Fortinet Community

Here is a cleaner and more professional version for your post:Hello everyone,I’m currently working with a FortiExtender (FEX) using LTE connectivity, and I’m facing an issue related to public IP changes.Every time the LTE provider assigns a new IP address, the connection drops completely. The only way to restore connectivity is by rebooting the FortiExtender.Has anyone experienced a similar behavior?I would like to understand:Is this expected behavior with LTE dynamic IP?Is there any configuration (keepalive, DPD, monitoring, etc.) that can prevent losing connectivity after an IP change?Would enabling specific SD-WAN or tunnel monitoring settings help in this case?Any recommendations or best practices would be greatly appreciated.Thanks in advance!

I would like to know if anyone has experience implementing guest authentication using QR codes or guest access codes through the FortiGate captive portal at the interface level.Currently, I am configuring a captive portal for guest WiFi access, and I would like to provide a more user-friendly authentication method for visitors. Ideally, I would like to implement one of the following options:Access through QR codes that redirect users directly to the captive portal login page.Guest access codes or vouchers that users can enter in the captive portal to gain temporary access

Hi,I tested a FortiExtender LAN Extension on an FGVM-02. After removing the Extender configuration, only the tunnel interface remains, which cannot be deleted. The error message is: (phase2-interface) # delete fext-ipsec-***Can not delete a static table entryCommand fail. Return code -61 Does anyone have an idea how I can remove it? Thanks. 

Hello, We have FortiSwitch user ports configured with 802.1X authentication, using a Microsoft NPS server as the RADIUS server. We now need to ensure that IP phone ports and access point (AP) ports are also protected with 802.1X, so that if a device other than an AP or IP phone is connected, it must authenticate. I tried creating a dynamic port policy with the following logic: * The first three rules match APs based on vendor and device type, and assign them a VLAN policy without 802.1X.* The last rule assigns our 802.1X policy to any device that does not match the previous rules. However, when I connect a PC to these switch ports, it somehow receives the native VLAN configured in the VLAN policy used for the AP rules. This happens even though the PC does not appear as a matched device for those AP rules. Does anyone know why this might be happening? Or can you suggest another way to bypass 802.1X only for IP phones and APs without using MAB(without h

Last year we closed a location in the Eastern time zone and put the recovered AP's in storage. When a site in the Central time zone had an urgent need, we shipped them 5 AP's from this inventory, and now the site is complaining all their computers are defaulting to the Eastern Time Zone.  Now the finger pointing is going on between the Windows desktop team and the Networking team. I discovered a portal MS provides where you can request your BSSIDs to not be tracked in their geo database, but it's an input only form that leaves you wondering if anything is really going to happen. It also provides no way to determine if BSSID is what is causing the incorrect time zone detection.   The FortiGate is set to the correct time zone, has the correct time, and DHCP points clients to the internal NTP servers for centralized time.  I am curious if anyone else has come across this and have any advice on resolving it? Denny

Hey guysI already know that we can update IPS Engine manually.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-manually-upgrade-the-IPS-Engine/ta-p/194513https://community.fortinet.com/t5/FortiGate/Technical-Tip-Upgrading-IPS-Engine-on-the-primary-FortiGate-will/ta-p/202345But can we update IPS Engine automatically ? Are there any related document ?

Lab Setup:Host Machine:Connected to internet.Default gateway: 192.168.1.1/24Running VMware WorkstationVM Configurations:FortiWeb VM:Port1 (LAN segment: WAN): 10.10.10.10/24Port2 (LAN segment: Lan): 192.168.2.101/24Port3 (Management - Bridged): 192.168.1.121/24Windows Client VM:LAN segment: WANIP: 10.10.10.2/24Default gateway: 10.10.10.10Firewall disabledWindows Server_1 VM (IIS):LAN segment: LanIP: 192.168.2.250/24Default gateway: 192.168.2.101Windows Server_2 VM (IIS):LAN segment: LanIP: 192.168.2.240/24Default gateway: 192.168.2.101FortiWeb Configuration:Created VIP: 10.10.10.50/24 on Port1Created Virtual Server using this VIPCreated Server Pool:Type: Reverse ProxyServer Balance: enabledHealth Check: HTTPLoad Balancing: Round RobinAdded both servers (192.168.2.250 and 192.168.2.240)Port: 80Health check: InheritCreated Policy:Linked to Virtual ServerLinked to Server PoolProtocol: HTTPLog traffic: enabledIIS Configuration:IIS installed on both Windows ServersDefault website works when

