Fortinet Community

Hi all,I am currently encountering an issue with SSLVPN, and would would like to seek your advices. Thank you very much.Background:Fortigate 121G(7.4.12)Forticlient(7.4.11.0198)iPad OS(16.7.16)Issue:The SSL VPN connectivity is working successfully on iPad devices running iPadOS 17 and Android devices.However, the issue happen on the iPad device running iPadOS 16.7.16. The SSL VPN connection often gets stuck at the "Connecting" stage, and the login page does not appear.(Remark:iPadOS 16 and iPadOS17 in the same network, and same ssl vpn setting)We observed that when the issue occurs, the FortiGate firewall does not receive any SSL VPN traffic from the affected device.（Enabled SSL VPN application diagnostics, but no messages were generated）

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

Anyone seen a problem using FMG from Safari on MacOS where you occasionally (every few minutes) get a message saying connection to FMG was lost, usually counts down for a few seconds then reconnects. It's likely related to a tcp keep alive because it doesn't happen when I'm interacting, only when I'm idle for a few minutes. I'm just not sure if I should adjust Mac or FMG side. I only see this in FMG but it never happens on Windows machines, even using Safari.

I got problem.. I Deployment Web filter profile on Fortigate, my system already allowed & all runs well..But someday the license expired...then the Web Filter profile not running because license expired…and now i already renew, update & payment the license fortigate... Then Re-Deployment Web filter profile in rules firewall, but my system is blocking by Web filter profile without any changes on web filter profile.. i just replace / re-use Web filter after renew the license.Can you help explain what happen with this?FYI, Fortigate 101F with OS version :  v7.0.18 build0695 (Mature)This alert / alarm show in URL my system must be allowed, but blocking by Security Policies → Web Filter Profile : 

FortiClient IKEv2 IPsec VPN – Negotiation Timeout After 30 Seconds During RADIUS/EAP OTP AuthenticationHello everyone,I'm experiencing an issue with an IKEv2 IPsec remote-access VPN using RADIUS/EAP authentication with MFA/OTP, and I would appreciate your feedback or any similar experiences.Environment FortiGate: FortiOS 7.6.6 FortiAuthenticator: 6.6.8 FortiClient: 7.4.8 (ZTNA) VPN: IPsec IKEv2 Remote Access Authentication: RADIUS/EAP with MFA/OTP RADIUS server: FortiAuthenticator Issue descriptionThe issue occurs regardless of the OTP delivery method. We have reproduced it with: FortiToken Mobile SMS OTP Email OTP When the user enters the OTP within approximately 30 seconds, authentication succeeds and the VPN tunnel is established normally.However, if OTP entry takes longer than approximately 30 seconds, FortiClient remains in the "Connecting" state. The connection eventually fails with an IKE negotiation timeout, and the tunnel is not established.Important observation:

We need to block Microsoft Copilot for our users, but the M365 admin controls don’t give us a clean off switch. So I’m looking at doing it at the FortiGate level instead. I am specifically talking about the co-pilot that is embedded in all Office 365 apps, not the direct web interface.The catch is that Office 365 must keep working without any impact. Copilot is now embedded across the Office apps and shares a lot of Microsoft infrastructure, so I’m wary of blocking too broadly.Has anyone had success with this? Specifically interested in:Application Control signatures for Copilot and how reliable they areWeb Filter or FQDN based blocking, and which domains you targetedWhether deep inspection was needed to make it workAny side effects you hit with Teams, Outlook, or the desktop appsSuccess stories, gotchas, or configs that worked would be really appreciated.

Hi, I'm trying to improve FortiGate security profiles.What are the best threat feeds for Web Filtering and Antivirus?

I am writing to submit a critical product architectural improvement request regarding how FortiClient EMS 8.0.0 on Linux establishes secure directory integrations.During our recent deployment of FortiClient EMS 8.0.0 on Ubuntu 24, we encountered persistent authentication failures when connecting EMS to our Windows Server Domain Controllers via secure LDAPS (Port 636). Real-time debugging via the adconnector.log file revealed that the authentication loop continuously failed with the following explicit Windows SChannel error wrapper:LDAP Result Code 49 "Invalid Credentials": 80090302: LdapErr: DSID-0C09089D, comment: AcceptSecurityContext error, data 1In the Windows security subsystem, Windows Error Code 80090302 translates directly to SEC_E_UNSUPPORTED_FUNCTION. This protocol violation occurs because the FortiClient EMS backend engine is compiled to automatically encapsulate its Active Directory GUI bind traffic using an NTLM/SPNEGO negotiated token handshake.The Troubleshooting Barrier

