Fortinet Community

Hi Fellas,I'm deploying FortiClient EMS 8.0 using Microsoft Intune (Win32 app) and have run into an issue.Environment FortiClient EMS 8.0.x Microsoft Intune (Win32 app) Deployment package generated from EMS with MSI Installer Files enabled EMS generated: forticlient.msi forticlient.mst PackagingBoth files were placed in the same source folder and packaged into a single .intunewin using IntuneWinAppUtil.exe.The install command in Intune is:msiexec.exe /i "forticlient.msi" TRANSFORMS="forticlient.mst" /qn /norestart /L*v "%ProgramData%\Microsoft\IntuneManagementExtension\Logs\FortiClientInstall.log"IssueThe installation completes successfully, but when FortiClient launches, it still displays the "Enter Invitation Code or IP Address" screen.Even when I manually enter the Invitation Code or the EMS IP address, the client does not register with EMS.Additionally, the folder:C:\Windows\FortiEMSInstaller_logsis not created, so there are no EMS installer logs to review.Expected B

Hi everyone, I'm Sarah, just joined this community. We've been running a site-to-site VPN on FortiGate and occasionally notice intermittent drops, especially during peak traffic hours. Has anyone tuned specific settings (dead peer detection, keepalive intervals) to make tunnels more stable? Would appreciate any troubleshooting tips before opening a support ticket.

I am experiencing an issue when connecting to the IPsec Dial-Up VPN from a Linux virtual machine using strongSwan.Once the VPN connection is established successfully, the Linux VM loses its Internet connectivity. However, the same IPsec Dial-Up VPN connection works correctly on Windows machines, where Internet access remains available after the VPN is connected. 

Customer has a 60E - i have config backup from 60E - don’t have access to 60E registered account ( ????@datec.com.fj ); have a new 70G ( registered by me to ????@nivismotors.com.fj who is the owner/customer ) - why is it so difficult to get support to assist to convert my 60E config, and import “new” config into 70G via forticonverter.  I sent time today with both customer & technical support via chat, and neither is able to assist to resolution.  Going forward why should i advise customers to stay with FG 

Hi all,Due to SSL VPN no longer being supported in newer FortiOS versions, we’re migrating our FortiClient remote-access VPNs from SSL VPN to IPsec Dial-Up.Our SSL VPN setup is used by our team, partners, etc., and authentication is done via Azure SSO. I created an IPsec Dial-Up tunnel using local FortiGate authentication and it works fine. However, when I switch to SSO authentication, it fails. (go to the online login page but fails in the end).  Before I lose too much hair on this migration 😅, I’m trying to understand whether IPsec Dial-Up can really reproduce our current SSL VPN setup.Main questions:Azure SSO: Is SSO supported for IPsec Dial-Up in the same/similar way as SSL VPN? Different IP pools per group: Can each user group get its own client IP range? No RADIUS: The “Assign IP from User Group” option seems to require RADIUS. Is there another way without deploying a RADIUS server? Split tunneling: With SSL VPN, access is mainly controlled by firewall policies. With IPsec, it l

I’m currently preparing for NSE 4 on FortiOS 7.6, and one thing I’ve noticed is that going through the study material and actually being able to troubleshoot a FortiGate scenario are two very different things.So I wanted to hear from people who have recently prepared for or passed the exam.What helped you the most?Hands-on FortiGate labs Fortinet Training Institute material Fortinet documentation and KB articles Practice questions CLI troubleshooting Real-world troubleshooting scenariosPersonally, I’ve found that combining the official material with hands-on practice makes it much easier to understand where the gaps are.For those who have already taken NSE 4, how did you balance theory and hands-on practice, and what would you recommend spending more or less time on?

Does anyone know if the new exam is using Enteroruse Firewall Admin questions?NSE library has enterprise firewall admin and sdwan modules but nothing that lines up with name Network security architect or is it a whole new exam with both modules combined? 

