Fortinet Community

I am trying to set up IPSEC vpn from a fortigate to FortiClient for Windows and Mac. I have it working on FortiClient for Windows. On FortiClient Mac it says Connecting, then times out. I noticed that the Mac version is missing three options in the setup that are visible on Windows and I wonder if that is my problem.The options missing are:VPN Settings: EncapsulationPhase 1: NAT TransversalPhase 2: Enable Replay DetectionCan I get those options to show somehow?The fortigate side was set up using the wizard, and this is a full tunnel.

Hi everyone... I have confuse about vpn concentrator, anybody help me to describe what is vpn concentrator mean? Thanks

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

automatic failover between two different ipsecvpn remote gateway public IP addresses in FortiVPN Client

Hi all,I am currently encountering an issue with SSLVPN, and would would like to seek your advices. Thank you very much.Background:Fortigate 121G(7.4.12)Forticlient(7.4.11.0198)iPad OS(16.7.16)Issue:The SSL VPN connectivity is working successfully on iPad devices running iPadOS 17 and Android devices.However, the issue happen on the iPad device running iPadOS 16.7.16. The SSL VPN connection often gets stuck at the "Connecting" stage, and the login page does not appear.(Remark:iPadOS 16 and iPadOS17 in the same network, and same ssl vpn setting)We observed that when the issue occurs, the FortiGate firewall does not receive any SSL VPN traffic from the affected device.（Enabled SSL VPN application diagnostics, but no messages were generated）

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

Anyone seen a problem using FMG from Safari on MacOS where you occasionally (every few minutes) get a message saying connection to FMG was lost, usually counts down for a few seconds then reconnects. It's likely related to a tcp keep alive because it doesn't happen when I'm interacting, only when I'm idle for a few minutes. I'm just not sure if I should adjust Mac or FMG side. I only see this in FMG but it never happens on Windows machines, even using Safari.

I got problem.. I Deployment Web filter profile on Fortigate, my system already allowed & all runs well..But someday the license expired...then the Web Filter profile not running because license expired…and now i already renew, update & payment the license fortigate... Then Re-Deployment Web filter profile in rules firewall, but my system is blocking by Web filter profile without any changes on web filter profile.. i just replace / re-use Web filter after renew the license.Can you help explain what happen with this?FYI, Fortigate 101F with OS version :  v7.0.18 build0695 (Mature)This alert / alarm show in URL my system must be allowed, but blocking by Security Policies → Web Filter Profile : 

FortiClient IKEv2 IPsec VPN – Negotiation Timeout After 30 Seconds During RADIUS/EAP OTP AuthenticationHello everyone,I'm experiencing an issue with an IKEv2 IPsec remote-access VPN using RADIUS/EAP authentication with MFA/OTP, and I would appreciate your feedback or any similar experiences.Environment FortiGate: FortiOS 7.6.6 FortiAuthenticator: 6.6.8 FortiClient: 7.4.8 (ZTNA) VPN: IPsec IKEv2 Remote Access Authentication: RADIUS/EAP with MFA/OTP RADIUS server: FortiAuthenticator Issue descriptionThe issue occurs regardless of the OTP delivery method. We have reproduced it with: FortiToken Mobile SMS OTP Email OTP When the user enters the OTP within approximately 30 seconds, authentication succeeds and the VPN tunnel is established normally.However, if OTP entry takes longer than approximately 30 seconds, FortiClient remains in the "Connecting" state. The connection eventually fails with an IKE negotiation timeout, and the tunnel is not established.Important observation:

We need to block Microsoft Copilot for our users, but the M365 admin controls don’t give us a clean off switch. So I’m looking at doing it at the FortiGate level instead. I am specifically talking about the co-pilot that is embedded in all Office 365 apps, not the direct web interface.The catch is that Office 365 must keep working without any impact. Copilot is now embedded across the Office apps and shares a lot of Microsoft infrastructure, so I’m wary of blocking too broadly.Has anyone had success with this? Specifically interested in:Application Control signatures for Copilot and how reliable they areWeb Filter or FQDN based blocking, and which domains you targetedWhether deep inspection was needed to make it workAny side effects you hit with Teams, Outlook, or the desktop appsSuccess stories, gotchas, or configs that worked would be really appreciated.

Hi, I'm trying to improve FortiGate security profiles.What are the best threat feeds for Web Filtering and Antivirus?

I am writing to submit a critical product architectural improvement request regarding how FortiClient EMS 8.0.0 on Linux establishes secure directory integrations.During our recent deployment of FortiClient EMS 8.0.0 on Ubuntu 24, we encountered persistent authentication failures when connecting EMS to our Windows Server Domain Controllers via secure LDAPS (Port 636). Real-time debugging via the adconnector.log file revealed that the authentication loop continuously failed with the following explicit Windows SChannel error wrapper:LDAP Result Code 49 "Invalid Credentials": 80090302: LdapErr: DSID-0C09089D, comment: AcceptSecurityContext error, data 1In the Windows security subsystem, Windows Error Code 80090302 translates directly to SEC_E_UNSUPPORTED_FUNCTION. This protocol violation occurs because the FortiClient EMS backend engine is compiled to automatically encapsulate its Active Directory GUI bind traffic using an NTLM/SPNEGO negotiated token handshake.The Troubleshooting Barrier

Hi there, I have few expectation with Ipsec version 2 which might support. If user is setting idle it means neither sending traffic nor receiving  user must be disconnected as per the set timeout , what is the default time out and how I set as per my need. Same user cannot be login in multiple device. how can I achieve it only single user can login in one device. I have two ISPs, I want if one ISP goes down users must not be experiencing any issue and users must be shifted to another link automatically. (do we need to create two separate tunnel and policy and all configuration must be same - like policy,routing,access) or any other way I can achive. I have observed in remote IPsec version 2  if MFA is configured for users until user enter OTP till then internet gets disconnected, however tunnel is configured in split mode. Anyone has faced this issue, please share your experience can I achieve in Foritgate Remote Ipsec version 2

