7.6.7Cert is used as part of the authentication, the serial number is expected to be in the cert as the CN, but its not  We can see this by using debugs   diagnose debug resetdiagnose debug enablediagnose debug application depmanager 0diagnose debug application depmanager 255diagnose debug enable  Clearly the serial number is required   { "id": 1, "result": [{ "status": { "code": 5, "message": "device serial number conflicted"}, "url": "start\/probe\/session"}]}We can get passed the serial number issue by creating a new cert  i found that i have to use this low key size of 512, anything higher wont be accepted   openssl req -x509 -newkey rsa:512 -nodes -keyout fmg_tunnel.key -out fmg_tunnel.crt -days 365 -subj "/CN=MYSERIAL/O=Fortinet/OU=Lab"openssl pkcs12 -export -legacy -out fmg_tunnel.pfx -inkey fmg_tunnel.key -in fmg_tunnel.crt and now the issue is different  { "client": "\/bin\/dvmcmd:5115", "id": 2, "method

FortiAuthenticator Cloud – End of Order Announcements                                            2nd July 2026 It has been announced on support website (https://support.fortinet.com) that FortiAuthenticator Cloud (formally known as FortiTrust) has come to End Of Order (EOO) as per date below. Customers are encouraged to move to FortiIdentity Cloud (FIC) for SaaS-based identity solution. Replacement SKUs are as follows: Current SKU Description Replacement SKU Description FC2-10-ACCLD-511-02-DD Cloud-managed Identity User Subscription including 24x7 FortiCare for 100-499 Users. FC1-10-IDCLD-445-02-DD Annual, per-user, cloud-managed FortiIdentity subscription for 25-499 users (includes 125 SMS credits per user and FortiCare Premium Support per year). FC3-10-ACCLD-511-02-DD Cloud-managed Identity User Subscription including 24x7 FortiCare for 500-1,999 Users. FC2-10-IDCLD-445-02-DD Annual, per-user, clo

Environment:FortiManager 7.6.1 FortiGate-VM64-KVM, FortiOS 7.2.0 build1157, Evaluation License (15-day) ADOM version 7.2Issue:When installing a Policy Package from FortiManager to a managed FortiGate, the install fails with:  post_vdom copy error::(errcode)3 - max entry. object: firewall policy. detail: global limit. solution: limit is 3This strongly implies a hard cap of 3 firewall policies enforced during the FMG→device install process.However, this is demonstrably NOT a device-side limitation. Running show firewall policy directly on the same FortiGate via console/SSH shows 7 policies already present and fully functional, created locally without any issue:  [paste your 7-policy output here]This proves the FortiGate itself accepts well more than 3 policies. The limit is only encountered when FortiManager performs the install — meaning the restriction lives somewhere in FortiManager's install/validation logic (or possibly an ADOM/device-DB setting), not in the FortiGate's own firewall

Hello community, Im once again dealing with FortiNAC, as my company is been back and forwards with it.For example using Cisco ISE, we configure 802.1x on the switches, Cisco ISE validates certificate or username (if im not mistaken) and thats usually the way to go with ISE.My question is: whats the equivalent of what I mentioned for ISE on FortiNAC? Does it support 802.1x at all in the same way ISE does? And if it does, is that the common way to go with FortiNAC. If not, well, whats the common way to go?I got that FortiNAC support a lot of protocols, but thats actually what confuses me, it supports so many stuff that I don't know what to do or whats normally done out there in most scenarios (even though no environments are the same :)I guess Im asking for a practical aspect, I would like to know how are the most FortiNACs deployed out there, real case scenario in this aspect based on real world experience deploying/managing this monster.

I have an issue with Fortiswitches 2048 and a Cisco CBS 350 switch. I had in the Fortinet SFP Finisar and in the Cisco i had a multimode SFP Cisco. The link of the two switches is down and i don’t know why. I replaced the Finisar module with Cisco and the result was the same. Also, i changed the speed from Fortiswitch to 1000 and i didn’t see any change.Inside of the interface of Cisco , there isn’t choice for auto negotiation. The config is trunk with specific vlan and native another vlan from 1. Also, i change the STP to RSTP without any result and i don’t believe the problem was with spanning tree because the the issue is in Layer 1 and not Layer 2. The output of the tranceiver of finisar in Fortiswitch is the below:StatusOKTemperature27.109375 CVoltage3.319000005722046 voltsOptions0x000F: TX_DISABLE, TX_FAULT, RX_LOSS, TX_POWER_LEVEL1Options Status0x0008: TX_POWER_LEVEL1Alarm Flags0x0000Warning Flags0x0000Laser Bias5.624000072479248 mAmpsTransmit Power-4.974363327026367 dBmReceive

We required otp through sms and authentication code through Google authenticator or Microsoft authenticator. Pls evaluate and confirmin scnerio of fortiauthenticator as saml idp and forticlient ems and saml sp please confirm 

Hello,I have complain from user that they have application but not running, after i do investigation by remove web filtering from the policy the application is running. Then i make a new web filter and set all categories to 'enable' and apply to the policy, and unfortunately the application didn't work anymore, then i remove again this web filter from the policy and the application running back.So here i want to know if there any difference between we set all categories on the web filter to enable then apply to the policy with no web filter on the policy?

Hi all,We're looking at FortiSASE to possibly replace Cato SASE (a different debate).What mechanisms does FortSASE have to ensure only corporate devices connect? Does it support Entra Conditional Access Policies and Compliance checks?Can we use our machine certificate and authenticate based on that? 

OS - 6.4 I am trying to understand the behavior with this setting and when it should be used. Assuming we have multiple Internet healthchecks with this setting enabled across multiple SD WAN rules we use for steering, what would the impact be?   Based on the this article it sounds like it would remove our default route which we probably don't want.https://kb.fortinet.com/kb/documentLink.do?externalID=FD44679 I am probably missing something here.  Any guidance would be much appreciated.     

Hi @community,We are using the external manual input feature via email links in FortiSOAR and When a user clicks the link, it opens the standard manual input pop-up window. We are facing a couple of UI limitations and wanted to check if there are any workarounds: Pop-up Size: Is there a way to increase the dimensions (width and height) of the input template? The current text area is quite small for analysts to provide detailed inputs. Draggable Window: Is it possible to make this pop-up window draggable? We want analysts to be able to drag the popup aside so they can read the underlying alert data while filling out the form.   Any suggestions or guidance on this would be greatly appreciated.Thank you.

We pay for premium support. One of the reasons is when we have an issue with a firewall or device, we can call in to get help and resolve the issue immediately. This especially important in an MSP setting, where we have to go on-site for troubleshooting and don't have the luxury of waiting until they call us back. We can’t leave the site (which sometimes are hours away) and then travel back to the site when they call back. This is very concerning and a very bad support move. 

Hello everyone,At the moment i experience an issue with the FortiMail API when trying to retrieve the artifacts of a specific incident using it's session ID.When I try to send request, the API returns all incidents from the selected directory instead of the specific incident associated with the session ID.Could someone please advise on the correct way to retrieve a single incident by its session ID? Am I missing a required parameter or using the wrong endpoint?Any help would be greatly appreciated. Thank you!