Hi,I download the latest Fortinet VPN file.Trying to install it ion Windows 11 25H2The process seems working but at the end, application is not installed. no error message.I'm trying to supress microsoft visual C++ distirbution, then retry to install but same result.How to fix it  & install the VPN client ?

these 2 microsoft team network are injected into mac route table to be sent over  vpn tunnel and when it does this, user fails to join the meeting (see attached screenshot). Our vpn set up is ssl vpn and with split tunnel based on firewall policy destination with FQDN route injectionBelow are those network:Below are microsoft team network on netstat -nr above52.112.127.222Query name (QNAME):api.flightproxy.teams.microsoft.comAnswer (A record) name (RRNAME):epx-enterpriseproxy.d03-058.ic3-calling-enterpriseproxy.01-eastus-prod.cosmic.office.netReturned IP52.112.127.222 52.112.23.78Query name (QNAME):epx.usea-03.ic3-calling-enterpriseproxy.eastus-prod.cosmic.office.netAnswer (A record) name (RRNAME):epx-enterpriseproxy-1.d03-058.ic3-calling-enterpriseproxy.01-eastus-prod.cosmic.office.netReturned IP:52.112.23.78It appears so far only mac user having this issue . The issue  is reproducible  easily. We  run through diagnose firewall fqdn list-all and the injec

Hello,I made a support ticket for this issue (=11577363)  The combination we use :Forticlient-EMS with IKEv2(with EAP-TTLS) IPSEC dialup vpn with authentication via AD LDAP(S) , Fortigate v7.4.x does not seem to support the following :  change the password when expired or change for the first time at login when checked.I've been asked to make a new feature request to allow this in future releases.I hope this can be done via this way.

Hello together, we are currently using free FortiClient VPN in our environment and have started experiencing a serious issue affecting multiple users.When users click “Connect” in the FortiClient VPN client, the connection progress does not start — no percentage counter appears and the login process does not proceed at all. In addition, the FortiClient icon is no longer visible in the system tray.We have already: Restarted all related servicesPerformed complete uninstallations and reinstallationsRebooted the affected machines multiple times None of these steps resolved the issue. The only thing that has worked so far is a full reinstallation of the operating system, which is obviously not a sustainable solution. The issue has already occurred on 6 machines and the number is increasing.We need assistance in identifying the root cause and a proper fix. Thanks for the Help. Ist an German Client.There is no percentage progress bar displayed during the connecti

Hi,When a user logs in to FortiSASE for the first time, the device is automatically placed in the Default Endpoint Group.Is there a way to make the device join a specific endpoint group immediately instead of going to the Default group first?I would like to avoid moving devices manually after first login. 

 Hello,I’m facing an issue with FSSO on FortiGate.Scenario:FSSO is configured and connected correctly.When I run:   diagnose debug authd fsso listI can see all logged-in users that FSSO knows about.However:The firewall does not recognize these users in policies.The users are not usable for authentication-based rules.They only become available after I manually refresh/pull users from the GUI.this photo how i pulled into firewall My Question:Is there a way to pull/import FSSO users into FortiGate via CLI or API instead of using the GUI?Specifically:Is there a CLI command to force FortiGate to sync FSSO users?Can this be done via REST API?Is there a debug command that forces the firewall to populate the user table? Any guidance would be appreciated.Thank you.FortiGate #FSSO

Hi all,I need one clarity about captive portal option we have under user and authentication.i wanted to know the use case of this and by default it is disable still captive portal works in my environment.

Hi everyone! I am currently doing a clean-up on our FG501-E. Part of cleanup is to check whether the tunnels are still passing traffic. Where could I efficiently check this type of log? I did the 3 and no results came back1. diag vpn ike gateway list2. Went to the GUI > Dashboard > Network > IPSEC3. Went to FortiAnalyzer > Events > VPN It feels like I am doing wrong on checking. Could you kindly suggest other ways to check this? Regards!

Hi, I am currently migrating multiple Cisco ASA firewall  to a single FortiGate (HA setup). I extracted multiple NTP server and DNS server, and all of them are requirement of the client for auditing.  How can I configure this servers on the FortiGate?