Hello, I am currently using a laptop that runs FortiClient to connect via REMOTE IPSEC VPN to the primary and backup firewalls.On this laptop, I am using version 7.07 345, which is obsolete. I have a new PC on which I just installed the latest version, 7.4.34726. I created a backup of the configuration on my old PC that I'm trying to import onto my new PC. Unfortunately, when I try to restore this backup on the new PC, FortiClient doesn't even ask me for the password.I asked ChatGPT+ for help, and we switched to the Command Prompt (cmd—run as administrator) and ran the following commands:    - FCConfig.exe -m all -f cheminfichierSave.conf -o import -p MOT_DE_PASSE   - FCConfig.exe -m all -f cheminfichierSave.conf -o import i -1 -p MOT_DE_PASSENeither of these two orders is going through. Could you please let me know what steps to take?Thank you, and have a great day.GwénaëlleNote: This post was machine translated in accordance with our Fortinet Community Guidelines.

Hi, I upgraded my Forticlient EMS to the 7.4.5 version and now i can't access to the web portal. When i try to run the command "service restart --all" in the linux console i have the next error:get services status: start apache2 service: exit status 1exit error: [exit status 1], exitStatus: 1Can someone help me with this issue please?

When I attempt to Telnet into a Cisco switch located downstream of a FortiGate 50G (FG-50G), the Telnet connection fails.However, through cross-testing, I discovered an odd workaround: Whenever I modify any Firewall Policy on the FG-50G (even an irrelevant change, such as removing a service from a disabled policy), the previously failed Telnet connection to the downstream switch suddenly starts working normally.Unfortunately, if the system is left idle for a while, the Telnet connection issue returns.Network Architecture & Environment Setup Upstream & Downstream Switches: Cisco switches, connected via LACP configured to allow all VLANs. Plaintext   interface Port-channel1 switchport mode trunkend FortiGate 50G: Configured in Transparent Mode. Aggregate Interface Configuration:   edit "downlink" set vdom "root" set allowaccess ping https ssh snmp radius-acct set broadcast-forward enable set l2forward enable set stpforward enable set type aggregate set me

I am trying to upgrade my FortiClient EMS from version 7.4.7 to 7.4.8, but I keep receiving the following error message. Does anyone know how to resolve this issue?  Reverting EMS installation files dpkg: error processing package forticlientems (--configure): installed forticlientems package post-installation script subprocess returned error exit status 1 Processing triggers for postgresql-common Removing obsolete dictionary files: Errors were encountered while processing:  forticlientems E: Sub-process /usr/bin/dpkg returned an error code (1) cp: cannot stat '/tmp/ems/info/ems.*': No such file or directory  

I would like to confirm about Forticloud SSO solutions with Entra IDAfter read document it seems working as below conceptsConfigure IAM with IdP on forticloud portal (Entra ID → FortiCloud) Enable FortiCloud SSO on the FortiGateHowever, this first time for me & not sure there are any concern point that need to be aware or any required special license? anyone have experice on this please suggest me, thanks

Because SSL VPN will retired then i try to create IPSec VPN Remote Access with below setting:phase1 :edit "VPN-RA"        set type dynamic        set interface "port2"        set local-gw xxx.xxx.xxx.106        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 10.105.10.5        set proposal aes256-sha256 aes128-sha1        set localid "vpnra"        set dpd on-idle        set dhgrp 20 5        set peerid "vpnra"        set ipv4-start-ip 10.203.203.1        set ipv4-end-ip 10.203.203.200        set ipv4-split-include "LAN"        set unity-support disable        set psksecret ENC xxxxx        set dpd-retryinterval 60    nextphase2:    edit "VPN-RA"        set phase1name "VPN-RA"        set proposal aes128-sha1 aes256-sha256        set pfs disable    nextAnd below is my forticlient setting But why i always get timeout?  

Is there a possible way to schedule FortiClient VPN (FREE) to login on a schedule ? For Example i want a client machine to connect daily at 12PM to the forticlient VPN. 

Hi,What's the deal with the free version of the VPN agent? According to the documentation, it should be 7.4.3.4799, but only version 7.4.3.4726 is available.What's the deal?

I achieved my NSE 6 at the weekend, but I didn't realise that it wouldn't extend the validity date of my NSE 4 (1-3 were extended). I am going to study for my NSE 7 in Secure Networking now, but I only have 18 months to do this as my NSE 4 will expire then.I can see on their website that you can renew NSE 4 by "Complete the online NSE 4 recertification assessment if you passed one NSE 4 exam no more than 2 years ago", but I can't find a way to do this without sitting the full exam again (not an issue if required)Just wondered if anyone has done this before? 

nslookup v4-aws.api.intuit.com 96.45.45.45Server: dns1.fortiguard.netAddress: 96.45.45.45*** dns1.fortiguard.net can't find v4-aws.api.intuit.com: Server failednslookup v4-aws.api.intuit.com 96.45.46.46Server: dns2.fortiguard.netAddress: 96.45.46.46*** dns2.fortiguard.net can't find v4-aws.api.intuit.com: Server failed

Hi,after the win 11 upgrade to 25h2 version more notebook/pc dont connect trough vpn ipsec .IF I disable in network adapter the Fortinet  NDIS packet can connet but dont reach any devices  on remote network  and dont receve traffic. I tried Forticlient 7.2,  7.4 versions but nothing.Please HELP ME! Thanks in advance.