Hi there, I have few expectation with Ipsec version 2 which might support. If user is setting idle it means neither sending traffic nor receiving  user must be disconnected as per the set timeout , what is the default time out and how I set as per my need. Same user cannot be login in multiple device. how can I achieve it only single user can login in one device. I have two ISPs, I want if one ISP goes down users must not be experiencing any issue and users must be shifted to another link automatically. (do we need to create two separate tunnel and policy and all configuration must be same - like policy,routing,access) or any other way I can achive. I have observed in remote IPsec version 2  if MFA is configured for users until user enter OTP till then internet gets disconnected, however tunnel is configured in split mode. Anyone has faced this issue, please share your experience can I achieve in Foritgate Remote Ipsec version 2

Hello, I am currently using a laptop that runs FortiClient to connect via REMOTE IPSEC VPN to the primary and backup firewalls.On this laptop, I am using version 7.07 345, which is obsolete. I have a new PC on which I just installed the latest version, 7.4.34726. I created a backup of the configuration on my old PC that I'm trying to import onto my new PC. Unfortunately, when I try to restore this backup on the new PC, FortiClient doesn't even ask me for the password.I asked ChatGPT+ for help, and we switched to the Command Prompt (cmd—run as administrator) and ran the following commands:    - FCConfig.exe -m all -f cheminfichierSave.conf -o import -p MOT_DE_PASSE   - FCConfig.exe -m all -f cheminfichierSave.conf -o import i -1 -p MOT_DE_PASSENeither of these two orders is going through. Could you please let me know what steps to take?Thank you, and have a great day.GwénaëlleNote: This post was machine translated in accordance with our Fortinet Community Guidelines.

Hi, I upgraded my Forticlient EMS to the 7.4.5 version and now i can't access to the web portal. When i try to run the command "service restart --all" in the linux console i have the next error:get services status: start apache2 service: exit status 1exit error: [exit status 1], exitStatus: 1Can someone help me with this issue please?

When I attempt to Telnet into a Cisco switch located downstream of a FortiGate 50G (FG-50G), the Telnet connection fails.However, through cross-testing, I discovered an odd workaround: Whenever I modify any Firewall Policy on the FG-50G (even an irrelevant change, such as removing a service from a disabled policy), the previously failed Telnet connection to the downstream switch suddenly starts working normally.Unfortunately, if the system is left idle for a while, the Telnet connection issue returns.Network Architecture & Environment Setup Upstream & Downstream Switches: Cisco switches, connected via LACP configured to allow all VLANs. Plaintext   interface Port-channel1 switchport mode trunkend FortiGate 50G: Configured in Transparent Mode. Aggregate Interface Configuration:   edit "downlink" set vdom "root" set allowaccess ping https ssh snmp radius-acct set broadcast-forward enable set l2forward enable set stpforward enable set type aggregate set me

I am trying to upgrade my FortiClient EMS from version 7.4.7 to 7.4.8, but I keep receiving the following error message. Does anyone know how to resolve this issue?  Reverting EMS installation files dpkg: error processing package forticlientems (--configure): installed forticlientems package post-installation script subprocess returned error exit status 1 Processing triggers for postgresql-common Removing obsolete dictionary files: Errors were encountered while processing:  forticlientems E: Sub-process /usr/bin/dpkg returned an error code (1) cp: cannot stat '/tmp/ems/info/ems.*': No such file or directory  

I would like to confirm about Forticloud SSO solutions with Entra IDAfter read document it seems working as below conceptsConfigure IAM with IdP on forticloud portal (Entra ID → FortiCloud) Enable FortiCloud SSO on the FortiGateHowever, this first time for me & not sure there are any concern point that need to be aware or any required special license? anyone have experice on this please suggest me, thanks

Because SSL VPN will retired then i try to create IPSec VPN Remote Access with below setting:phase1 :edit "VPN-RA"        set type dynamic        set interface "port2"        set local-gw xxx.xxx.xxx.106        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 10.105.10.5        set proposal aes256-sha256 aes128-sha1        set localid "vpnra"        set dpd on-idle        set dhgrp 20 5        set peerid "vpnra"        set ipv4-start-ip 10.203.203.1        set ipv4-end-ip 10.203.203.200        set ipv4-split-include "LAN"        set unity-support disable        set psksecret ENC xxxxx        set dpd-retryinterval 60    nextphase2:    edit "VPN-RA"        set phase1name "VPN-RA"        set proposal aes128-sha1 aes256-sha256        set pfs disable    nextAnd below is my forticlient setting But why i always get timeout?  

