Fortinet Community

Hi there,I have been struggling for months to replace SSL VPN with IPsec. We have a production environment with a 90G running 7.4.5 (we cannot change the OS yet because we still have not been able to migrate successfully to IPsec) and around 100 remote users connecting with LDAP and FortiToken. For the last 4 years we have had ZERO problems with SSL VPN.For about 4 months now, we have been internally testing IPsec, and we run into problems almost every week. Fortinet support recently suggested switching to IKEv2, so I decided to test this in a lab environment using an FG50G and FortiClient.Initially, I started with FortiOS 7.4.13 and FortiClient 7.0.12. With IKEv1 I was able to get the tunnel working and successfully ping the LAN. However, once I started testing IKEv2, the problems began.I then upgraded to FortiOS 7.6.6 and FortiClient 7.4.3 (which supposedly should be free of known bugs), but I still cannot get it working correctly. The VPN tunnel comes UP, but I cannot ping the LAN,

I have set up a lab following Keith over at CBT Nuggets. I followed him step by step. When I power on FW1 -FW4 when I go through the initial setup I input admin for login and leave blank for the password and keep getting Login incorrect. Is there something I am missing?  I am using version 7.6.6. Fortinet FW Lab using VMware workstation  

Hello everyone,I have a newly deployed FortiGate firewall with an active license.I would like to separate the internet path used by the FortiGate itself (FortiGuard updates, DNS, NTP, firmware checks, etc.) from the internet path used by LAN users accessing the internet.My setup includes a router between the FortiGate and the internet.What is the best practice to make:FortiGate local-out/update traffic go through one WAN/interface/path User LAN-to-WAN internet traffic go through another WAN/interface/pathShould this be done using:Local Out Routing Policy Based Routing SD-WAN or Static Routes?Any recommended architecture or examples would be appreciated.Thank you.

Can anyone explain what is the EOL date for this software version ?fortiauthenticator FAC-VM 8.0.1 build0033 (GA) end of life date

Hello everyone, After finalizing the bulk registration using the Persistent Agent, I’m wondering what’s considered the best practice to register a brand new device.The issue I’m seeing is kind of a chicken and egg problem:New devices can’t access the network because they get isolated (no Persistent Agent yet) But to deploy the Persistent Agent with GPO, the device first needs to join the domain And to join the domain, it needs network access first...How are you guys usually handling first time onboarding for new company devices after the first enrollement ?BR,

Hello Fortinet Team,I would like to confirm whether FortiClient Windows version 7.2.13.1284 is affected by the recently disclosed vulnerability related to Missing Authorization CVE-2026-44278, which may allow an authenticated local attacker to decrypt a currently logged-in user’s VPN password via an unprotected DLL function.Could you please clarify:Whether version 7.2.13.1284 is vulnerable If this issue has already been fixed in this release Whether any mitigation or upgrade is recommendedThank you in advance for your assistance.

Hi mates,I'm trying to test "SSL offloading" scenario in my lab with Fortigate v7.0.14 on kvm, as i should clear the scenario, it is simple process which we can achieve for example with nginx as a reverse proxy.There is a web-server ( 10.11.12.10) which placed in DMZ and there are WAN and MGMT interfaces as well. I'm trying to configure fortigate to act as revers-proxy to offload SSL be half of web-server. (Client from internet DST port 443 and using HTTPS in URL indeed)---> (WAN Port)-(Fortigate)-(DMZ port)--->( Web-server Port80 ) I used "virtual servers" for the solution and here's my configuration: config firewall vipedit "vweb"set uuid 3757f926-f35e-51ee-348e-fdc06559ea6eset type server-load-balanceset extip 172.29.129.190set extintf "port2"set server-type httpsset http-ip-header enableset ldb-method round-robinset persistence http-cookieset extport 443config realserversedit 1set ip 10.11.12.10set port 80nextendset http-multiplex enableset ssl-certificate

The issue:Clients connected to a vlan with Block intra-VLAN enabled can't reach the FortiGate for around 2 minutes and 30 seconds after failover. Clients connected to a vlan with no Block intra-VLAN enabled do not have this issue.All switches are managed by the Fortigate.Topology:2 X Fortigate 601F in HA A/P2 X Core switches FortiSwitch 1024E in MCLAG2 X FSR-216F-POE connected in a ring to the MCLAG switches. So, the first switch connects to the first 1024E switch and the second connects to the second 1024E switch with a link between the two FSR-216F-POE switches. (We can't change this because of the physical fibers)I have tested with two clients connected to the same switch. Client A connected to port 1 on a vlan with intra-vlan blocking enabled, and Client B connected to port 2 on a vlan with intra-vlan blocking disabled.Client A was having issues after the failover and could not reach the Fortigate for around 2 minutes and 30 seconds. Client B does not have any problems. It looses o

