Fortinet Community

The vFSA appliance is deployed in IBM Cloud Classic (Dallas) in an active–passive configuration with only one public subnet IP currently assigned, and no additional public IPs available in the subnet. We have five web servers hosting different websites that must be externally accessible. In the absence of spare public IP addresses, we would like guidance on how to expose these services behind the firewall with separate public IPs. Please advise on the recommended architecture or configuration for this setup. If possible please share some links if there are any. Thanks

What are the Windows AD Service Account minimum privileges for the Fortinet SSO user account I must assign in the Windows Active Directory Domain Controller? Granting the overly privileged Domain Admins group to a service account is not permitted due to best practices and the security policies enforced by the security team.

Hello all , I’m a bit confused about the certificate-probe-failed error and would like to better understand why it happens and how to identify its root cause.We experienced denied traffic on the FortiGate firewall to smart.3CX.be:5001 due to a certificate probe failed error, with the following message:"SSL connection is blocked due to unable to retrieve server’s certificate.”(certificate-probe-failed) As the default behavior for CERT probe failed is block so the traffic is blocked.It's strange for me as the issue occurred yesterday, where the traffic was consistently blocked by the firewall. However, today the traffic started passing successfully, and the service is working as expected without any changes made on the firewall side. does anyone have any idea about that ?note : I use default Certificate inspection profile with flow mode .

Hi everyone,I manage like 30 fortigate devices and I updated them to 7.2.13 when it was released.Since I got users complaining about slow SMB traffic inside IPSEC tunnel s2s. The users are all behind this 101E model and they are thé only ones to complain.Bandwidth is like 300KB/s during transfer in 7.2.13I tried to check ipsec config (encrypt. algo.) Changed and adjust MTU but the traffic is still slow...Since the users told me it started since last update I tried to rollback to 7.2.12. same issue. I remember that I updated 7.2.12 and 7.2.13 a week after. So I checked to rollback to 7.2.11 and now speed is back to normal like it was before 8MB/s.I'll open a ticket but it seems linked to this model. Anyone has the same behaviour ?

Hello! I wanted to ask for people who are using fortinac for authentication with radius and mac traps alongside persistent agent. How long does it take for a user to go from isolation vlan to production?

Hey guys, so I did a "small" mistake.We bought two new FortiGate clusters (120G and 100F, both active-passive) to replace our old Palo Altos. One cluster is already running and the other is in the lab to set up.While starting to configure the second cluster, I realized that I mixed them up. The running cluster should be the 100F, but those firewalls are currently on my table. What is the best way to replace the running cluster with the other hardware?The issue I have is that I don't have much time. The second cluster has to be installed next tuesday and the already running cluster is already full productive. How can I exchange them with the least interruption? Thank you so much for your answers!

Good morning, I am struggling with an issue with FortiClient SSL VPN (Standalone VPN) on a Windows 11 computer. I have installed the FortiClientVPNOnlineInstaller.exe from the FortiClient downloads page. The install finishes correctly. I am able to set up the VPN. I've used the exact same VPN configuration on other computers with no problems. On this computer, when I click "Connect" it seems that nothing happens.The expected response would be for FortiClient SSL VPN to open a web page for me to log into my SSO to authenticate. I've performed the following troubleshooting steps:1. Restarted the computer.2. Uninstalled FortiClient VPN/reinstalled FortiClient VPN.3. Checked, double-checked, and triple-checked the configuration. Even tried multiple remote gateways that should work.4. Ran SFC scan on the computer.5. Performed a Network Reset via Windows Network Settings on the computer.6. Ran DISM /RestoreHealth on the computer.7. Flushed the DNS cache.8. Tested the FortiClient VP

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hello guys,I am currently configuring FortiNAC to authenticate users using LDAP accounts. This setup is intended for BYOD devices, primarily mobile phones and Windows laptops.I am using EAP-PEAP with MSCHAPv2 as the inner authentication method.The issue I am experiencing is as follows: FortiNAC correctly assigns profiles and policies to the devices upon authentication, but it does not assign the Access Value / VLAN configured in the SSID according to the Logical Network.For comparison, a very similar configuration is used for internal devices, which works correctly — the Access Value/VLAN is applied as expected.I have verified that:The SSID has the VLAN/Access Value properly configured.LDAP authentication succeeds, and users are correctly identified.Policies and profiles are applied as expected.Could anyone advise why the Access Value/VLAN is not being assigned for BYOD devices in this scenario and how to resolve it?There are some pictures and part of debug log:- AccessConfiguration&nb