Is there a possible way to schedule FortiClient VPN (FREE) to login on a schedule ? For Example i want a client machine to connect daily at 12PM to the forticlient VPN. 

Hi,What's the deal with the free version of the VPN agent? According to the documentation, it should be 7.4.3.4799, but only version 7.4.3.4726 is available.What's the deal?

I achieved my NSE 6 at the weekend, but I didn't realise that it wouldn't extend the validity date of my NSE 4 (1-3 were extended). I am going to study for my NSE 7 in Secure Networking now, but I only have 18 months to do this as my NSE 4 will expire then.I can see on their website that you can renew NSE 4 by "Complete the online NSE 4 recertification assessment if you passed one NSE 4 exam no more than 2 years ago", but I can't find a way to do this without sitting the full exam again (not an issue if required)Just wondered if anyone has done this before? 

nslookup v4-aws.api.intuit.com 96.45.45.45Server: dns1.fortiguard.netAddress: 96.45.45.45*** dns1.fortiguard.net can't find v4-aws.api.intuit.com: Server failednslookup v4-aws.api.intuit.com 96.45.46.46Server: dns2.fortiguard.netAddress: 96.45.46.46*** dns2.fortiguard.net can't find v4-aws.api.intuit.com: Server failed

Hi,after the win 11 upgrade to 25h2 version more notebook/pc dont connect trough vpn ipsec .IF I disable in network adapter the Fortinet  NDIS packet can connet but dont reach any devices  on remote network  and dont receve traffic. I tried Forticlient 7.2,  7.4 versions but nothing.Please HELP ME! Thanks in advance.     

If the FortiOS 7.6/8.0 Administrator Self-Paced lessons (not including the paid for Labs or Instructor led classes) are completed do you get a course completion certificate? My Employer currently lacks the budget to provide paid for training including the labs/classes however if a course completion certificate is given upon completion of the lessons then my employer may allow us to complete the training during working hours as a compromise.

Hi,a few days we updated from FortiOS 7.2.13 to 7.6.6.Now we can’t download “*.xlsx” files, because our DLP profile is blocking that.But we have only “*.xls” configured for blocking and not “*.xlsx”.When i remove the “*.xls” pattern, we are able to download “.xlsx” Files again.It looks to me that he is using “*.xls*” when entering “*.xls”. Is this a bug or a expected behavior? What do i need to enter, when i only want to block “*.xls” and not “*.xlsx”?A second problem, when i edit the DLP profile i can’t see the file types and can’t edit them. A other admin who is in the same admin group see 2 more colums in the profile table and is able to edit the file types. I switched on already all features in the feature visibility and cleard the browser cache, but no change. Has someone a hint for me?Kind regardsStefan

Hello all,we have an Exchange Hybrid setup with all our mailboxes on-prem. We need to let graph send emails via Exchange Online but we would need to relay these emails via our Fortimail appliance. So the Exchange Online environment does not send these itself without going through the Fortimail first. We found this in the cookbook:How to integrate FortiMail into Microsoft 365 | FortiMail Appliance and VM 7.4.0 | Fortinet Document LibraryAnd this technical guideline:Technical Tip: Office365 Secure Relay via FortiMail to avoid unauthorized email relay | CommunityAnd it seems like we can’t let graph talk directly to our on-prem Exchange servers:https://learn.microsoft.com/en-us/graph/hybrid-rest-support So we wondered how does the Technical Tip from fortinet make sure that we are not risking the relaying of unwanted emails. The authenticated part in the technical guideline does not apply here, no? Because our user mailboxes are all on-prem? And regarding the cookbook: our concern is that w

I would like to Integrate Tufin with Remedy in such a way that the CRQs requesting Fortimanager security policies configurations get automated, meaning that Tufin would be able to see the CRQs on Remedy and automatically configure the rules on Fortimanager:Tufin pick up Remedy ticket, figure out which firewall, check for conflicts, push rule to FortiManager. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes.Is there any documentation or support that I could have access to accomplish this? Thank you & best re