Fortinet Community

I have one FGT node in one data center and another node in a different data center. Currently, each one has its own management IP: 10.10.10.1 and 10.10.10.2.This is a deployment from scratch, so we are going to connect a cable between the HA ports of both nodes.My question is: I now need to configure an A-P HA cluster between the two nodes. However, in the past, when I enabled HA Reserved Management in an attempt to keep both management IPs independently accessible, I lost access to the firewalls through their management interfaces.What would be the correct steps to set up an A-P HA cluster between these two nodes without losing access to either of them through their respective management interfaces?

Currently, I have a FortiGate configured with two ISPs, with WAN1 as the primary connection and WAN2 as the secondary connection.For the LAN-to-Internet policy, I have a fixed IP pool NAT configured using the usable IP provided by WAN1. When I introduced an additional IP pool NAT on the LAN-to-Internet policies using the WAN2 Interface IP, users reported that they were unable to access the internet.After reverting the change and removing the WAN2 IP pool, internet connectivity was immediately restored for the users.My question would be:- What is the recommended NAT design for a FortiGate with DUAL ISP connectivity when an existing IP pool nat is already in use?- Are there known considerations or limitations when using fixed IP pool NAT address in a multi-WAN deployent?- Are there any FortiGate best practices for maintaining internet connectivity while introducing NAT rules in a dual ISP environment?

I have enabled pmtu-discovery as per instructions from this topic Dynamic MTU Configuration in SD-WAN Deplo... - Fortinet Community but MTU on the GRE tunnel remains 1476. I want it to be 1356 for this state when ipsec is off. one side of that mikrotik - fortigate link is discarding ldap traffic so domain users are unable to log into their computers because of problem in communication between computers and domain controllers... ldap traffic from windows 11 clients to domain controller on port tcp88 and vice-versa has DF bit set and traffic may not be fragmented..

Can we query fortinac license usage using snmp? I need historical license consumption every hours.

We are observing an issue with FortiClient authentication where the expected “Wrong Password/Invalid Credentials” popup is not displayed when an incorrect password is entered.The issue is a for both local and remote users,Kindly assist us in troubleshooting this issue and identifying the root cause.

Drear colleagues, please confirm if Fortigate FG-120G, (SN FG120GTK25005307 and SN FG120GTK25005240) allow redundant AC power supply with different 220 VAC sources, that is , from different UPS 220 VAC equipments.

I currently block the advertising categories in our DNS and URL Filtering Profiles. We are starting to get a small but increasing number of websites that are blocking access unless we allow access to the Ad network they are using (Screenshot attached below). I am hesitant to allow access to the ad network, however I am getting pressure to do so. What are others thoughts on this. Is it truly a security risk? Is there away to continue to block the ads and allow the website? 

Hello I want to update my license

My email already exists in FortiCare, but signing in shows “UNAUTHORIZED — Your account cannot be found”, error A02E03-151. Creating a customer account fails because the user already exists. Please check my account and its association with Customer Service & Support.

i have one Entra ID single subscription and single tenant but in this entra ID contains 3 of companies. In Entra i have 3 groups indicated their company such as group Corp-1, Corp-2 and Corp-3. In the fortigate can we make a firewall rule based on Entra ID group and not using IP address as the source?

I am automatically updating FortiClient for Windows from version 7.4.5 to 7.4.6. On about 50% of the test computers, the installation process stops at: “Stop services.” I also tried doing it manually by running the installer file, but in that case it also gets stuck at “Stop services.” How can I work around this issue?I have updated versions 7.0.x and 7.2.x many times before and never had this problem. Now I’m updating to version 7.4.x for the first time. Has anyone had a similar issue?   

SUMMARYOn FortiClient for Linux, an IPsec IKEv2 + SAML tunnel imported from an exported XML configuration always fails at IKE_AUTH, even though SAML authentication completes successfully and the encrypted PSK field, password, and profile are all correct. Root-cause analysis shows the client never decrypts the field-level encrypted preshared key (EncX... format) before handing it to iked - it passes the raw encrypted blob through as if it were the plaintext key. ENVIRONMENTFortiClient (Linux), tested and reproduced identically on:- 7.4.3.5411- 7.4.4.1796 (includes the fix for Bug ID 1035496, connection problems with SAML, multifactor authentication, and Linux CLI options)- 7.4.8.1904OS: Debian 13 (Trixie), amd64 - same .deb package family as the supported Ubuntu builds.Connection type: IPsec IKEv2, Preshared Key + SAML/SSO (sso_enabled=1, ike_saml_port=9443), imported via Configure VPN > XML > Import XML Configuration from a profile exported on a Windows FortiClient install. STEPS

Hello Fortinet Community,I am trying to activate my FortiGate VM evaluation license.My FortiGate VM serial number is:FGVMEVXGQIBZMQA4The license status is showing as Invalid.When I try to download the evaluation license, I get:"Error downloading license: Invalid serial number."I previously contacted Fortinet Support regarding this issue and was directed to the Fortinet Community Forum for assistance.Please help me troubleshoot and activate my FortiGate VM evaluation license.I have screenshots of the error and can provide them if required.Thank you.

This update adds a new Outbreak Response solution pack and updates four connectors:Outbreak Response - GitLab Path Traversal Vulnerability v1.0.0: A new response solution pack for the GitLab path traversal vulnerability. It augments the Outbreak Response Framework solution pack. Fortinet FortiAnalyzer v5.0.0: Updated authentication handling to support the latest authentication changes. Fortinet FortiSIEM v7.0.0: Updated authentication handling to support the latest authentication changes. The configuration parameter Organization no longer has a default value. Microsoft Graph API v2.3.0: Added actions and playbooks to get risky user history, get risk detections, and run advanced hunting queries. Added a Days parameter to the Get Risky Users List action, and updated the output schema of the Get Risky Users List and Get Risky User Details actions. Utilities v3.7.3: Fixed URL extraction when escaped backslashes are present. The Email: Extract email's metadata from email file action now ret

Good morning, I have a question regarding FortiClient VPN Only and the expiration of the FortiGuard Anycast CA certificate, which is scheduled for October 10. When I contacted Fortinet support, I was told that version 7.4.3 (the only version available for download from the official website: https://www.fortinet.com/support/product-downloads ) will be affected by this certificate change. Where can I download the updated version? 

