Solved

Hi AllI would like to know if there is a method to export FGT Policies into Excel (csv) format.Please advise any available options. Am using FortiOS v7.4.12 Many thanks

Hi everyone, I’m having an odd issue with Minecraft and FortiGate and wanted to see if anyone here has run into something similar. I read this thread https://community.fortinet.com/t5/Support-Forum/Unblock-certain-game/m-p/390777/highlight/true and it reminded me of what I’m dealing with, but the solutions there didn’t quite fit my situation. When I try to join certain Minecraft multiplayer servers (especially public ones), the connection either times out or I get disconnected after a few seconds. Singleplayer works fine, and some servers connect without any problem, which makes it confusing. I checked basic settings like allowed ports and application control, and nothing obvious is being blocked. I’m wondering if FortiGate might be identifying some Minecraft traffic incorrectly or if there’s a specific profile or setting that usually causes issues with game traffic. If anyone has experience running Minecraft behind FortiGate, I’d really appreciate hearing

Greetings Forti Community, I use a web application that I reach on a IP address in my company network over IPsec VPN.It appears that the application sends a HTTP POST request to the server that can't get through the VPN tunnel, because the package is to big. After I change my client VPN network interface to MTU 1350, it can send the package and the access works. I change it with the following command:netsh interface ipv4 set subinterface "Ethernet 3" mtu=1350 store=persistent After that I've tried to set the MTU of the VPN IPsec Tunnel to 1350 and restart my client, I still couldn't access the web application. I've also tried different MTU values on the Firewall, but it didn't really change anything. Only if I do it on the client per command line.If I restart my client and start the FortiClient VPN, it seems that this resets my MTU on my client VPN network interface. So I'd have to execute the command to change my client MTU every time after I start the FortiClient.&nbsp

Hi all,We're migrating a FortiGate-80F to FortiOS 8, and as part of this we need to move our remote VPN access from SSL-VPN to IPsec/IKEv2. Our affected fleet is 50 workstations running Linux/Ubuntu 22.04.The free FortiClient VPN edition on Linux doesn't support IPsec/IKEv2 (only the licensed FortiClient Standalone edition does, as far as we understand), so we're evaluating FortiClient Standalone.We're trying to figure out the licensing requirements for:- FortiClient on Ubuntu 22.04, establishing an IPsec/IKEv2 tunnel to a FortiGate 80F;- Authentication using the FortiGate's local user accounts (not a remote/cloud identity source);- 50 Linux users.A few open questions, in case anyone here has hands-on experience:1. Does FortiClient Standalone on Linux fully support IPsec/IKEv2 VPN tunnels to a FortiGate, and is this supported when using the FortiGate's own local user accounts for authentication (rather than a remote/cloud identity source)? 2. According to the FortiClient Standalone Use

Hello,I am facing an error code to a random number of windows hosts (approximately 30/400 windows 11 home & windows 11 pro devices).The mentioned devices has recently appeared in the state " Running (OS settings outdated" and the error code is "OS settings outdated". I have tried to reload & uninstall and re install the collector with no luck. The collector version is 5.2.6.0065.Any ideas will be helpful in order to further troubleshoot the issue.BR

Hi everyone,Today, I upgraded two FortiGate units in an active-passive HA setup from 7.6.6 to 7.6.7.After the upgrade, I tested HA failover and noticed that the secondary IP did not move to the passive FortiGate as expected.When I downgraded back to 7.6.6, everything worked normally again.Has anyone experienced a similar issue with FortiOS 7.6.7? If so, is there any known fix or workaround?Thanks!

I have 2 cisco switch managed by fnac and i add the 3rd cisco switch.After i configure the dot1x on the 3rd switch then the authentication is rejected with below errorWhat mean of RADIUS not enabled on device? IN the inventory the RADIUS was enabled. 

Hello Team,Following a recent electric power outage, HA FortiGate 201G v7.4.11 build2878 (Mature) cluster displayed the attached alert:“File System Check Recommended"Both units in the HA cluster are synchronized and operating normally,What is the recommended best action to handle this alert in an HA environment?Appreciate your guidance to ensure system stability and prevent potential disk issues. Thank you,

Hi all TL;DRDoes anyone know if the Fortigate trial licence limitations on encryption/decryption (which for example prevent the use of HTTPS) also prevent the SSL connections from Fortigate to FortiAnalyzer for the purposes of sending logs (via oftpd)? I was trying to test sending logs from a Fortigate VM (firmware 6.4) to FortiAnalyzer VM (firmware 6.4) but I just get "No connection" and if you hover the cursor over that you get "Error occurred:{0}".  The goal is to test forwarding logs from the FortiAnalyzer to a third device but I can't get this far as the Fortigate won't send the logs to the FortiAnalyzer.  A reddit post (www.reddit.com/r/...er_trial_ssl_error_3/) suggested this is probably a trial licence limitation but it would be good to confirm it here if possible. If anyone has found something similar please let me know. Thanks  Testing steps:I've made sure to check the compatibility matrix and the FGT and FAZ are compatible.  The F

