Fortinet Community

Background   We are migrating existing Lacework customers from our current Lacework support portal (Zendesk) to the FortiCare support portal to service all support requests for the Lacework FortiCNAPP product.    We ask all customers to start submitting support tickets in FortiCare instead of Zendesk as soon as possible. Until July 23rd, 2025, both systems will be active. All tickets that remain in Zendesk after the cutover date will be migrated to FortiCare.   Prerequisites   Your Zendesk account has been migrated to FortiCare as an IAM user. In order to be able to use it, the Master Account Owner of your company needs to generate the password reset link for you and share your FortiCare Account ID. If you already have it, you can proceed to the next step.   If you haven't yet received your password reset link and/or the FortiCare Account ID, you need to contact your Master Account Owner. This is the person responsible for the Lacework FortiCNAPP prod

Dear All, SSL VPN users are facing issue while receiving token If email based token is configured for SSL vpn users. Please correct me if I am not correct - I have configured SSL VPN users (Users name is Test) and test user is part of multiple group under local user - Group name  Name - TestType - LOCALtwo-factor - abc@gmail.com (email based authentication for SSL VPN test)Group - XYZ, vendorstatus - enabled My question is If user is part of two group it means token will be received two times for test user on his email email id - abc@gmail.com  Thank you for immediate response.     

Hi, I'm trying to setup the FTM with FortiToken Cloud. User login in FortiClient IPsec VPNFortiGate sends push request to my phoneTapping Allow Getting notification on my phone “request sent”And nothing happen fortigate debug:diagnose debug resetdiagnose debug console timestamp enablediagnose debug application forticldd -1diagnose debug enable2026-02-05 20:51:20 [263] fds_resolv_addr: resolve 'eufctupdate.fortinet.net' 2026-02-05 20:51:20 [189] fds_get_addr: name=eufctupdate.fortinet.net, id=10208, cb=0x5555ff9c60 2026-02-05 20:51:20 [185] fds_svr_default_timeout: try to get IPs for Forticlient-svr 2026-02-05 20:51:20 [52] dns_parse_resp: DNS resp-id=10208 2026-02-05 20:51:20 [74] dns_parse_resp: eufctupdate.fortinet.net: rcode=3 2026-02-05 20:51:20 [52] dns_parse_resp: DNS resp-id=10208 2026-02-05 20:51:20 [74] dns_parse_resp: eufctupdate.fortinet.net: rcode=3 2026-02-05 20:51:21 [4089] fds_handle_request: Received cmd 117 from pid-1328, len 4

Hello, community members. I'm currently testing a migration from SSL VPN to IPsec on FortiGate v7.4.9.Client: FortiClientFortiClient 7.0.9: IPsec connects successfully (no issues)FortiClient 7.4.3: IPsec fails - appears to connect for a moment but then immediately disconnectsThe FortiGate CLI (diagnose debug application ike -1) reveals the following:IKEv2 authentication succeededPhase 1 (IKE_SA) is establishedThe client appears to receive an IP address (mode-cfg), but the tunnel immediately goes downSSL VPN from the same client to the same FortiGate works fine. Has anyone experienced this issue with FortiClient 7.4.3 and FortiGate 7.4.9?Are there any known interoperability changes (EAP settings, Phase 2 proposal/TS selector behavior, DPD/NAT-T, IPsec-over-TCP specifics, etc.) that could cause Phase 1 to be fine, but Phase 2 to immediately drop? If you have any suggestions or ideas, please let me know. Thanks!

I am facing an issue while trying to bring Two FortiSwitch-108F switches under FortiLink managed mode with a FortiGate-40F.The switches are discovered and authorized, but they never come OnlineEnvironment DetailsFirewall: FortiGate-40FFortiOS: 7.4.9 (GA)Switch Model: FortiSwitch-108F (2 units)FortiSwitchOS: 7.4.5Management Method: FortiLink (single FortiLink interface)Topology:FortiGate Port A → FSW1FSW1 port 8 → port 8 FSW2 (ISL)

Hi everyone, We’re running into consistent performance and internet connectivity issues when using a Fortigate 40F firewall behind a Draytek Vigor 3912 router. The WAN connection (with a dedicated public IP address) is managed and delivered by a third-party IT provider. So far, they’ve only been able to make the setup functional by using a double NAT configuration.Unfortunately, we don’t have administrative access to their VPN router, meaning all network and routing configurations can only be modified on our Fortigate side. This limits our ability to optimize or troubleshoot the setup beyond our local network. Has anyone experienced similar performance degradation or connectivity problems in a comparable setup (Fortigate behind Draytek / double NAT scenario)?Any advice on best practices or alternative configurations that could help improve throughput, latency, or overall stability would be greatly appreciated. Setup overv

