Fortinet Community

Hi Community,I am reaching out because I am hitting a wall with a specific client installation and I suspect a hardware/driver conflict, but I need confirmation or ideas on how to debug this further.The Scenario: I am deploying an IPsec VPN configuration with SAML Authentication (Entra ID / Azure AD).Success: The exact same configuration works perfectly on an HP PC.Failure: It fails consistently on a specific Dell Laptop.Environment (Failing Machine):Hardware: Dell LaptopNetwork Adapter: MediaTek Wi-Fi 6E MT7922 (Wireless LAN Card)OS: Windows 10/11 [Please confirm your OS version here, e.g., 22H2]FortiClient Version: VPN-only Client 7.4.3 (Build 1790) / Hotfix 1.8758The Symptoms:The user starts the VPN connection.SAML Authentication window pops up (Microsoft Entra ID).Authentication is successful.The Issue: Immediately after the auth window closes, the FortiClient status hangs (stalls). It does not establish the tunnel.After a short moment, nothing happens, or the connection attempt si

Has anyone run into this error when registering FortiClient to EMS Cloud using Google Workspace SAML?Error: 403 - app_not_configured_for_userEnvironment:FortiClient EMS Cloud Google Workspace SAML authentication FortiGate 90G HA pairAlready verified:User access set to ON for all users in Google Admin Attribute mapping is correct ACS URL and Entity ID match between EMS and Google SAML app Not in test modeStill getting the 403 on registration. Anyone else hit this and found a fix?

Hi,What issues could there be in a split-brain scenario? I realize the raw logs sync wouldn't be a problem, but what about configs? For instance, an admin adds some devices to one node while another admin adds new devices to the other node. How can the Geo-redundant HA reconcile those changes? Can that damage Analyzers and Collectors?

Sometime we facing issue the client suddently disconnect from the network and i got below error.Is the fnac reject the client request? This is not permanent issue because if i re-plug the cable then the client can connect again 

https://fortiguard.fortinet.com/psirt/FG-IR-26-156FG-IR-26-156 (CVE-2026-70465) advisory states the fix is available in FortiClient Windows 7.4.4 / 7.2.12 and later. However, the free VPN-only agent has not received a new release since 7.4.3 (per the community note that v7.4.4–7.4.8 include no new free VPN-only build).Could you confirm: 1. Is FortiClient Free VPN-only 7.4.3 (build 4726) vulnerable to CVE-2026-70465? 2. If yes, will a patched free VPN-only build be released, or is upgrading to a licensed version the only path to remediation? Thanks in advance.

We are currently evaluating our options and already have a quotation prepared for a licensed FortiClient solution, which is awaiting final approval and signature. Our organization has two FortiGate firewalls with active licenses and has been using FortiClient VPN Free Edition 7.4.3.4726 as our VPN client.Approximately 20 days ago, one of our security partners advised us to remove or upgrade FortiClient VPN 7.4.3 due to a reported vulnerability. As a result, we upgraded to FortiClient VPN 7.4.8. However, we later discovered that this version appears to require FortiClient EMS for ongoing management, leaving us uncertain about the most appropriate temporary solution.We have been unable to determine whether FortiClient VPN Free Edition 7.4.3.4726 remains secure for continued use. The software is still available for download, and discussions in community forums appear to reference different CVEs than the ones currently under review.As part of our evaluation process, we would like to unders

Hello,We have a large amount of FortiGates running 7.4 with automatic patch updates.Different kinds of models, but mostly entry-level ranging from 40F to 100F and 50G to 90G.We are looking to upgrade these manually to 7.6 and keeping automatic patch updates on.I am going back an forth between 7.6.6 and 7.6.7, as public opinion varies greatly between these, and according to release notes they both have different issues.Anyone out there know if 7.6.7 is included in the automatic patch updates, or if this still sits with 7.6.6?