I am having an issue with the FortiClient IPsec IKEv2 VPN connection on Android. I entered all the required information correctly and tried many configuration changes, but the issue still persists. When I attempt to connect, I receive a “Null” error message.At the same time, I tested the same VPN configuration on my iPhone, and the connection works perfectly without any issues.  Iphone Settings  Android Phase2 Settings    Andorid VPN Settings 

I’m trying to set up a full-tunnel SSL VPN on my Fortigate 60E running 7.4.6 and for what ever reason, when connected to Forticlient if I go to a website that shows your public IP (ie- www.whatismyipaddress.com), it is showing my laptop’s local internet connection’s public IP instead of the fortigate’s WAN IP. I have tried using the ‘full-tunnel’ portal, disabling the ‘tunnel-access’ portal, changing both to ‘full tunnel’ in the SSL VPN settings and disabling both and creating a new portal which is full tunnel, but whatever I do it keeps showing up with my laptop’s local internet connection. I did some packet traces and it *seems* to be egressing the Fortigate’s WAN interface but for whatever reason it keeps showing my laptop’s internet’s public IP. I can ping devices inside the network (behind the fortigate) just fine, so I know the VPN is working. It’s a real head-scratcher. Can anyone take a look at the config (attached to this post) and tell me what is going on? Of note, I did try

Hi guys, I’m writing here after few weeks of working with Fortigate support. We went into dead end. I have full admin right on Google Workspace and Fortigate 30G running 7.6.7 build 3704, I’ve configured the LDAP as follows:FortiGate-30G (G_Workspace) # showconfig user ldap edit "G_Workspace" set server "ldap.google.com" set cnid "uid" set dn "ou=users,dc=spxxxxxxx,dc=pl" set secure ldaps set port 636 set client-cert-auth enable set client-cert "G_LDAP2" nextendTest Connectivity always works (this is misleading), Test User Credentials work fine - on any user which exist on my Workspace.Problem is when I want to press Browse button, I’m getting error “Invalid LDAP server” while from Workspace logs related to LDAP I can see:Event:Search failedDescription: LDAP search with (objectClass=*) failed with INSUFFICIENT_ACCESS_RIGHTS.Similar error I’m getting when I try to configure User Group based on G_Workspace profile - “Invalid LDAP ser

Dear colleagues, Have any of you managed to register FortiClient in your EMS Cloud using the invitation code? I enter the correct invitation code (all in sequence and with capital letters only). After I entered the, I hope so, correct invitation code in FortiClient, the application minimizes and closes. As a result, it keeps writing that FortiClient is unlicensed and I do not have access to extended options, e.g. saving the password in the SSL VPN connection profile and Always-up connection feature. The FortiClient version is "FortiClient_v6.2.3-build0332-release.apk" downloaded from the support site in the FortiCloud panel. I will be very grateful for all hints. My Android version is 14. Best regards,Witek

Hi, does anyone found a solution, to hold the VPN up and running when the screen is locked? OS: MacOS Sequoia 15.4 and MacOS Sequoia 15.5FortiClient: VPN 7.4.3.1761I had to install the newest FortiClient VPN version after a firewall upgrade as the older versions running in some connection problems.The older versions were stable and connected when the screen was locked. With the new version, the VPN disconnect each time the screen locks. In fortitray.log it is good to see, a message is send to forticlient and immediately after the message, the ssl-vpn is disconnecting. 20250508 14:55:24.613 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:390 System is locked/sleep20250508 14:55:24.620 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:404 System is going to sleep20250508 14:55:24.646 TZ=+0200 [FortiTray:INFO] VpnManager.swift:2163 Check VPN Connect without Reauth20250508 14:55:24.657 TZ=+0200 [FortiTray:DEBG] VpnManager.swift:2174 VPN Connection without reauthenticati

I have many event like this for cisco ipphone. Are this event say that we can enable device profile using CDP? 