Dear All, Recently I have upgraded my FW from 7.2.12 to 7.4.11 and since then my AWS site to site VPN is not working even though tunnel is showing up but not able to send/receive the traffic. I have even disabled the NAT but not working and as soon as i downgrade to 7.2.12 it starts working. Please suggest what should I do here. FW - 80e 

I am trying to set up a IPSEC Dialup ikeV2 VPN using OKTA SSO and get the okta prompt and goes through but the okta prompt comes back up and VPN isn't connecting.  Okta is showing the login successful.  I followed the article in the forums and am having no luck.  

Okay here's the deal, I was trying some new items and ran into an issue that led to more ideas. Does FortiOS/provider have a default timeout? So if I'm applying code and Terraform can't reach the host, can we define the timeout in the provider.tf? AI search says yes, but anytime I do a validate, it complains about that not being supported. here's what I'm running kfelix@proto fortios % cat .terraform.lock.hcl | grep -i ersion  version = "1.24.1" I even tried to defined the time-out under the resource, and validate still complains   

I am running a SDWAN infrastructure with one Hub and several spoke (15 spokes). All sites are equipped with FGT  clusters running 7.2.x. we have ADVPN configured with iBGP running over it for route advertisement .On 4-5 spoke sites  I have a strange behavior that is every 2-3 days   have this error in router events logs as below: BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 192.168.88.254 Down Hold Timer ExpiredBGP: %BGP-3-NOTIFICATION: sending to 192.168.88.254 4/0 (Hold Timer Expired/Unspecified Error Subcode) 0 data-bytes []BGP: %BGP-5-ADJCHANGE: VRF 0 neighbor 192.168.88.254 Down BGP Notification FSM-ERRBGP: %BGP-5-ADJCHANGE: VRF 0 neighbor192.168.88.254 Up The problem is that during this event all connections from spoke to hub are shut during roughly 60 or 120 sec

Good morning friends, how are you?One question, what is the difference between these inspection modes: flow based and proxy based, when creating a policy?

due to the VPN traffic possibly coming in or going out via one of three interfaces (due to BGP) i felt i should configure the VPN on another interface of the FortiGate. only the VPN process doesn't want to start the VPN now, the debug logs shows: 2021-06-19 14:41:49.269526 ike 0:p1-01:91: could not send IKE Packet(SA_INIT):x.x.x.x:500->y.y.y.y:500, len=248: error 101:Network is unreachable it set ups the VPN tunnel fine for incoming VPN requests, but it refuses to initiate a VPN itself. tried on both 6.0 and 6.4. i can sort of understand it, but it feels not needed, if i do ping-options for the same source IP x.x.x.x i can ping y.y.y.y fine. i can workaround it with a loopback interface, but that means no IPsec traffic offloading. another option is a second VDOM with the network used in the routing direction but that feels adding quite some config. anyone encountered this and has an another solution to make it work in both directions?

Hey Guys,I am new to FortiGate and Aroba. I wanted to implement a network segmentation on our network this side but i am seeing problems, I created vlans both on the aroba switch and the FortiGate and trunked the port from the switch to the firewall. I even gave on policies for every vlan to show what directions each vlan should take, but there's no communication between the vlans or the vlans to the internet (for the ones having outgoing interface as wan) End devices are able to acquire addresses as per the addressing table. I even did a trace route on the device which was connected to the CORP and Pent vlans and all of them end at their gateways (the ones specified on the firewalls). I carried on doing a debug on the cli on FortiGate to see if at all packets arrive to their designated policies (by doing pin 8.8.8.8 on CORP since it has The Internet policy enabled) nothing popped up from the cliThings verifiedDHCP of the corresponding vlan issues the correct address as par the ad

One User is currently experiencing:1. All sent emails are deleted2. Received emails are double in inbox How to fix? Please help

The status does not move from here after Windows update.

Hello Fortinet community, We are facing a problem right now, trying to connect our FortiDeceptor physical appliance (v6.1.0) to FortiGuard web filtering Server through our proxy. Specifically: Failed to verify web filter server: Error happened when verifying FDN/WF server (154.52.24.78:443) certificate: 'NoneType' object has no attribute 'splitlines' As far as I understand, there seems to be a problem with SSL certificate. How could I proceed further? Thanks in advance.

