Fortinet Community

Hi everyone,I’ve deployed an IPsec dial-up VPN to allow users to connect via FortiClient.The VPN uses IKEv2 and a RADIUS server, and all users belong to the emergency group.After configuring FortiClient with all the correct phase 1 and phase 2 parameters, I consistently get the following error when trying to connect:"WRONG CREDENTIAL EAP FAILED CONNECTING TO 8.x.x.x"Below I’ve included the phase 1 and 2 configuration, along with the log captured from the FortiGate.The log clearly shows that the user is correctly identified, as well as their group membership.However, shortly before the error, this message appears:ike V=Vpn:1:Emergency:1804 EAP 14757603831873 result FNBAM_DENIED ike V=Vpn:1:Emergency: EAP failed for user "jjonh"Phase1 configuration:edit "Emergency"set type dynamicset interface "WAN"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 8.8.4.4set proposal aes256-sha256set dpd on-idleset dhgrp 14set eap enableset eap-identity s

Hi everyone, I've got the guest flow working — guests get isolated, hit the captive portal, self-register, and get moved to the guest VLAN. SNMP, MAC learning, and L2 traps are all configured and working on the switch side.Now I'm trying to set up the employee flow and I'm not sure what the best practice is. For employees I want them to authenticate against Active Directory and then get placed into the employee VLAN automatically. My question:For AD-authenticated employees, is the captive portal still the recommended approach or should I be looking at dot1x instead? (It is a wired network, no wireless).Any advice or example configs would be greatly appreciated. Thanks!

Hello everyone,  I have a question regarding guest self-registration accounts in FortiNAC. Guest accounts are configured with a validity period of 24 hours. Once the account expires, I’m trying to locate the history or record of that account. The only place where I can still see some trace of them is under the Account Requests section. Could anyone please clarify where expired guest accounts are stored, or how we can access their history after expiration? Is there a specific log, report, or database section that retains this information? BR,

Hi All, I am quite new to FortiNAC and would appreciate some guidance. A recent vulnerability assessment identified TLS-related issues on a FortiNAC 500 running version 8.7. Based on our checks, the device is already EOL/EOS. However, immediate replacement is not currently possible, so we are exploring mitigation options. The vulnerability recommendation is to disable TLS 1.0 and TLS 1.1 and allow only TLS 1.2 or higher. May I know whether this EOL FortiNAC system supports disabling TLS 1.0/1.1 through configuration without upgrading the firmware? Any advice or recommended workaround would be greatly appreciated. Thank you very much.

Hi all,I’m looking for advice or similar experience with a layered VPN design on FortiGate.Topology  The core transport network is built on FortiGate devices using VXLAN over IPsec across the Internet (site-to-site).Inside the VXLAN, there is a single L2 broadcast domain, and over this network I establish a second (service) IPsec tunnel between two FortiGate devices (for a specific customer).Behind the service (customer) FortiGates:On one side: a serverOn the other side: a client PC Problem:Throughput between the client PC and the server is very low (~9 Mbps).Testing is done using iperf.What I verifiedIf I connect the customer FortiGates directly (without VXLAN) or over the Internet with a single IPsec tunnel, I get around 500 Mbps.This seems to rule out:FortiGate performance limitsPC/server performanceInternet bandwidth issuesHypothesisI suspect the issue is related to MTU / MSS / fragmentation due to multiple encapsulation layers:inner IPsecVXLANouter IPsecHowever, I’m not sure:

    As organizations increasingly rely on AI to accelerate cloud security investigations and security vendors embed more AI into their solutions, supporting responsible and transparent AI usage becomes critical. The FortiCNAPP AI team is committed to giving customers clear visibility and control over generative AI capabilities.     This update reinforces responsible AI adoption while preparing the platform for upcoming AI-powered security capabilities.    Trust in AI?  Trust in Artificial Intelligence (AI) should not be assumed and depends on several crucial considerations. Risk assessments of the data being processed are essential. AI's non-deterministic nature means we must be overtly aware and deliberate about what data we feed into AI systems. For the security-oriented, this will be especially vital as Generative AI and integration into Agentic workflows and beyond continue to evolve and

Currently for contractor user the fortinac will use captive portal using entra ID before gain access to the network.If I only use SSO for the authentication then same contractor user can use any workstation to access the network. Some one here know can we limit the device for single user, example using mac address restriction?I try register manually the devices and assign the device to group named 'Contractor' then if this device plugged to the switch then fortinac open the capive portal and showing the device was registered, the captive portal not bring to login page.

So, I can export a profile, encrypt it, and successfully create it. However, when I import said profile, none of the connections work, and just timeout when trying to connect. No idea what is happening. The restore of the config is successful, but for whatever reason, the config that just worked when it was exported does not work correctly when it is imported. Ideas?

Hello everybody,we are using the FortiClient EMS Server Appliance and want to use our private step-ca as the ACME server for the EMS certificate, including automatic renewal.We do not want to expose EMS to the internet just to use Let’s Encrypt, and we would also like to avoid manual certificate replacement.Has anyone done this with the EMS Appliance, and if yes, how did you get EMS to trust the private ACME CA? Thanks in advance

Hello all,has anyone noticed any issue while loading the dashboard of the EU portal for the forticloud ? i'm able to connect but the dashboard fails to load (portal.eu.fortigate.forticloud.com)

Due to a recent vulnerabiliy reported on 7.4.9 i need to upgrade to 7.4.11 but in the fortigate GUI unders system firmwares i can only see upgrae to 7.4.10 available. However on the support portal 7.4.11 image is available for download ?  Does this mean 7.4.11 not recommended for upgrade ? why it is not showing in upgrade path 

I currently have 4 FortiAP's managed by a Fg-40f the 40F is only job in life is to manage those AP's and the switches, I had it laying around its cheaper to keep paying for forticare for it than run cloud managed.I am currently in bridge mode, 3 of the AP's are local and one is remote connected to a FG-60F on the remote side and managed by the local FG40 via an IPSec tunnel. I have the ability to run UTP on the AP's but didn't buy the AP UTP license since that is currently handled by a pair of edge Fortigates.I have noticed that some stats just don't show up and I am guessing its because I am in bridge mode. Are there any benefits from running one or the other I should be considering? I ran bridge because each AP has two home runs to two different fortiswitches for hittless poe failover and I assume data failover. So in my mind tunnel mode brought those AP's into a single point of failure, however I just ordered a pair of 70Fs to replace my edge firewalls and could in theory run an HA

Hello everyone,I’m encountering a strange behavior with my FortiNAC architecture (v7.4.2) running in Layer 3 mode. Everything was working perfectly for months, but suddenly, the VLAN assignment logic seems broken.My Setup:FortiNAC Version: 7.4.2Mode: L3 with Registration VLAN activated.DHCP: Pool declared directly on FortiNAC for the Guest/Registration scope.Switch Configuration: Standard Radius config applied to the ports.Port Group Membership: Initially, only "Role-Based Access" was checked.Troubleshooting attempted: To mitigate this, I recently had to check "Forced Registration" in the Port Group Membership settings. However, I never needed this before; it used to work perfectly with only "Role-Based Access" enabled.Question: Why did the default behavior change? Has anyone seen a bug in 7.4.2 where unknown hosts bypass the Registration VLAN and get Production access by default?

We have about 100 users using FortiClient (a mix of 7.2.11 and 7.2.12) on Windows 11 laptops (mostly 25H2 but some 24H2) to connect an IPSec tunnel to a Fortinet VM hosted in Azure (UK South). Some users (such as myself) never get connection issues, but some continually report that the VPN drops multiple times during the day. We've done the basic troubleshooting (restart Windows, sit close to the wireless access point, try a cable, speed tests, etc) but we're still unsure what causes this and how we can resolve it.We opened a ticket with Fortinet to send logs and get to the bottom of this but thought I'd ask the community to see if others have found ways to maybe make it more stable and drop less frequently.Your thoughts are very welcome :)

Hello.I've deployed FSSO CA agents on 2 domain controllers (same domain) to enable HA from FGT.I have not deployed the DC agents. Configuration of both CAs is identical, both monitoring the same 2 DCs using WMI polling. The problem is that 'show logon users' on both CAs shows different information .... some logons are shows in both CAs, some only on either one. Refreshing/clearing the logon cache doesn't help. Any ideas what could be wrong?

Hello, After upgrading our FortiAuthenticator (FAC) to version 6.6.7, we noticed that importing remote users from Active Directory via LDAP is taking significantly longer than before. Specifically, the group membership refresh is very slow. We now have to wait at least one hour before newly added users appear in the corresponding LDAP group.

I configure user SSO for FortiNac and after i enter the Entra credential using captive portal then i got this error. Anyone know how to fix this?