Hello everyone, I am experiencing an issue with all my FortiGate 101F firewalls running FortiOS version 7.2.12. Since a few days ago, these devices have stopped sending logs to FortiGate Cloud. The problem is affecting my entire fleet of firewalls simultaneously

Hi everyone, after a lot of trial and error, I managed to set up a working IPSec VPN configuration based on certificates (server and client auth) that works for the FortiClient and also for strongswan (on Linux). Now I would like to extend our firewall policies, so that we can limit access for individual users to what services they actually need. Since user matching is already part of the IPSec authentication, I assumed that this would be fairly easy, but it doesn't work. As soon as I select the group containing the authenticated user for the policy, it doesn't match anymore and traffic is dropped. Here are the relevant excerpts of the configuration: # PKI user:config user peeredit "vpnphip"set ca "CA_Cert_2"set subject "CN = vpn-bup"nextend (I first tried with "set cn vpn-bup", with the same result) # PKI group:config user peergrpedit "vpnadmin"set member "vpnphip"nextend # Normal user group:config user groupedit "vpngroup"set member "vpnphip"nextend&nbsp

Hi, we are looking into the migration from SSLVPN to IPSEC, it mostly works with windows, but there doesn't seem to be any ipsec options for the VPNOnly client on linux (only in windows).It seems that the ZTNA Edition is capable of connecting under linux but it requires licensing.So the question would is, with the 7.6 versions disabling sslvpn, are there any free clients that can connect to VPN with IPSEC+SAML? Will fortinet provide them a any time? Regards

Hi Friends,I would like to know if there is a portal on the FortiGate website where we can check the recommended firmware versions for FortiGate firewalls. Coming from a Cisco background, I’m aware that we can verify the recommended firmware for specific Cisco devices on their website. Is there a similar portal available for FortiGate where we can check the recommended firmware for specific firewall models?

I am no longer able to log in to the AP GUI and am not proficient in CLI yet. If this is an issue, what should I be checking? Although the AP's have the DHCP server enabled when we connect to either of the two SSID's we receive an IPADDR from the pool set up for the DHCP on port 4. Be advised that the AP's are connected to port 4 but have a different DHCP range set up on the individual AP. Does the AP not distribute from its own DHCP range?

I work at a small non profit in New York City. Our network administrator was in a bad accident. I have been asked to help out until a replacement can be found. I have no experience with firewall administration. I need to add IP addresses to the whitelist of  a Fortigate 200D and a Fortigate 60D. Where on the interface do I add these IP addresses. Thank you very much.

Hi there, I have configured Radius server in window server to authenticate Firewall user so that users can manage Firewall. Radius server is accessible from Fortigate Firewall and user is also reachable when I test from FortiGate test connectivity. But when I do ssh or access GUI to access the firewall by entering username and password showing incorrect password. Please need your suggest what I am missing.   Even after entering correct username & password which configured at Radius server is not able to login.  Thanks for your attention on this problem

Currently, two separate FortiMail VM instances are running in Server Mode for two different zones. Both zones use the same mail domain, and FortiMail is providing full mail server functionality (mailbox services) along with email security features.Now, there is a plan to migrate from 2 FortiMail VMs to 2 FortiMail bare-metal appliances (zone-to-zone replacement).I would like to get guidance from the community on the following:What is the recommended process for migrating FortiMail VM (Server Mode) to hardware appliances?Is configuration backup and restore between VM and hardware models fully supported, or are there limitations?What is the proper approach for migrating mailbox data, mail storage, and mail queues?Are there firmware compatibility requirements between VM and hardware before restoring configuration?What storage-related concerns should be considered (e.g., disk initialization, RAID configuration differences)?What are the key risk factors during this migration, especially whe

Last week, I upgraded the Forticlient EMS server to version 7.4.5. The workstations are still running 7.4.4.A few days later, I noticed that there were 3500 files in Quarantine.This wasn't the case before. Users can no longer find some of their files.For example, Spyder is a scripting app we use for data analysis, modeling, and reading/editing files.I've never had a problem with it.But now users are getting the following error:I also see, for example, .xlsx files from some users' OneDrive files incorrectly in Quarantine.These exclaimer files are also valid:When I click on the ransomware link, I get the FortiGuard Labs message below:UnavailableCould not retrieve this virus at this time. Please try again later.Any idea why there are suddenly so many false/positives?