A company is using SAML Credentials and Azure as IdP for wireless authentication. The configuration works fine for devices other than Apple. On Apple devices, users open up settings > Wi-Fi and then select the SSID. Upon doing so, a captive portal comes up where the user inputs their credentials. In order to proceed, the user needs to input their one-time password from the Authenticator app. Since the user is in the captive portal at this time, they need to back out of it & open up the Authenticator app to get the code. Once they get the code and re-open their settings, the process starts all over again. Please see the following video.Troubleshooting steps taken: exempt captive.apple.com to prevent the captive portal from opening up in settings so users have to open Safari in order to go through the authentication process. Although this resolves the initial issue of not being able to input their OTP, the users never get connected even after going through the entire process.

Hi guys, New to forum, want to check with the community senior of Fortinet whether FortiSASE is a real cloud solution that managed (Backend) by Fortinet or a cloud solution that require customer to managed? As we being request to call Fortinet when hit FSASE bug (1213936) everytime it occur and need to start the troubleshooting from scratch (Took around at least 45minutes everytime) to validate the issue even though we had told them we do hit the bug (1213936). Seems like become the one to maintain FSASE infra instead of Fortinet themselves. Do any of you encounter such experiences before, how would you suggest to speed up whole troubleshooting? Challenges: 1) FSASE not managed by us and require call in to Fortinet support for manually reboot/restart the service/instance2) The troubleshooting most of the time need start from scratch even being told it hit the known issue (1213936)3) The known issue (1213936) can be happen few times on same day (Updated by Fortinet s

We are going to be joining a lot of our devices to InTune. I wonder whether anyone has any hints on getting details of the logged in user from these devices to be used by the Fortigate.  Particularly in a 'shared device scenario' - we have cabinets full of laptops and iPads that are handed out to students. Cheers Jon

I'm a long time Palo Alto user and just transferred to a new organization and we utilize the FortiGate 401F. We utilize GeoBlocking for both incoming and outgoing however it is implemented using an Access Control List.  I've seen posts using a Firewall Policy to implement Geo Blocking. Obviously F/W policies give an in-depth look using security policies but would like to hear from the community what is a best practice for Geo Blocking, ACL or F/W policy?  Also is there an online document on recommended best practices for the FortiGate?Much thanks!

 Hello,  I am testing an IKEv2 IPsec dial-up VPN on a FortiGate 81F (FortiOS 7.6.6) and I would like to confirm if my use case is fully supported.SetupFortiGate 81F – FortiOS 7.6.6IPsec dial-up VPN (IKEv2)Authentication: LDAP (Active Directory)No RADIUS, no FortiAuthenticator, no EMSClient: FortiClient VPN Only (free)IssueThe tunnel establishes correctly (IKE + Child SA).The client receives an IP address and traffic is allowed.A few seconds later, the VPN is disconnected immediately.IKE debug shows repeated EAP challenges:  FNBAM_CHALLENGE until the client sends an IKE DELETE.ObservationsEAP-TTLS fails (expected, since no RADIUS/FAC is present).EAP-MSCHAPv2 seems required for LDAP auth, but on FortiOS 7.6.6 there is no option to force the EAP method on the FortiGate.The EAP method appears to be fully client-driven.QuestionIs IKEv2 IPsec with LDAP authentication (without RADIUS/FAC/EMS) officially supported with FortiClient VPN Only?If yes, is EAP-MSCHAPv2

Hello FNAC admins, I'm trying to add my fortigate to FNAC inventory, I'm getting this error. SNMP is configured on my Fortigate, I'm able to ping Fortigate from FNAC and vice versa. Any ideas ?   BR,

Hello, we use a split sslvpn tunnel to connect.I know there is a filter filter implemented in the Fortigate. We currently test the FortiClient EMS. Is there a function to block file types with the FortiClient?

I have the possibility of deploying approx 5 or 6 Meru AP832i Access points at my home as a slight upgrade to my current Wi-Fi setup. They are units that were deployed at the school I work at and were taken out a couple of years back and left in a cupboard doing nothing. I understand I will need some sort of controller software to run these as they won't work as a standalone set, which I can deploy in a Proxmox VM system.My question is: will I need or can I get a licence to run this system, given that the Ap's are now legacy and no longer supported. Or am I basically on a hiding to nothing here?

Hello FNAC admins, I'm trying to access the CLI console on my FortiNAC's GUI, but I can't find it... Is there a feature I have to enable to access the CLI ? BR,