When rolling out AWS Network Firewall at the internet edge, one of the first practical decisions security practitioners must make is how to implement deep packet inspection without turning rule authoring and maintenance into a full‑time job. Although custom Suricata rules provide fine‑grained control, they also require constant tuning, threat research, and lifecycle management—work that can quickly slow down delivery in dynamic and fast‑moving AWS environments.   Fortinet’s Managed Rules offer a more operationally efficient approach. Backed by FortiGuard Labs threat intelligence and delivered as a native AWS Network Firewall stateful rule group, these rules allow you to enforce proven security controls without managing individual signatures. From an infrastructure perspective, they integrate cleanly into existing firewall policies and behave exactly like any other stateful rule group—no sidecar appliances, no custom update pipelines.   In this article, we will explore how For

Hi,I'm configuring my first Fortinac.I have a problem whit switching vlan. When I plug on switch an pc  Fortinac receive snpm trap but the switch to isolation vlan is done after 40/50 seconds about.So pc get IP of production and after switching VLAN it don't get a IP of isolation subnet until I do ipconfig /renew.here what I see on switch:Aug 28 15:06:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to upAug 28 15:06:59: %SYS-5-CONFIG_I: Configured from console by admin on vty1... Could you help me? Thanks in advance

Hello guys, I am currently facing an issue with user authentication when connecting to dialup IPSec IKEv2 VPN using SAML authentication through FortiAuthenticator.Ending with this error:Generated some random hash or something instead of user name and reason is SAML auth resp is not detected. Here is part my configuration:config system global     set auth-ike-saml-port 1001     set remoteauthtimeout 120 config user saml    edit "saml_FAC"    set cert "*.secret-2026"    set entity-id "http://vpn.secret.cz:1001/remote/saml/metadata/"    set single-sign-on-url "https://vpn.secret.cz:1001/remote/saml/login/"    set single-logout-url "https://vpn.secret.cz:1001/remote/saml/logout/"    set idp-entity-id "http://fac.secret.cz:4433/saml-idp/ipsecvpn/metadata/"    set idp-single-sign-on-url "https://fac.secret.cz:4433/saml-idp/ipsecvpn/login/"    set idp-single-logout-url

Hello, I would like to know if someone know how can deal with this kind of information leakage. After doing some tests, i didn't see any log using this kind of app "googlesyncfs.exe". Therefore, i cannot create any policy in FortiDLP to avoid this kind of information leakage. It seems like that app ofuscates this file transfer making it really hard to monitor the activity. I've seen that there's one post about drag and drop block uploads by default using FortiDLP, but i doesn't work in this case. I really appreciate any kind of tips you can give me. Best regards.

Hi Everybody,As we (hopefully) all know, SSLVPN tunnel mode will be discontinued in FortiOS 7.6.3. This is definitely a step in the right direction and I don't challenge that decision at all.Now, there's a lot of guides to move to DialUp IPSec and ZTNA. The thing is however, it all is so cumbersome compared to SSLVPN. For instance:- With IPSec, you need to deploy either a PSK (which is not very wise) or certificates, but if you have some external user you'd need to give him a certificate and it's already hard enough if you just have a user/password combo.- With IPSec you can do SAML, sure, but you still need a PSK or a certificate.- ZTNA is nice and all, but you can't have a tunnel which is essential for many of the use cases that revolve around managing devices that are attached to the network (think of: building automation, things like that)...and the list goes on. There's just no easy solution from Forti which I am aware of.So, right now, we're evaluating another approach, basically

Hello everyone, I am new to Fortinet products and have two questions regarding password history thresholds and account lockout settings. I have already reviewed the available online documentation and community forums but was unable to find definitive answers.  Thank you. How can I check the current account lockout settings from the command line? The documentation I found only explains how to configure (set) these values, but not how to display the existing configuration.config system global set admin-lockout-threshold <failed_attempts> set admin-lockout-duration <seconds> end 2. What is the expected outcome if the Password history threshold is set to 3, while Allow password reuse → Specify is set to 8? According to the administrator guide, the reuse value must be lower than the password history threshold. In this case, which setting would take precedence, and how would the system enforce the policy?   

FortiCNAPP AI Assist: From signal overload to action SOC Analyst burnout and the cybersecurity skills gap continue to worsen. SOC teams shouldn’t need deep detection expertise to understand what happened and decide what to do next — and FortiCNAPP AI Assist is built around that simple observation. Shaped for and by analysts using the product daily, every change targets a specific friction point between “alert fired” and “incident resolved.” The result is an AI-assisted triage workflow that correlates context, prioritizes findings, generates remediation grounded in the specific alert, and calls out exactly where confidence ends and assumptions begin. This matters because composite alerts — FortiCNAPP's high-fidelity signals that correlate multiple indicators into coherent attack narratives — carry a lot of context by design. As Fortinet's white paper on AI-driven investigation and remediation describes, the opportunity is in bridging the gap between surfacing correlated alert observatio

It was updated to this version and the eye icon that allowed you to see the password in plain text no longer appears in the wireless controller where the SSIDs are located. Any Help?