Fortinet Community

Which is the latest FortiOS version that still supports SSL VPN?

Does anyone else experiences issues with login into customersso portal ( https://customersso1.fortinet.com/saml-idp/ ) when trying to access anything that requires authentication with it?I dont get the the push notification in the mobile app and upon entering the token manually I get  Invalid token code entered or your session has timed out. Please re-enter your credentials. Is there a known issue with this service ? L.E. figured out my manual input issue is due to entering the wrong token assigned to the account ( having multiple ones in the app ) , but the push notification from the app still doesnt work

Hello guys,Issue Description: We recently attempted a firmware upgrade on our GCP HA cluster from v7.4.12 to v7.4.13. The image upload and HA synchronization process completed successfully, and both nodes rebooted. However, immediately upon booting into 7.4.13, the system experienced a false positive on the WAN health-check (Link Monitor). The firewall incorrectly detected the external ping targets (8.8.8.8 and 1.1.1.1) as unreachable. This triggered the automatic removal of the default static route on the external interface. As a result, the cluster lost all outbound Internet access. I got this error message when uploading frimware image : anyone with similar architecture have experienced this issue ??

Hello everyone, I have a few questions about how synchronization works at the HA group level.Virtual IPs (VIPs): Are VIPs synchronized across all the clusters/units that belong to the HA group, or must they be configured separately on each cluster? DKIM keys: Are DKIM keys synchronized across all the units/clusters in the HA group? Or do we need to generate or import them manually on each one? “Action on failure” in the HA group: When this option is set to “Wait for recovery and switch to configured role”, what happens when Site A comes back after being down while Site B was acting in its place? Does Site A resynchronize and apply the configuration changes made on Site B during the outage before switching back to its configured role? Or does it come back with its old configuration, potentially overwriting or ignoring the changes made on Site B? Thanks in advance,BR,

Hello Community, We are currently facing an issue regarding IPSec Remote Access VPN connectivity from Linux (Ubuntu) using FortiClient VPN as the user agent. Our FortiGate is running FortiOS 7.6.6, and we want to allow remote users to connect through IPSec Remote Access VPN. However, after installing FortiClient VPN on Ubuntu, we noticed that the GUI only provides options for SSL VPN and XML configuration, and there is no option available for IPSec VPN.Since SSL VPN is not supported in our current deployment scenario on FortiOS 7.6.6, we intended to use IPSec-based Remote Access. As a workaround, we installed strongSwan on Ubuntu and configured the IPSec connection manually. The VPN tunnel was established successfully using the user created on the FortiGate, and connectivity is working properly. However, we would like to clarify the following points:Is IPSec Remote Access officially not supported in FortiClient VPN Only for Linux?If FortiClient VPN does not support

Hi everyone, I'm trying to set up remote access via IPSec to a FortiGate 60F. Since MS365 SSO is in use already for various services, this should be used also for VPN access. I've been able to successfully implement this and was able to connect from a Windows box with SSO and the FortiClient VPN-only version (7.4.3 hotfix 1.8758). EMS is not in use. However, I'm also looking for a solution for Linux, but each option that I see leads to a dead Open-source IPsec clients like strongswan and libreswan don't appear to support SSO authentication (yet). I tried to add a separate user using static credentials for EAP login, but I also haven't found a way to use these tools with both a PSK and additional EAP authentication.I was able to establish a connection with the regular Linux FortiClient, but it can't be used without an EMS except for a trial.The FortiClient VPN-only version for Linux (7.4.3 build 1736) appears to only support SSL VPN, but not IPSec.SSL VPN is obsolete

Hi All,I have fortigate firewall (OS 7.6.7) with two WAN interfaces (WAN1: 10.10.10.1 & WAN2: 20.10.10.1)And configured IPsec tunnel on WAN1 10.10.10.1), generally we can add another public IP as secondary IP to IPsec tunnel.But now I want to add WAN2 IP (20.10.10.1) as secondary IP to my existing tunnel, which is configured on WAN1 interface. Will it possible?, or in traditional way have to configure two IPSec tunnels?