Hi, I am trying to migrate IKEv1 to IKEv2 Dial-UP VPN tunnels for devices that use Forticlient and that do not use Forticlient(e.g. MacOS).The configuration includes a split tunnel setup.When a Forticlient enabled client attempts an IPSec connection the client acquires a split tunnel VPN session. I can see the following few lines in the debug session that indicate routes will be installed in the routing table of the device. ike 2:QDIPS_0:10843292: processed INITIAL-CONTACTike 2:QDIPS_0:10843292: mode-cfg assigned (1) IPv4 address 172.28.12.1ike 2:QDIPS_0:10843292: mode-cfg assigned (2) IPv4 netmask 255.255.255.128ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:10.0.0.0/255.0.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:172.16.0.0/255.240.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:91.200.16.0/255.255.254.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:141.176.34.0/255.255.255.0:0ike 2:QDIPS_0:1

I’ve just rolled out 802.1x for the first time and it ~~appears~~ as if reauth causes disconnects. In the log it says the port is no longer authorised and then reauthenticates. Is that correct?I’d have expected the reauth to work similar to IPSEC, where it does it before the expiry time, so that things don’t drop? If it does then fail, then deauthorise the port. 

We have a couple of internal CAs here and with a new setup of a FGT 100F on 7.6.6 and several FSW 148Fs on 7.6.6 we noticed that the CA certificates (and user peers) are not syncing to the FortiSwitches. This is with tunnel-mode compatible set already.To work around this I created several fortiswitch custom-scripts that create CAs and peers and an automation that looks for FortiSwitch Connected events and runs those scripts on the connecting switch.Is this a known issue on this release? Did I miss something in the initial setup? Is this standard behavior? 

Hi all, could you tell me where I can find the link to operate queries regarding S/N to see active contracts and so on?I remember that it was something like "Find Asset" or similar but I'm not able to find it anymore...  Thanks in advance

I wrote a Fortigate Administrator exam the previous week, and mid exam my pc restart and I had to login in again to continue but I was unable to continue because the Exam did not want to open again, the pearsonvue app was only showing the my video, and no chat option was available, after a while I got disconnected from the exam and I was told that I violated a policy when I contact the support team. I am reaching out because I lost my voucher and 200usd for a system that didn’t work properly. Please hep!

I’m running v7.6.6 on FortiNAC. When I issue ‘backup now’ on the system backup using the GUI, it seems to work. However, the file never shows up on FTP server. In fact, no packets are generated at all towards the FTP server, thus ruling out syntax.When I run the command from the CLI, I see the packets and the file is accepted by the FTP server.execute backup config ftp / 10.99.3.206:21 <user> <password> Any ideas why GUI not working?

We are running a Forticlient EMS Server 7.0.9 with ~350 Forticlient 7.0.9 endpoints in use. In recent weeks we have received more complaints from Windows 11 users on our network that picture files (jpg, png) become corrupt when copied or opened from the network drive. They can open them, but the pictures are "corrupted". Windows 10 users are not affected by the problem. If we disable FortiClient and copy the files again, no errors occur. We already deactivated the option "Scan Network files" in the corresponding Malware Protection Endpoint Profile, but this didn't help.  Does anyone have a similar problem and a solution?

Hi ti all, Our FortiGate 50G is protecting 2 different routers from 2 different ISPs. One is plugged to Wan and the other to Lan1 (=Wan2). Domestic use network. Only ethernet. No WiFi. A few days ago, I tried to protect a TV decoder with the FortiGate. Creating the multicast policies, I have surely changed something I should not have to. The TV decoder was plugged into lan 2 which belongs to a Vlan switch (called "lan". Members: lan 2 + lan 3). This Vlan provides internet from only one of the routers Now I have the following symptoms: - When using this routers's internet and plugging the ethernet cable to my computer, my Airbook gets an auto-assigned IP first (yellow led) and, after 30 seconds, it switches to a normal IP (green led): Internet is available then. This symptom happens only with one of the routers (plugged to lan2 or lan3... Where the TV decoder was plugged to). I tried to disconnect "STP". then the symptom disappears. But comparing with the old configuration file, I notic

Hey everyoneI’m deploying FortiSandbox for the first time and integrating it with FortiGate, F5 Load Balancer, and an internet modem.Before starting, I want to make sure the environment is ready.What are the required network prerequisites and ports that should be open?Also, are there any common mistakes or best practices I should be aware of for a first-time deploymentn? 