Hi I'm having trouble connecting to the server of one of our customers. In the last 2 weeks it worked but now all I'm getting is Status: DisconnectedNotification: Error: Can not connect to VPN server. I'm using the Foriclient (VPN only client) 7.4.3.1736 für AMD64 linux on a freshly updated Debian 13. In 3 of 5 cases, I enter the password and immediately get this error messages. And even when it manages to connect to the server, it prompts me for the token. And the generated token does not work anymore (using latest FortiToken Mobile on android). This is the error message that I see in /var/log/forticlient/sslvpn.log 20260218 00:15:24.439 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:/CN=<REDACTED>20260218 00:15:24.462 TZ=+0100 [sslvpn:DEBG] vpn_connection:669 http connection closed.20260218 00:15:24.463 TZ=+0100 [sslvpn:DEBG] vpn_connection:531 Response line: 200 OK2026021

Seeking a Fortinet solution to replace our Umbrella DNS Advantage for remote users. The goal is to enforce DNS filtering for all remote users, regardless of whether or not they are on/off VPN. Forticlient doesn't support the DNS filtering profile (only on Gates). My research comes up with the following potential solutions. Looking for any other comments or suggestions. User on prem = use DNS filter on the gateRemote user on FCT/EMS = force always-on vpn and make sure DNS traffic is routed over the tunnel and DNS Filter profile is applied to a FW policyRemote user on SASE = force always-on and apply the DNS Filter profile in the SASE POP. Thanks all,Don

Hi Team, I am unable to use FGT 7.6.6 in my EVE-NG it is asking me to update license but it is not taking that. can someone please help me on this. RegardsSantosh

Hello,I have a Site-to-Site IPsec VPN between a Fortinet FortiGate 80F and a MikroTik router.Phase1 and Phase2 parameters match on both sides. The tunnel shows status = up, but no traffic passes until I manually restart the tunnel on the FortiGate.After restart:Traffic works normallySA counters increaseBoth directions pass trafficAfter some time, traffic stops again while:Phase1 remains upDPD status is OKNo config changes are madeIn diagnose vpn tunnel list, sometimes I see:proxyid_num=0 / child_num=0orasymmetric counters (only enc or only dec increasing)Is it possible for Phase1 to stay up while Phase2 becomes unusable?Could this be related to NPU offloading or replay protection?FortiOS version: 7.4.11Any guidance would be appreciated.#FortiGate

FortiGate / FortiOS: Fortigate 81F / v7.6.2VPN: IPsec IKEv2 dial-up Client: FortiClient VPN-onlyAuth: Local users + EAP-MSCHAPv2 + FortiToken (2FA) Whats working so far : FortiClient connects successfullyFortiToken OTP is requested and validatedClient receives an IP from the IPsec poolTunnel is UP Issue : No access to LAN resources (can't ping my DCs from ipsec vpn but can from ssl vpn)All traffic is dropped by firewall with policy 0 Debug :  Flow debug shows:received packet from VPN_IPSEC_0 route found via LAN Denied by forward policy check (policy 0) Policies I tried so far : srcintf = VPN_IPSEC (not accepted)srcintf = VPN_IPSEC_0 (not a valid interface)srcintf = zone containing VPN_IPSECsrcintf = anyWith / without user groupsWith very permissive rules (ALL / ALL)Still always policy 0. Observations Interface VPN_IPSEC exists (169.254.x.x, type tunnel, UP)Traffic arrives as VPN_IPSEC_0, which cannot be referenced in policies

Hi, New to the forum and seeking assistance.  Since EOL has been set for the FortiGate 30E I am considering updating to the FortiGate 30G. The replacement product. The question is 'Can I download configuration for the FortiGate 30E and upload it to FortiGate 30G. Will uploading transfer the Policy and Object section? Any help appreciated.

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.