Hello community,Product: FortiGate-90GThe device is currently running FortiOS 7.4.7 build 2731.Its FMWR/support contract expired on 11 July 2025.FortiCloud SSO access is currently being blocked with Attack ID 20000021 because the installed FortiOS version is affected by CVE-2026-24858. I would therefore like to update the device to a security-fixed FortiOS release. However, due to the expired support contract, the FortiGate does not permit the upgrade through FortiGuard and the FortiCare portal does not allow me to download the firmware image manually. I am not requesting access to a newer major/minor FortiOS branch. I would like to remain within the existing FortiOS 7.4.x branch and upgrade only to the current security-fixed patch release, preferably FortiOS 7.4.12.Is it possible for the the official FortiOS 7.4.12 firmware image for this FortiGate-90G to be provided, or can someone from this community enable another supported method of upgrading this device to 7.4.12 for security rem

We have trouble with Forticlient vpn only 7.4.3 on Mac OS 27 Golden State. If we are trying to establish vpn connection, every time we recived time out. Oure Macbook Air is staight from suplier with clean preinstaled Mac Os Golden State. Vpn is configured as IPSec. Firewall is disabled.The same config we are using on Windows and it is working just fine.

Hello Fortinet Community,I have a FortiGate firewall and would like to implement the following requirement in my organization.Requirement: Block WhatsApp Web access through web browsers (Google Chrome, Microsoft Edge, Firefox, etc.). Allow WhatsApp Desktop application on Windows PCs. Users should not be able to access https://web.whatsapp.com through any browser. WhatsApp Desktop should continue working normally, including messaging, voice/video calls, and file transfers. My Questions: Is it possible to achieve this using FortiGate Web Filter or Application Control? Can we block only the WhatsApp Web browser traffic without affecting the WhatsApp Desktop application? Which FortiGate application signatures or URL filtering rules should be used? Is SSL Deep Inspection required for this implementation? Are there any recommended configurations or best practices to achieve this requirement? I would appreciate any guidance, CLI configuration examples, or step-by-step instructio

Hello everyone, Does FortiGate accept two VIP objects with the same external IP ? If so which FortiOS and how is it configured ? Thanks in advance.BR,

authentication code issues, only works with a push notification, code gives 'vpn error'

 HI all,I’ve run into a tricky issue on an IPsec Remote Access VPN connection with Forticlient.my FG version: ’FortiGate-50G v7.4.8,build2795,250523 (GA.M)’, FG can see internet, and here is the configuration of IPsec Phase1:FortiGate-50G # config vpn ipsec phase1-interfaceFortiGate-50G (phase1-interface) # edit IPsec\ RA\ vpn0 FortiGate-50G (IPsec RA vpn0) # show config vpn ipsec phase1-interface edit "IPsec RA vpn0" set type dynamic set interface "lan2" //yes my wan interface name is lan2 set ike-version 2 //also tried ikev1(agressive and main) set local-gw <my public ip> set peertype any set net-device disable set mode-cfg enable set proposal aes128-sha256 aes256-sha256 set dpd on-idle set dhgrp 5 set eap enable //also tried with no eap set eap-identity send-request set authusrgrp "POC_grp" set nattraversal forced //also tried

FortiAIFortiAI 6.1.0: Adds AI Agent Traceability to review every step of an agent run, insight templates for the AI Insights dashboard, quick prompts on the Alert, Case, and Indicator list views, AI verdict and summary fields on alerts, and four MCP servers. Alert Investigation 1.0.1: Records each investigation step for review in AI Agent Traceability. Chat Assistant 2.0.0: Adds a plan mode that hands multi-step requests to the Orchestrator agent, and records agent runs for traceability. Connector Generation 1.0.0: New agent that generates a FortiSOAR connector from a natural language description and API specification, and can import it into FortiSOAR. FortiSOAR Data Access 1.0.1: Adds traceability and improves query efficiency and performance. Identity Context Provider 1.0.1: Includes fixes. Investigation Planner 1.0.1: Adds traceability, and an option to mark data sources as unavailable so investigation questions cover only the sources that can be queried. IOC Masking 1.0.1: Adds tra

Hello Fortinet Community,We are experiencing recurring FortiClient VPN connection issues with one of our customers and would appreciate your advice.System Information:Device: MacBook Pro (Apple M1 Pro) Operating System: macOS 27.0.1 FortiClient VPN: 7.4.3.4323 (Free VPN Version) VPN Type: SSL-VPNProblem Description:The VPN connection works normally for several days. However, after some time, FortiClient becomes unresponsive when attempting to reconnect.Restarting the Mac does not resolve the issue. The VPN only starts working again after reconfiguring the connection, but the problem returns after a few days.Troubleshooting Already Performed:Verified the VPN configuration. Successfully tested connecting and disconnecting the VPN. Checked Fortinet network extensions and background services – all active. Reviewed FortiClient logs without identifying a definitive cause. Verified that the VPN works correctly immediately after reconfiguration.Our Questions:Is FortiClient VPN 7.4.3.4323 offic

If we refer to the Fortinet article below:Technical Tip: Implementing IPsec VPN SAML-based authentication using loopback Interface | Community it states that:IKE with SAML authentication does not support multiple SAML servers on the same interface, as the SAML server is directly bound to the interface and allows only one instance to be configured.What is the recommended design if I have two Internet connections for VPN redundancy?Since the SAML server is bound to an interface, does that mean we cannot enable the same SAML server on the secondary Internet interface?Has anyone implemented IPsec VPN with SAML authentication in a dual-ISP redundant setup?