Hi All,I need some expert opinion for my issue that is being caused by the FortiEMS Client. CPU behaviour:When downloading a test file, the CPU would remain at 100% consistently.Testing with another laptop performing the same download showed CPU around 45%, indicating normal behaviour.FortiClient observation:When FortiClient Fabric Agent (EMS) was enabled and the machine was on fabric, CPU usage during downloads would spike to ~100%.When FortiClient was disabled / off fabric, CPU usage dropped to ~40–50% during the same download test.This also causes network drop, teams issue and many more other problems that is related to network. The on-fabric feature currently has all modules disabled except for the system module, yet the CPU spike still occurs when the endpoint is connected to the fabric. The issue has been confirmed to be caused by the FortiEMS Client. My version is 7.2.8. Case has already been raised but I am not nearing or anywhere close to the solution.&nbsp

I have a setup where the Fortigate has Microsoft Entra Single Sign-On as an authentication scheme and a ZTNA setup that uses groups from that. The devices are Entra joined Intune managed, and synced and verified to the Forticlient EMS server.  Everything works when using Windows devices. It automatically knows who the user is, matches the groups he is in and allows access to whatever is setup on the proxy policy.  But when i do it for macOS devices, it doesn't work.  I am having issues understanding what this means from the documentation FortiClient (macOS) does not support native Entra ID integration with EMS. For the integration to work, macOS endpoints must be managed by Intune or JAMF and enrolled to company portal using Entra ID.For the integration to work macOS endpoints must be managed by Intune and enrolled to the company portal using Entra ID.  My mac device is managed by Intune and enrolled to the company portal using Entra ID (tho

We're running FortiClient 7.4.5. All of our Windows 11 computers contain thousands of events like this in the Windows Security log. There are close to 100 every minute and they're all the same. Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.File Name: \Device\HarddiskVolume3\Program Files\Fortinet\FortiClient\FortiAmsi.dll I don't know when the issue started, but it has been going on for at least a year and through multiple FortiClient versions. I opened a Fortinet support ticket and they told me it was a Microsoft issue. I'm skeptical that attempting to contact Microsoft would be helpful. Do others notice these events in the security log. The events occur so often that it's hard to find other important events.

my forticlient has been working fine now i cant get in always saying credential or sslvpn configuration is wrong -7200 even tho my password and everything is correct 

When I tried to connect to my IPSEC VPN, an error " time out connecting to its wan"what should I do?

Hi!The FortiClient IPsec connection takes too long when using the FortiClient EMS-managed client.Clients that are not managed by EMS (VPN‑only client) take about 6 seconds to establish the IPsec connection.Example log:06:09:02.585 → VPN connection starts06:09:02.834 → IKE_SA_INIT sent06:09:02.851 → IKE_SA_INIT received (16ms)06:09:02.914 → EAP-MSCHAPv2 started06:09:02.936 → EAP-MSCHAPV2: Authentication succeeded (22ms!)06:09:03.657 → negotiation success (~1s total IKE)+4.29s GAP – NO IKE activity06:09:07.947 → first ike_sa_alive checks(only keepalives, no real traffic)06:09:24.777 → Ready to read packets06:09:24.787 → tunnel_name = dummyThe IKE negotiation itself takes ~1 second.Technically, the tunnel is up at 06:09:03.657.But FortiClient only reports the tunnel as "Ready" 21 seconds later — from 06:09:03 to 06:09:24.Attempts so far: config user settingset auth-on-demand always set client-auto-negotiate enableset client-keep-alive enableCreated VIP and policy to allow traffi

found several KB articles state the dev_down value in diagnose sys session stat or diagnose sys session full-stat is related to the time firewall sessions are deleted because an (IPsec) interface goes down, although one says IPsec admin down and the other general interface down ... planning to do some tests on that soonish. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-counter-information/ta-p/197839 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Meaning-of-the-counter-fields-in-diagnose-sys/ta-p/192305 But how does it relate to two values? what is the first and the second value, a recent and total value perhaps? Can't find the exact answer in the KBs.

Hello, I just ran into this: on a FGT I have two policies: One has a VIP as destination to rewrite an ip into a different subnetThe other matches all traffic between the involved subets and interfaces.the policies have exactly this order. In FortiAnalyzer I can see:- it does the VIP because it shows me the destinatin nat ip- it didn't match the first policy though because source intf and -address were wrong in itBut- it also didn't match the 2nd one even though everything in there matches and the traffic got denied (Policy #0 implicit deny). I understand why it didn't match the first policy but I don't get why it didn't match the other policy then. Policy #1: Source Interface: zone2destination Interface: zone1source address is in subnet of member of zone2destination: vip1action: allowservices: ping,https vip1:external IP: ip the traffic originates tomapped IP: destination ip (which is also on a meber of zone1) Didn't match because traffic or

Forticlient VPN 7.4.3.1790 (free)Fortigate 100F 7.4.11We are doing cert based IKEv1 with xauth and Fortitoken, works fine.Now im migrating, so i started setting up SAML and IKEv2 with PSK, it worked. From there I wanted to make it certificate base, some EAP config are already in there: