Fortinet Community

Hi,I've been attempting to setup a High Availability pair of virtual Fortigate firewalls under AWS.https://docs.fortinet.com/document/fortigate-public-cloud/7.6.0/aws-administration-guide/229470/deploying-fortigate-vm-active-passive-ha-aws-between-multiple-zones From what I can gather the normal approach is to have 4 network ports to do thisWAN, LAN, HA, Management.However I've been attempting to set this up on a c6in.large image which is limited to 3 network ports (because c6in.xlarge is double the cost) I nearly got this to work by avoiding the use of a management port and logging onto the secondary firewall using the virtual serial port via the EC2 Serial port console under AWS. This allowed me to setup both firewalls with ports for WAN, LAN, HA only. I found that switching from the Primary to the Secondary works, but switching back from the Secondary to the Primary fails to call the AWS API calls to update the routing tables / elastic ipsBased on this link

Good afternoon everyone,I installed FortiClient VPN on my Debian machine (running KDE Plasma), but I can't get past the login screen. I enter my password and it just gets stuck on "Connecting" forever.The logs show an invalid certificate error. I tried to unlock the padlock icon in the UI so I could check the "Do not Warn Invalid Server Certificate" box, but when I click on it, the application freezes completely.Does anyone know how to bypass this padlock freeze or how to enable the certificate exception via command line? Thanks in advance! 

Good day, i have block instagram from application Control. it works in laptop or pc that connected through this network. but for user who using mobile phone with Wifi access, still able to access Instagram application smoothly. my question is, how to block instagram for user access from mobile phone Iphone or Android. Thank you for Help  

We use FortiMail’s webmail for IBE secure mail exchange.The Webmail interface allows users to download the de-crypted emails using “save as” without any encryption. These mails are saved as decrypted plain email format (.eml)How can we disable this function in Webmail?Is piping the WebGUI through a reverse proxy/WAF to block this particular button the only way?

If i look from authentication log one host have some authentication request and if we see from below pic there are 4 authentication request.Three of that is failed and one is success. Failed authentication due to timeout and this timeout mean the network devices can’t connect to the fortinac?    

Hello, our organization recently obtained a few MacBook Neos and Airs to test, running on macOS 27 Golden Gate. However, after installing FortiClient and connected to the office network, at random times, the Wi-Fi and Bluetooth would switch off and cannot be turned back on manually. After 2-3 minutes of this, the MacBook will then freeze then immediately restart on it’s own. Following a restart, everything seems normal, but this issue can repeat multiple times in a day, but as the day goes on, it becomes stable. This happens the moment I disconnect and reconnect back to the office network. Especially after bringing home and returning to the office with the MacBook. This issue does not happen with a private home network or hotspot. Resetting the MacBook does not resolve the issue either. When FortiClient is not installed, the MacBook behaves normally. 2 older MacBooks obtained last year does not experience this issue. We have disabled / blocked Apple Account login, Mail, Calendar, iClou

Hi, I have created an fortigate administrator login using below video, however in my case I'm unable to bypass Two factor authentication while creating user on fortigate device. Fortigate running version 7.6.4 https://youtu.be/WWIJHZrFTW8?si=ZTT2cTcDkZ-v6-qe

Hi, Initially, several FortiGate 70G HA pairs became out of sync due to an unknown FortiAP entry, AP-11N-SERIAL-0001, appearing under Managed FortiAPs. Deleting the unknown AP entry from the primary FortiGate resolves the HA synchronization issue. Eventually, I found another entry in System Event log on FortiGate showing that the unknown AP was added after a discovery request was received. Source IP: 66.132.224.63 Event: AP AP-11N-SERIAL-0001 added Reason: Discovery request was received Any insights or relevant known issues would be appreciated. Thank you!

If i want to make traffic shaper to prioritize traffic from LAN to host 10.10.10.10 located on datacenter for example,then are i need to create the traffic shapper only for this specific host? Or I need to make another traffic shaper for other traffic with medium priority?

Hello,I have an FMG running version 7.4.7 on Azure, and this FMG has 2 ADOMS, each of which manages a “pair” of FortiGate devices operating in HA (via an Azure ELB).We need to perform scheduled backups once a week from the FMG.Is this possible?Is it possible to export the backups to a TFTP server from the FortiGates, but with everything managed through the FMG?Thank you for your feedback.