How do I get FCREMOVE.exe for a free copy of Forticlient I am unable to download the tools and I have a free copy of Forticlient installed and I can not remove it It is not showing in add/remove programs.  We can't uninstall   We can't install.  We are stuck Any ideas?

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on.

I’m using Fortianalyzer 1000F version 7.6.8. I have a myriad reports that run daily based on traffic logs. These reports get mailed to IT and Security staff. What I find though is that the reports get sent even if there are no results. Any other reporting tool I have seems to have an option to only send mail alerts/reports if there are results (Splunk etc.)Is this possible in Fortianalyzer? If not, are there alternatives ?

Hi Everyone,We have a fortigate firewall with HA and FortiOS is 7.4. also laid few client based FortiGate SSL-VPNs accounts.Now we have to upgrade either 7.6 or 8.0, where as not support the client based FortiGate SSL-VPNs accounts. So, what is the best practice for moving to 7.6 or 8.0 version?.Before upgradation can we use any migration tool only for SSL-VPN accounts to IPsec or any other?.MY SSL-VPN purpose is providing the RDP access & Web based internal urls.  Anyone guide me for best practice for without any production impact?.Thanks in advance.  

Running FortiClient 7.4.8.2066 on Windows 11 25H2.What’s happening, Users can connect, everything works.  Next time they open laptop, unable to connect VPN Software.The Fortinet SSL VPN Virtual Ethernet Adapter is disabled.  Simple restart of laptop re-enables card, works again.    100 Users, at any one moment in time, 30 NICs are disabled on average.My best guess, and it is a guess, relates to Power Management on WiFi card.  Windows is disabling WiFi when you put laptop to sleep.  This event disables FortiClient NIC.  Wake laptop up, WiFi enables itself, FortiClient doesn’t.Has anyone seen this before ThanksBryan

Fortinet Video Library — October 2026 Roundup Hi everyone, here are 12 full-length videos published on Fortinet’s official Video Library YouTube channel during October, checked through October 30. I’ve grouped them by product and included YouTube and video.fortinet.com links. Shorts are excluded.FortiGate & FortiOSOct. 28 — FortiOS 8.0.1: Configuring Hashed External Feeds to Block WebsitesYouTube | Fortinet Video Library Oct. 27 — FortiOS 8.0: Steering SD-WAN Traffic Based on Underlay BandwidthYouTube | Fortinet Video Library Oct. 22 — FortiOS 7.6.8: Configuring Application Hold Timer to Hold Newly Created Application SignaturesYouTube | Fortinet Video Library Oct. 13 — FortiOS 8.0: Using IPAM for Dual-Stack IPsec VPN Remote Endpoints' IPv6 Address AssignmentYouTube | Fortinet Video Library Oct. 8 — FortiOS 7.6.7: Enabling NPU Offloading for IPsec VPN over VNE Interfaces to Improve PerformanceYouTube | Fortinet Video Library Oct. 6 — FortiOS 8.0.1: Configuring User-Defined Applicat

Product: FortiGate-80F-POE, S/N FG80FPTK24000713 Firmware: FortiOS v7.6.8 build3744 (GA.M); IPS Engine 7.01200; AV Engine 7.00062 Severity: 3 (business impact, workaround available)SummarySince Windows clients started sending hybrid post-quantum key shares (OpenSSL 3.5+, Chrome/Edge), TLS 1.3 handshakes from Windows hosts through our FortiGate time out. The ClientHello (~1.5–2 KB) is split into two TCP segments. For sessions without the TCP timestamp option (Windows default timestamps=allowed), the FortiGate ACKs the second segment to the client on behalf of the server. It then retransmits that segment on wan1 about 6 times, and the server never acknowledges it. The handshake hangs until the client times out (FIN from server after ~15 s, or RST after ~35 s).macOS clients (TCP timestamps on) are unaffected through the same policy, with the same NAT IP and destination, and even with a byte-identical ClientHello split at the same offsets.This looks related to KB “ERR_SSL_PROTOCOL_ERROR wh