Hello, I am preparing for my exam scheduled for July, but I am having trouble understanding this question. Could you please tell me the correct answer and explain why When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalidcertificate.Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choosethree.)A.AllowB.Trust & AllowC.Allow & WarningD.BlockE.Block & Warning    

I am currently installing FortiClient on an Ubuntu 24.04.4 LTS VM. However, when I open FortiClient, the IPsec VPN option is not available/disappears from the VPN section. Could you please confirm whether the installed FortiClient version/package supports IPsec VPN on Ubuntu 24.04.4 LTS and advise if any specific package, version, or configuration is required? I can also share the installed FortiClient version and system details if required.currently using version  FortiClient VPN 7.4.3.5411

I am trying to test the Web Filter Profile Override blocked categories feature. When I set the option to “IP” it works fine. When I set to either User,User Group or Ask it ddoes not work.Scenario 1:I set the Option to User Group, I select the User Group, the Web Filter that will bypass the category block, then I configure the Firewall policy source with the suer group and “all”.When I surf to a blocked category it allows it rather than getting the block page. When I remove the user group from the Firewall policy then I get the block page but It says “Only User based Overrides are allowed…..”Scenario 2:When I set the Web Filter Override to “Ask”, then configure the firewall policy with the user group, I do not get the block pageIf I remove the User Group from the Firewall Policy then I get the block page but I am not presented with User Group Options. I have followed the KB but cant get this to work.https://docs.fortinet.com/document/fortigate/7.6.7/administration-guide/408599/web-profi

After an auto deployment I have many endpoints that only say under Installer- Endpoint Notified but they never updated to the latest version. How do I fix this? It happens every time there is an update to the Forticlient and we do an auto deployment of the update.  Thanks,Donna

 I have a query, I created gre tunnel & then gre interface at the fortigate side  & mikrotik side can't be able to ping remote gateway IP (p2p) which was created fortigate gre interface remote gateway with ping access. But can be able to ping from mikrotik side p2p IP which are using fortigate gre interface local ip. Gre  tunnel showing also up from fortigate side.What is the issue & how to solve it please help me urgently. Using fortigate version is 7.6.7   

HiI have reviewed the FortiClient website and available documentation, but I was unable to find any clear resources explaining how to deploy FortiClient together with the required configuration VPN profile via Intune for Windows users.deployment with a preconfigured setup is supported? If so, please provide the relevant deployment guide, configuration documentation, or recommended deployment method.

Unable to connect to SSL VPN after firmware upgrade to v7.6.7. The connection goes to 10% then I get the following error message: "Unable to establish the VPN connection. The VPN server may be unreachable." 

Hi Team,I configured IPsec Remote Access (Dialup) for FortiClient users (Windows, macOS, Android) on FortiGate 201G – FortiOS 7.4.12. How can I restrict VPN access based on Geo-IP, so users can connect only from a specific country?Thanks.

Due to the lack of support of the SSL VPN, I am migrating the FortiClients VPN to IPSec. Created a new IPSec Dialup config and the tunnel worked fine for a local user. However when I enable the Fortitoken for the user (I receive the token in the email) but the tunnel never goes up and FortiClient show “time out” msg. Sniffing the traffic is possible to see my local peer trying to connect on port 500/4500 but get no answer back from the firewall. Once I try the user without the token it goes completely fine. Any ideas? Cheers

Hi all,I've made a free firewall migration tool, now available on GitHub: https://github.com/gateshift/gateshiftIt's still in beta, and feedback from people who actually do this work would be welcome.If you run firewall migrations or optimizations, give it a try and let me know where it falls short. 

Recently upgraded my Fortigates to 7.4.5 - tested VPN - all fine.Gone to work from home and can no longer connect - stops at 10%I have tried absolutely everything I have seen online for example DIsabling IPV6 on both my network adapters and on my router.lowering MTUchecking all policieschanging DNS settingsloads of other things. The only thing I found that lets me connect is first connecting to Cloudflare one Traffic + DNS (UDP)I have checked and there no IP’s blocked on my Fortigates. No other user has reported a problem.I am on Youfibre. I cannot access many websites i need when connected to Cloudflare so this isn’t a permanent solution. Any ideas? The logs don’t seem to show many any errors of the time i’m trying to connect either. TIA

I upgraded my E-series FortiGate from version 7.6.3 to version 7.6.6. After the upgrade to 7.6.6, I lost connectivity to several networks that had been working without issues on version 7.6.3.I checked the configuration, and the static routes and policies remained unchanged; however, we had no connectivity. We had to downgrade back to version 7.6.3. Connectivity was restored after reverting to the previous version.Has anyone else encountered this scenario? I’ve reviewed the release notes and found nothing regarding configuration loss or any changes that might explain this behavior.Has anyone else experienced something similar?NOTE: My FortiGate has FortiLink configured with a FortiSwitch. I am not sure if this could be a compatibility issue. However, upon reviewing the release notes, I haven't found anything related to this type of behavior.