Hi Guys, My firewall did an update recently from 7.4.9 to 7.4.10 and since then my static routes have stopped working.  I have a couple of internal routers that route between different subnets.  They were configured a number of years ago, and since then I haven't had any issue with them until now.  The routes are very straight forward - Destination (192.168.50.0/24**  subnet at other side of router) Gateway (192.168.10.10 router IPt) Interface (LAN)  (enabled).  Clients gateways are set to the Fortigate device and everything was fine until the update.  All clients could reach 192.168.50.x without issue.  That's now stopped working.  If I add a static route on the clients direct it works fine.  So issue is definetly at Fortigate.  Also all monitoring of the subnet stop at exact time of update. Tried removing and re-entering/rebooting, just doesn;t want to work. Anyone got a similar issue/fix? Many thanks  &n

Hi Guys, Has anyone sat the NSE4 exam so far? I’m taking this exam next month and feeling a bit nervous.Please share your experience how tough was it, which topics came up the most, and what helped you pass?Any tips would be appreciated for all the people like me preparing right now

I struggle to understand why this dataset query shows no result on my FortiAnalyzer instance:SELECT dstport, srcip, dstipFROM $logWHERE $filter AND ipstr(dstip) IN ('172.31.11.80', '172.31.11.83')GROUP BY srcip, dstip, dstportORDER BY dstport, srcipTo be sure, I am getting results if in the Log View I search for:  dstip=172.31.11.80 or dstip=172.31.11.83Any hint?

We are a 100% cloud-based org using M365. We are 85% Windows and 15% Mac. We use FortiClient EMS Cloud to manage/publish ZTNA and VPN connection profiles to users. We have the FortiClient EMS configured with Domain Authentication and connected to our Entra ID tenant. The appropriate groups are assigned, and registration is seamless and it works. I fully understand that Mac OS is very different and does not support  Entra ID authentication with EMS. The Fortinet EMS admin guide says, “FortiClient (macOS) does not support native Entra ID integration with EMS. For the integration to work, macOS endpoints must be managed by Intune or JAMF and enrolled to company portal using Entra ID.” Adding an Entra ID server | FortiClient 7.4.5 | Fortinet Document LibraryThat last sentence says it’s possible to use Entra ID integration for Macs. Our Mac machines are registered to Intune through JAMF PRO and enrolled to Company Portal. Domain Authentication will not work, and I know that. Which registrat

i have newly created VIP rule to publish local microsoft dynamic test server to the internet to access anywhere, but the vip rule not hit any packets.attached the rule screenshot and policy, any help from the community team would be appreciated 

Hi,I would like to know if anyone else is experiencing similar issues with FortiEndpoint EMS Cloud and the integrated FortiEDR feature.Our environment is currently running:FortiClient EMS Cloud: 7.4.7 build 2194 (Mature) FortiClient: 7.4.7 Windows 11 25H2: Build 26200.8875 FortiEDR Engine assigned by EMS: 5.2.8.0044Originally, we noticed that some endpoints using the same EMS policies and profiles had FortiEDR working and connected, while others showed FortiEDR Disabled in FortiClient and Disconnected in FortiEDR Cloud.Both working and affected endpoints are operating in the same environment and network, which makes the different behavior seem questionable. We are also seeing the same issue on endpoints in customer environments, so it does not appear to be limited to a single device or network.We also tested multiple FortiClient versions, including 7.4.4, 7.4.5, and 7.4.6, but the behavior remained the same.On affected endpoints, the Collector reported:FortiEDR Detected incompatible ma

My FortiGate 100F, has been damaged by lightning. We have purchased a new FortiGate 100F. We want to transfer the license (2 years subscription) from the damaged FortiGate 100F to a new one FortiGate 100F. I wanted to transfer the license directly, but unfortunately I have already registered the new FortiGate 100F on my account, so I can't transfer the license.Can anyone help me?Many thanks.

Hi EMS adminsOn EMS 7.4.3 I was able to configure NTP via OS config files (chrony).But on 7.4.4 there is no access to sh/bash and I can't find anywhere some command to set it up with emscli.In emscli cmd ref I just found this command but nothing said about setting time server.https://docs.fortinet.com/document/forticlient/7.4.4/ems-cli-reference/239339/execute-timeAny useful info would  e appreciated.

I have a Fortigate-400E and a 4G Router. About the 4G RouterThis router has an IP address of 192.168.x.x. To get internet access, all I have to do is plug in a LAN cable from the 4G Router to a PC. That simple. About the FortigateThis firewall has a 10.10.x.x IP address range. My QuestionHow do I set the 4G Router to the firewall? Right now I have plugged in a LAN cable from the 4G router to firewall physical interface 10. What configurations do I make? Do I change the role of the interface to LAN or WAN? What else needs to be done? Create a VLAN? Once this part is done, I can create a policy, that part I is not a problem. Could someone provide a step by step configuration guide? It is so simple without the firewall but I have no clue how to get it done thru the firewall.  

Hello,I wonder if the Extender standalone supports the feature “Routing Behind Mobile Station”, that is RADIUS attribute 22 / framed route in a company 5G mobile network.I could not find anything regarding this in the docs. If yes, anyone here used this feature already?best regards