Hi allNothing important or urgent.According to Fortiguard RSS feed about updates, a new version of FAC (8.0.4) has been released over 24h ago.However, I am not seeing any release notes on the fortiauthenticator page or see a download folder for 8.0.4 (so no firmware or release notes there either).Usually it doesn't take that long after a release info to see downloads and release notes. So, I am not sure if I am just impatient.Anyone know if the info and firmware files have been withdrawn?Thanks

Hello everyone,I need assistance with configuring FortiNAC guest self-registration to assign different VLANs based on the location of the Cisco access point.Environment:FortiNAC: Version 7.6.7, deployed at HQ. Cisco WLC: Catalyst C9800 running version 17.9.4a, deployed at HQ. Access Points: Deployed at both HQ and Site A. Guest SSID: Configured for FlexConnect, with local switching at Site A. FortiNAC: Guest self-registration and the relevant policies are already configured.Issue:I want guest clients connecting through APs at HQ to be assigned to the HQ guest registration and guest VLANs, while clients connecting through APs at Site A should be assigned to the corresponding Site A VLANs.Currently, when a guest connects through an AP at Site A and completes the self-registration process, FortiNAC assigns the client to the HQ guest VLAN. I have already created the necessary policies in FortiNAC, but I am unable to get the VLAN assignment to work correctly according to the AP's location.M

Hi,I just downloaded FortiOS 7.6.7 for VMware, but when I use the CLI, I am able to log in with my username and password:Username: adminPassword: [Assigned password]However, when I try to authenticate via the web interface, I get a credential error.Does anyone have any ideas?

We have experienced what appears to be a chronic problem with the 40F routers crashing and dumping their firmware entierly when they lose power unexpectedly. In the last year I would say 8-10 of our deployed 40F routers have dumped firmware, forcing an on-site trip to connect physically and attempt a TFTP load of firmware just to get the box to boot again. I just did one this morning, and another before that just last week. I haven’t gotten anyone from Fortinet to acknowledge an issue, they just ask me to buy more support contracts. Has anyone else had this experience? Is there a paritcular firmware minumum that resolves this issue? We’re setting them all at 7.4.12M which seems to be quite stable on the 60E, 60F, and 80E units we have in the field. I’d like to proactively address this issue if possible. 

We have become aware of the following security advisories regarding a vulnerability in FortiClient:https://fortiguard.fortinet.com/psirt/FG-IR-26-156https://advisories.ncsc.nl/2026/ncsc-2026-0296.htmlWithin our organization, we exclusively use FortiClient VPN-only for Windows. We do not use the full FortiClient client or FortiClient EMS.Therefore, we would like to know whether the vulnerability described in FG-IR-26-156 also affects the FortiClient VPN-only client.Additionally, we would appreciate clarification on the following:* Is FortiClient VPN-only affected by this vulnerability?* If so, which versions are affected?* Which version does Fortinet recommend installing to address the vulnerability?* Is an updated version of FortiClient VPN-only currently available?* Does the VPN-only client update automatically, or do we need to manually deploy the updated version to all our laptops?We would appreciate your clarification so that we can take the appropriate measures if necessary.Kind r

Hello,We are using the free FortiClient Windows VPN-only agent, version 7.4.3.Regarding Fortinet PSIRT advisory FG-IR-26-156 / CVE-2026-70465, the advisory lists FortiClient Windows 7.4.0 through 7.4.3 as affected and recommends upgrading to 7.4.4 or later. However, the FortiClient Windows release notes state that versions 7.4.4 through 7.4.7 do not include a new release of the free VPN-only agent, and that users can continue using the 7.4.3 free VPN-only agent. Could a Fortinet representative please clarify the following?Is the latest available free FortiClient Windows VPN-only 7.4.3 build affected by CVE-2026-70465? References:FG-IR-26-156: https://fortiguard.fortinet.com/psirt/FG-IR-26-156FortiClient 7.4.7 release notes: https://docs.fortinet.com/document/forticlient/7.4.7/windows-release-notes/683433/special-notices This is a request for clarification of the public PSIRT advisory’s impact and remediation path for the free VPN-only edition

We have trouble with Forticlient vpn only 7.4.3 on Mac OS 27 Golden State. If we are trying to establish vpn connection, every time we recived time out. Oure Macbook Air is staight from suplier with clean preinstaled Mac Os Golden State. Vpn is configured as IPSec. Firewall is disabled.The same config we are using on Windows and it is working just fine.

An incident occurred involving the FortiMail RAID configuration (RAID60-S) where multiple disks simultaneously switched to "UNKNOWN" status, subsequently transitioned to "REBUILDING," and finally recovered to "OK."Have there been any similar incidents in the past?Does anyone know the cause?Model: FortiMail 3000FFirmware: v7.4.2 (GA-Maturity), build583, 2024.02.07RAID SystemModel: AVAGO MegaRAID SAS 9460-16iDriver: 07.714.04.00-rc1Firmware: 5.170.00-3483u0 (RAID60)├ u0-0 (RAID6)│  ├ p0│  ├ p1│  ├ p2│  ├ p3│  └ p4│└ u0-1 (RAID6)├ p5├ p6├ p7├ p8└ p9p10: SPAREp11: SPARE  3,"2026-09-26","21:07:33.594","system","Disk p3 has changed status from 'REBUILDING' to 'OK'.","warning","0702003084"4,"2026-09-26","21:07:33.594","system","RAID device has changed status from 'REBUILDING' to 'OK'.","warning","0702003084"13,"2026-09-26","17:08:48.462","system","Disk p7 has changed status from 'REBUILDING' to 'OK'.","warning","0702003084"19,"2026-09-26","16:32:54.634","system","Disk p2 has changed status fr

I replaced the secondary unit of a FortiMail (3000F) configured in a primary-secondary setup and rebuilt it using the old secondary unit's configuration.Before connecting it to the primary unit, the following entries appeared in the "Mail Event" logs:/var/spool/etc/mail/submit.cf: WARNING: dangerous write permissions/var/spool/etc/mail/sendmail_ec.cf: WARNING: dangerous write permissions/var/spool/etc/mail/sendmail.cf: WARNING: dangerous write permissionsDoes FortiMail use sendmail for email transmission and reception?For the time being, I have connected it to the primary unit, and data synchronization is complete.If the primary unit were to fail in this state, causing the secondary unit (which generated these error logs) to take over as the primary,would email transmission and reception function correctly?I am concerned about this point. Do you have any information regarding these logs?When I tested sending an email via Webmail from this secondary unit,the following entry appeared in

Hi Guys,We are facing a wireless authentication issue specifically with hybrid Entra ID users.Fully cloud-based Entra ID users are able to authenticate and connect to the wireless network without any issues. However, hybrid users are unable to connect.We tested the affected user's credentials directly from FortiGate, and the credential test is successful. But when the same user attempts to connect through the SSID, Windows immediately shows “Can’t connect to this network.”From the RADIUS logs, we can see: RADIUS Access-Request → RADIUS Access-Reject It looks like the credentials/authentication source is working during the FortiGate test, but something is causing the actual wireless RADIUS request to be rejected.Has anyone faced a similar issue with FortiNAC 7.6.7 and hybrid Entra ID users?Also, what would be the best FortiNAC debug/logs to check to determine the exact reason for the RADIUS Access-Reject?Thanks in advance.

Hi community, I have a question about FAZ logging. Which I can’t seem to find the right answer to and I’m hoping you guys may have experienced something similar.Basically I need to undertake some work on a FAZ VM itself where I don’t want new logs to be ingested to the database for a few hours while I do some work. It will be coming up and down so I don’t want it to start taking new logs when it boots up again.I have about 50 Gates logging to this FAZ and it is not feasible to go to each one and turn off the FAZ logging. I’m ideally looking for something like a pause button on the FAZ if it were to exist. I’m on a VM running 7.4.10. I have seen some recommendations about disabling the port on the FAZ used by the Gates so traffic can’t make it through and using a separate management port to continue to connect to the device which I believe is potentially my only option.Any other thoughts?

Hi Community,I am reaching out because I am hitting a wall with a specific client installation and I suspect a hardware/driver conflict, but I need confirmation or ideas on how to debug this further.The Scenario: I am deploying an IPsec VPN configuration with SAML Authentication (Entra ID / Azure AD).Success: The exact same configuration works perfectly on an HP PC.Failure: It fails consistently on a specific Dell Laptop.Environment (Failing Machine):Hardware: Dell LaptopNetwork Adapter: MediaTek Wi-Fi 6E MT7922 (Wireless LAN Card)OS: Windows 10/11 [Please confirm your OS version here, e.g., 22H2]FortiClient Version: VPN-only Client 7.4.3 (Build 1790) / Hotfix 1.8758The Symptoms:The user starts the VPN connection.SAML Authentication window pops up (Microsoft Entra ID).Authentication is successful.The Issue: Immediately after the auth window closes, the FortiClient status hangs (stalls). It does not establish the tunnel.After a short moment, nothing happens, or the connection attempt si

Has anyone run into this error when registering FortiClient to EMS Cloud using Google Workspace SAML?Error: 403 - app_not_configured_for_userEnvironment:FortiClient EMS Cloud Google Workspace SAML authentication FortiGate 90G HA pairAlready verified:User access set to ON for all users in Google Admin Attribute mapping is correct ACS URL and Entity ID match between EMS and Google SAML app Not in test modeStill getting the 403 on registration. Anyone else hit this and found a fix?

Hi,What issues could there be in a split-brain scenario? I realize the raw logs sync wouldn't be a problem, but what about configs? For instance, an admin adds some devices to one node while another admin adds new devices to the other node. How can the Geo-redundant HA reconcile those changes? Can that damage Analyzers and Collectors?

Sometime we facing issue the client suddently disconnect from the network and i got below error.Is the fnac reject the client request? This is not permanent issue because if i re-plug the cable then the client can connect again