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Windows printer component splwow64.exe is being flagged.Here are the exact details of the alert: Process/Object: C:\Windows\splwow64.exe Virus Name: FSA/RISK_HIGH//2000002004 Status: Files could not be quarantined To rule out an actual file-based infection, we verified the system file on the affected endpoints: The Microsoft signature is intact (Get-AuthenticodeSignature returns the status Valid). A local SFC scan (sfc /verifyfile=C:\Windows\splwow64.exe) reports no integrity violations. The file on disk is undamaged. The SHA256 hash of the file is BC7412A5EF6D1B32F7032E1008A324006B19C5A5CE4D27BC8D26DFD6BD7EDB0E. Checking this hash on VirusTotal currently shows 0/71 detections. Since the file itself is cryptographically clean and unmodified on the disk level, we strongly suspect this is a false positive caused by a recent p

Hello community,Product: FortiGate-90GThe device is currently running FortiOS 7.4.7 build 2731.Its FMWR/support contract expired on 11 July 2025.FortiCloud SSO access is currently being blocked with Attack ID 20000021 because the installed FortiOS version is affected by CVE-2026-24858. I would therefore like to update the device to a security-fixed FortiOS release. However, due to the expired support contract, the FortiGate does not permit the upgrade through FortiGuard and the FortiCare portal does not allow me to download the firmware image manually. I am not requesting access to a newer major/minor FortiOS branch. I would like to remain within the existing FortiOS 7.4.x branch and upgrade only to the current security-fixed patch release, preferably FortiOS 7.4.12.Is it possible for the the official FortiOS 7.4.12 firmware image for this FortiGate-90G to be provided, or can someone from this community enable another supported method of upgrading this device to 7.4.12 for security rem

Hi Team,I have completed NSE1 and NSE2, currently completing NSE3.I need to achieve FCF and FCA certificates but unable to find it anywhere.Can you please advise where/how to find FCF and FCA enrolment, exam, and certificates? 

Dear Team,If I have a FortiWeb deployment where the connection between the client and FortiWeb is encrypted using HTTPS, and the connection between FortiWeb and the backend server also needs to be encrypted, what configuration is required on FortiWeb to enable end-to-end HTTPS encryption between FortiWeb and the backend server?

hello,we have recent internet access issues following our shift from IP-based access control to LDAP authentication on the FortiGate firewall.Previously, users accessed the internet based on their IP addresses. As part of our security enhancements, we are transitioning to identity-based trust using LDAP authentication. Currently, users are unable to browse because the firewall policies for LDAP,  FSSO agent on fortinet is green and up.the policy not hitting any traffic,some sessions are failing to trigger authentication correctly.  

Can somebody help me to fix this issue?

I have multiple devices with varying levels of active support, and the inability to unlock the geoIP database is quite inconvenient. There is no method for manual updates, and using external filtering can consume significant memory resources when attempting to restrict access from a large geographical region.I understand the rationale behind conditioning support and updates to the greatest extent possible. Even "evil" major manufacturers like HP, Dell, and Lenovo provide publicly accessible BIOS and firmware updates for older hardware in response to critical security vulnerabilities, while placing non-critical updates behind a paywall. Their objective is to prevent the proliferation of insecure devices under their brand.

Hello, I am unable to import the CA certificate onto FortiGate 7.6.7. I generated a certificate using AD CS and am trying to import it into the FortiGate, but I receive an error stating that the certificate format is incorrect. Note that this CA was used to sign the FortiClient EMS SSL certificate. This is for a ZTNA lab setup where I want to integrate FortiClient EMS 7.4.8 with FortiGate. I am using evaluation licenses.

Hii,  I am thinking to Write NSE 4 in the upcoming week. So now my doubt is to attend NSE4 exam is it mandatory to complete NSE1, NSE2 and NSE3 Certifications ?? Actually i have Completed my NSE1, NSE2 and NSE3 certifications on 12/Aug/2019. And i heard that NSE1, NSE2 and NSE3 certifications is valid till 2 years. In that case my NSE1,NSE2 and NSE3 certifications got expired. So now is it mandatory to recertify all NSE1, NSE2 and NSE3 certifications and then should attend NSE4 or i can attend the NSE4 exam directly.Kindly please someone update on this .

Hi Fellas,I'm deploying FortiClient EMS 8.0 using Microsoft Intune (Win32 app) and have run into an issue.Environment FortiClient EMS 8.0.x Microsoft Intune (Win32 app) Deployment package generated from EMS with MSI Installer Files enabled EMS generated: forticlient.msi forticlient.mst PackagingBoth files were placed in the same source folder and packaged into a single .intunewin using IntuneWinAppUtil.exe.The install command in Intune is:msiexec.exe /i "forticlient.msi" TRANSFORMS="forticlient.mst" /qn /norestart /L*v "%ProgramData%\Microsoft\IntuneManagementExtension\Logs\FortiClientInstall.log"IssueThe installation completes successfully, but when FortiClient launches, it still displays the "Enter Invitation Code or IP Address" screen.Even when I manually enter the Invitation Code or the EMS IP address, the client does not register with EMS.Additionally, the folder:C:\Windows\FortiEMSInstaller_logsis not created, so there are no EMS installer logs to review.Expected B