This has been asked many times about - so, today Fortinet released CVE-fixing updates to its regular paid version, AND free VPN-only 7.4.3. The version number does not change - only built version. Announcement today: 

We are a new customer running FC 7.4.8 on 400+ Tahoe 26.6 Macs. We need to verify if Macs can be auto-updated from our EMS (Example: When 7.4.9 drops, can our Macs get updated silently/automatically like other popular VPN/Security solutions)? I'm unable to find any official documents on this.

Hi,Our FortiGate 80F-POE is on version 7.4.11. We plan to upgrade to next higher version 7.6.x. Can someone help me identify which is the most  stable and least vulnerable version in 7.6.x?Thanks,Sanjay

orgin->sink: org pre->post, reply pre->post dev=1->2/3->1 gwy=x.x.x.x/0.0.0.0Traffic goes from LAN to ISP1, then returns from ISP2. We are doing BGP with both ISPs and advertising our public range out of both, so the "internet" is preferring to come back (due to BGP mechanisms) ISP on dev=3. How come the Fortigate is allowing this flow? I know it is allowing it, its working perfectly, but im just curious as to what I am missing here, as I thought that if traffic comes from a different interface that it went out, fortigate will block it.Note ISP1 and ISP2 are part of the same SDWAN zone. maybe this is why? still not sureAlso the session was offloaded indeed.

Hello,I’m creating this Topic because I’m facing an issue that neither me, Dell or our Forticlient provider faced before and we both have no idea what exactly is going on. We ordered a batch of Dell Computer Pro 3 14260. Those computers are facing kernel boot trap double fault with fortishield.sys. It occurs most of the time when the computer is booting with Forticlient 7.2.15.1309, but also very often when connecting or disconnecting of Forticlient. We also tried with 7.2.14 and 7.2.13 with same issueOur EMS is in 7.2 so we can’t try 7.4 for now it’s ongoing we have to build a linux machine for the upgrade.We don’t have this problem with any other dell computer model Of course if I don’t have Forticlient installed I don’t have any issueI’m trying to compare the components for those computers and see what could be conflicting but extremely difficult  I just know it’s something with fortishield.sys as it is mentioned in the minidumps If anyone faces this (no result on forum search) or h

Hi everyone,We are experiencing an issue with FortiClient VPN 7.4.3.1790 on some PCs belonging to one of our customers.After Windows starts, the following error message is displayed:“A JavaScript error occurred in the main process”The VPN itself continues to work correctly despite the error.We have searched online and found a possible workaround that seems to resolve the issue: Uninstall the existing FortiClient installation using Revo Uninstaller. Remove any old Microsoft Visual C++ Redistributable packages (e.g. 2008, 2013) using Revo Uninstaller. Restart the PC. Install the latest Microsoft Visual C++ Redistributable. Reinstall FortiClient. This procedure worked on some of the affected PCs.However, we now have a different limitation: FortiClient can no longer be installed manually using the installer. It must be deployed through Microsoft Company Portal, and the issue has started occurring again on the affected PCs.The environment is also EMS-managed.Has anyone experienced t

Hello,I am trying to activate the Permanent Trial / Evaluation license for FortiGate-VM 7.6.6 running on Microsoft Hyper-V.When I run:execute vm-licenseI receive:Failed to download VM license.The VM license status is:diagnose hardware sysinfo vm fullvalid: 0status: 3code: 502The VM itself is recognized as an Evaluation VM:diagnose debug vm-print-licenseModel: EVAL (1)CPU: 1MEM: 2048I have tested the license activation in two different network environments:Corporate network using an HTTP proxy Mobile hotspot without the corporate proxyOn the mobile hotspot, the FortiGate could successfully reach both 8.8.8.8 and usupdate.fortiguard.net, but execute vm-license still returned Failed to download VM license.I also ran:diagnose hardware sysinfo vm setupbut the license status remained:valid: 0status: 3code: 502Fortinet Customer Service confirmed that FortiOS 7.6.6 supports the Permanent Trial license and that there is no issue with the Evaluation license activation or registration on the Fort

Hello Team,can anyone help me with dial up vpn configuration with PKI user.It is working fine with radius user but the requirement is for internal users vpn should be connected with certificate instead of username and password. any step by step configuration guide and troubleshooting links would be helpful

Hi I am trying to install my FortiClient but I am getting this error. I have had it installed before but then I had to uninstall it due to issues.   