Hello, I'm trying to do a lab with a trial version of fortianalizer (7.4.10) and fortigate (7.4.11) and I can't do the connection. When setting the IP of the analizer on the logging settings on the fortigate I get "no connection".They are on the same network, already enable the fgfm on the interface. Can ping both analizer from fortigate and vice versa.  The config that I have on Fortigate:config log fortianalyzer setting    set status enable    set server "192.168.0.102"    set certificate-verification disable    set ssl-min-proto-version TLSv1end The config that I have on Analizer:config system global    set adom-status enable    set enc-algorithm low    set global-ssl-protocol tlsv1.0    set hostname "FAZ-01"    set oftp-ssl-protocol tlsv1.0    set ssl-low-encryption enable    set timezone 91    set usg enableend Log from analizer

Hello, I am trying to update FortiSIEM content version from 901 to 908, but I receive a “server unreachable” error during the update.For testing, I allowed all-all access on the firewall for FortiSIEM, but the issue still persists.Has anyone experienced a similar issue? Are there any specific URLs/FQDNs, ports, or log files that should be checked for FortiSIEM content updates? Best Regards,İsmail ÜREK

Hello :)I have a question about connecting via Putty or PowerShell. How do I clear the history of entered commands that are substituted after pressing the up and down keys? Connecting via SSH to the FG900, I don't know where the history of such commands is located. Please help.

I want to make Forti Sandbox take copy of all internal mail which sent between the staff internally and scan it “URL & Attachments”How can I do this step by step on Forti Sandbox ? 

Hello, Can the regulatory domain be changed on an FortiAP form -E (sweden) to -S (Philippines). Or does the sale have to be done locally in Philippines through local partner on local pricelist? BR Andreas

I was able to establish a connection for a very long time, but it then suddenly stopped working. The connection is established, but no data is received. The connection then closes after about 25 seconds.I noticed the following in the fortitray log which only appear after the time it stopped working:[2026-04-30 07:21:32.5496135 UTC+02:00] [17640:15916] [sslvpnlib  510   error] [ERROR]SslvpnAgent: Pipe is broken for writing. Error=233[2026-04-30 07:21:32.5532904 UTC+02:00] [17640:15916] [sslvpnlib  510   error] DoSendSslvpnReq() failed. Need to restart Pipe.[2026-04-30 07:21:32.5534866 UTC+02:00] [17640:15916] [sslvpnlib  510   error] Failed to connect to SslvpnDaemon, LastError=2[2026-04-30 07:21:32.5535905 UTC+02:00] [17640:15916] [sslvpnlib  510   error] CSslvpnAgent::SendSslvpnReq() 447 InitPipeHandle() failed.[2026-04-30 07:21:32.5537786 UTC+02:00] [17640:15916] [sslvpnlib  1261   error] CSslvpnBase::UpdateFortiSslvpnStatus() GetSslvpnStatus() failed.[2026-04-30 07:21:32.5538736 UTC

Hello Team, I have Fortinet firewall configure on Azure cloud as Active-passive with more than 400 Tunnels, Now i want to change mode from Active-passive to Active-Active. Any official documentation to achieve the same ?

I need help understanding an unexpected FortiEDR Manager restart.We observed the following event:Component: ManagerComponent Name: FortinetDescription: Server was restartedBefore this event, several FortiEDR components changed state to Disconnected:XX:XX:XX - Aggregator [aggregator-cloud] changed to DisconnectedXX:XX:XX - Core [core-cloud] changed to DisconnectedXX:XX:XX - Core [fortiedr-core-jumpbox-onprem] changed to DisconnectedXX:XX:XX - Warning: The following connectors will become inactive: Firewall FW (name)Then the services recovered after 20 seconds:YY:YY:YY - Manager: Server was restartedYY:YY:YY - Connection to Syslog succeeded: FAZ1YY:YY:YY - Connection to Syslog succeeded: FortiSIEMYY:YY:YY - Aggregator [aggregator-Cloud] changed to RunningYY:YY:YY - Core [core-cloud] changed to RunningYY:YY:YY - Core [core-onprem] changed to RunningWhat can cause the FortiEDR Manager to restart with the message “Server was restarted”?Any guidance on where to investigate further would be a