Our company is transitioning from SSL-VPN to ZTNA.  We have been testing ZTNA on 2 devices.  It seems Windows built-in applications are extremely slow to open.  For an example, when ZTNA is enabled, task manager took 17 seconds to open, command prompt took 39 seconds, recyle bin took 1 minute to open.When ZTNA was disabled, task manager took 1.81 seconds, command prompt took 1.18 seconds. and recycle bin took 1.81 seconds.  This is a big difference.  For a basic configuration, we are using ZTNA destinations and tags in EMS and ZTNA servers and firewall policies on the Fortigate.  To resolve internal FQDN’s, I have configured DNS servers on Fortigate forwarding DNS request to internal DNS servers.  We have also setup a KDC proxy which may have helped slightly.  Has anyone experience this before and is there a configuration fix for this?  In my testing everything works pretty well except for group policy.  The only big issue is slowness opening these types of applications.  

Hello Fortinet community,We are trying to connect our Fortigate 100F (7.6.7) to our RADIUS server (Windows NPS) but the NAS-IP of the Fortigate is designed to only accept IPv4 addresses. In our case, the NAS-IP needs to be the gateway of one of the interfaces on the Fortigate (configured as aaaa:bbbb:cccc:dddd::1) which is autorised in the NPS server According to the CLI reference, the field is hardcoded to use legacy IPv4 which I do not want to enable on my network :set nas-ip {ipv4-address}Are there any plans to add IPv6 support to this field ? Thanks

I haven’t been able to connect to my company network with Forticlient for the past two weeks. The latest versionof Forticlient vpn installed is 7.4.3 hotfix 1.8758. I keep getting a “connection timeout” error. I tried running it as an administrator, but that didn’t fix it. I uninstalled and reinstalled it, but that didn’t work either. I tried installing older versions, but that didn’t solve the problem either. The strange thing is that I can connect from some computers but not others. My Windows updates are also up to date. For example exact same windows uptade version and same forticlient vpn config but one computer can connect but other cannot.

I was doing some troubleshooting today and I kept getting errors when trying to save my DoS policies. Turns out that 7.4 uses the individual interfaces, despite the interfaces being in an SD-WAN zone. In 7.6, all of the DoS policies use SD-WAN zones and NOT the interface. I somehow missed this in any of the release notes, but wanted to mention it hear in case it's giving anyone else problems. 

Failed to perform SNMP connect. Please verify that the device can be contacted via ICMP (ping), and that the SNMP credentials are correct.Ping worked, SNMP was enabled on the FortiGate interface, and the SNMPv3 settings matched on both sides. A packet capture on the FortiGate showed UDP 161 requests arriving from FortiNAC, but the FortiGate did not respond.The cause in my case was FortiGate administrator Trusted Hosts. The FortiNAC source IP was not included in the permitted hosts for an administrator account with Trusted Hosts configured. This prevented the SNMP request from being processed, even though it reached the FortiGate.To resolve it:Identify the source IP FortiNAC uses to reach the FortiGate.In System > Administrators, review the accounts with Restrict login to trusted hosts enabled.Add the FortiNAC source IP as an allowed trusted host in all the administartors.Save the change and run Validate Credentials again in FortiNAC.The FortiGate was added successfully after the Tru

I have multiple IPsec site to site VPNs and remote access VPNs but all the tunnel shows in same table and there is not any option to see this is site to site and this is Remote access VPN tunnel.To verify that I need to open every VPN every time and check this is site to site and this is remote VPN.Like there are option in sophos firewall that we can differentiate this is remote and this is site to site.I faces issue multiple time during troubleshooting and every time need to open tunnel and verify that is remote access or site to site