Hey guys, Am facing issue with one of my fortigate device. The config status is shown as conflict. After a commit. The changes are reflected in the device level. Also once am trying to retrieve the config it is stuck. Does anyone had this issue before FMG version : v7.4.9Fortigate version : v7.4.7

Download links for FortiClient EMS invitations are not working because the filename in the invitation are Initial Cap, while the filenames are all lower case. Running version 7.4.8. This was working up to yesterday.

Is there a way to restrict vpn traffic from my external ip to IP that vpn would connect to using fortigate?

 Hi,I am troubleshooting an N+1 synchronization issue on FortiWLC 8.6-5build-8.The N+1 status currently shows Healthy, but configuration changes are not being synchronized to the secondary.I found the following error in the primary controller logs:Oct 1 2026 11:30:59 <controllername> nplus1_Primary:ERROR: Error: Ignored (/opt/meru/np1/scripts/np1-files)(np1sync_files.tgz) in middle of making sync package.I would like to understand exactly what this error means.In particular: Why is np1sync_files.tgz being ignored while the N+1 sync package is being created? Is /opt/meru/np1/scripts/np1-files a normal FortiWLC N+1 directory? Is np1sync_files.tgz a temporary file generated during the synchronization process? Could this "Ignored" message cause the N+1 configuration synchronization to fail? Is there a supported way to access or inspect /opt/meru/np1/scripts/np1-files on a FortiWLC controller? If shell/SSH access is available, what account or method should be used to inspect

Hi, I’m having an issue where users are missing from groups synchronized with Entra ID. I can browse and import groups from Entra ID, but when I go to System > Groups > Remote Groups and select "Show members," the list is empty. I suspect a missing API permission, but I’ve checked everything and the configuration looks correct. Has anyone encountered this problem before?P.S. The connection to Intune is configured and working without issues.   

I have one FGT node in one data center and another node in a different data center. Currently, each one has its own management IP: 10.10.10.1 and 10.10.10.2.This is a deployment from scratch, so we are going to connect a cable between the HA ports of both nodes.My question is: I now need to configure an A-P HA cluster between the two nodes. However, in the past, when I enabled HA Reserved Management in an attempt to keep both management IPs independently accessible, I lost access to the firewalls through their management interfaces.What would be the correct steps to set up an A-P HA cluster between these two nodes without losing access to either of them through their respective management interfaces?

Currently, I have a FortiGate configured with two ISPs, with WAN1 as the primary connection and WAN2 as the secondary connection.For the LAN-to-Internet policy, I have a fixed IP pool NAT configured using the usable IP provided by WAN1. When I introduced an additional IP pool NAT on the LAN-to-Internet policies using the WAN2 Interface IP, users reported that they were unable to access the internet.After reverting the change and removing the WAN2 IP pool, internet connectivity was immediately restored for the users.My question would be:- What is the recommended NAT design for a FortiGate with DUAL ISP connectivity when an existing IP pool nat is already in use?- Are there known considerations or limitations when using fixed IP pool NAT address in a multi-WAN deployent?- Are there any FortiGate best practices for maintaining internet connectivity while introducing NAT rules in a dual ISP environment?

I have enabled pmtu-discovery as per instructions from this topic Dynamic MTU Configuration in SD-WAN Deplo... - Fortinet Community but MTU on the GRE tunnel remains 1476. I want it to be 1356 for this state when ipsec is off. one side of that mikrotik - fortigate link is discarding ldap traffic so domain users are unable to log into their computers because of problem in communication between computers and domain controllers... ldap traffic from windows 11 clients to domain controller on port tcp88 and vice-versa has DF bit set and traffic may not be fragmented..

Can we query fortinac license usage using snmp? I need historical license consumption every hours.