Solved

I configured an IPsec Remote Access VPN. When I use local authentication, the VPN works fine. However, when I switch to SAML authentication, the SAML login completes successfully, but FortiClient returns to the main screen instead of establishing the VPN connection.Has anyone experienced this issue before or knows what could be causing it? 

We are currently running FortiOS 7.4.12 on multiple FortiGate 200F and 400F HA clusters in a banking environment within the EU.Following Fortinet's recent recommendation to upgrade to FortiOS 7.4.13 or later, we are evaluating an accelerated upgrade plan and would like to gather feedback from engineers who have already completed this upgrade in production.Specifically, have you experienced any of the following after upgrading from 7.4.12 to 7.4.13 (or later 7.4.x releases)?HA synchronization issues Performance degradation Unexpected failovers or cluster instability GUI access problems Routing behavior changes (BGP/OSPF/static routing) IPSec VPN stability issues SSL-VPN related issues Policy installation or FortiManager interoperability issues FortiAnalyzer anomalies Any known bugs affecting FortiGate 200F or 400F platforms specificallyFor those who have already upgraded:What platform/model are you using? Standalone or HA? Any caveats observed during or after the upgrade? Would you cons

Any good automation or are we still hand drawing?What information do you refuse to put on the diagrams and want is absolutely critical?Auditors and leadership love bugging me for pretty diagrams and it kills me to hand drawing them.

Hello everyone,so I was wondering if free Forticlient at version 7.4.3 is affected by CVE-2026-121529? I´ve heard that Free Forticlient has a differenet code, so it don´t have to be neceseraly affected, but these are just rumors.I haven´t found any official info yet.Thanks!

We are using IPsec VPN with SAML authentication integrated with Microsoft Entra ID. During the SAML authentication process in FortiClient, users receive a certificate warning: NET::ERR_CERT_AUTHORITY_INVALID.I understand that IPsec VPN itself does not necessarily require a public CA-signed certificate. However, since the SAML authentication flow relies on HTTPS communication between FortiClient, Microsoft Entra ID, and FortiGate, I would like to confirm:Can we replace the current certificate with a valid trusted certificate (for example, a public CA-signed certificate) to eliminate the certificate warning during SAML authentication? 

Hi All,I have a FortiGate 60F in our environment, we’re using EMS.We have significant issues with the IPSec VPN; when some users disconnect the DNS settings for our environment stick. This then causes issues accessing the general internet or reconnecting to the VPN.It seems like a known bug, but theres no fix for it outside version 8 which doesn’t seem to be available for EMS customers yet.Does anyone know of a suitable workaround for this, or anything that could be causing it? 

Hi all,after upgrading FortiManager to 7.6.8, all installs to our FortiGate-50G devices (FortiOS 7.6.7) fail. FortiManager pushes an attribute to the default profile “custom-deep-inspection” that the 50G does not support:config firewall ssl-ssh-profile edit "custom-deep-inspection" config https set udp-not-quic allow end config dot set udp-not-quic allow end nextend---> generating verification report(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" https:udp-not-quic) remote original: to be installed: allow(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" dot:udp-not-quic) remote original: to be installed: allow<--- done generating verification report------- Start to retry --------[same result]install failedTask status: “verify state: install OK/verify FAIL” → “install and save finished status=FAILED”. No changes are applied.Running the command manually on the 50G:set udp-not-quic allowcom

We are looking to replace our current Aruba switches with FortiSwitches.  Is it really required to have an active FortiCare subscription in order to just update the switch firmware?  These switches would be mangaged by our ForitGate (which does of course have an active subscription)?  We only have 2 switches and really don’t need phone support (it’s a really simple setup) or the RMA benefits FortiCare may provide. If FortiCare coverage on the switches is required just to be entitteld to update the firmware, we’ll likely just stick with an updated Aruba offering.  I haven’t been able to find a clear answer, since these would be maganged by our FortiGate (with FortiLink), if seperate FortiCare coverge for both switches is still required. Thanks!

I'm in an awkward position where our pair of 1000D's goes end of Life in April 2028 so I need to look at a replacement soon.My issue is that I need a Fortigate which can do more than 50 VDOMs and as such despite being more powerful the 900G series won't work.So with there being no announcement for a 1000G what is the alternative for replacing the 1000D? The 1000F is now marked end of sale and has an end of support date of 2031 so I definately don't want to go down that route.Is the only option to get more of the smaller units?

Hi! I´m looking for advice configuring an IPSec hub with FortiOS 8.0.1 for terminating IPSec site-to-site tunnels from multiple remote sites.We have a relatively high number of remote sites >50 with very low traffic (just remote management), but overlapping IP ranges.The IPsec tunnel interfaces (the inside of the tunnels) would need to connect to different VRFs. The tunnels would be initiated by the remote sites, which have different source IPs in the Internet,  but on the hub site all IPsec tunnels are terminated on a single public IP. Can I create a VRF instance per remote site?Having >50 VDOMs would not be feasible, as we are talking about maybe 10Mbps aggregate traffic and a relatively small firewall at the hub site, which can only support 10 VDOMs (like a an FG-120G).Some remote site will not have Fortigates, but most of them have. Is this doable at all? BR Peter 

Good Afternoon, Since upgrading Fortianalyzer VM to 7.4.12, within the Fortiview → Traffic → Top Source, I am no longer able to filter a SourceIP by CIDR notation in the GUI. In the past, I’ve been able to use e.g. 172.1.1.0/16, and will get results for traffic only for that specific subnet.  Since upgrading, I receive “no records found”, when the CIDR notation would align with individual IPs I can see in the traffic Fortiview. I am not seeing in the release notes that this was taken out or is a known issue.  Is anyone else experiencing this, or is there another method to filter by subnet within Fortiview on Fortianalyzer 7.4.12? Thank you!

Which is the latest FortiOS version that still supports SSL VPN?

Hello everyone, Does FortiGate accept two VIP objects with the same external IP ? If so which FortiOS and how is it configured ? Thanks in advance.BR,

We have standardized on using Power BI for reporting metrics on our different systems.  Has anyone created FortiSOAR reports using an external report system like Power BI?  If so, how did you accomplish this?

We have a few switches (124G) which are standalone, but daisy changed together in a loop, one switch per building. This all works. We have 3 ISPs, one in each building. We have two Fortigates, so two of the switches have links to a Fortigate port, one port per ISP. We do this for redundancy. My question is: Should I do any special commands on these standalone switches for hardening purposes? Since at least some of the ports are directly connected to the ISP.Thanks.

Hi, does anyone found a solution, to hold the VPN up and running when the screen is locked? OS: MacOS Sequoia 15.4 and MacOS Sequoia 15.5FortiClient: VPN 7.4.3.1761I had to install the newest FortiClient VPN version after a firewall upgrade as the older versions running in some connection problems.The older versions were stable and connected when the screen was locked. With the new version, the VPN disconnect each time the screen locks. In fortitray.log it is good to see, a message is send to forticlient and immediately after the message, the ssl-vpn is disconnecting. 20250508 14:55:24.613 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:390 System is locked/sleep20250508 14:55:24.620 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:404 System is going to sleep20250508 14:55:24.646 TZ=+0200 [FortiTray:INFO] VpnManager.swift:2163 Check VPN Connect without Reauth20250508 14:55:24.657 TZ=+0200 [FortiTray:DEBG] VpnManager.swift:2174 VPN Connection without reauthenticati

I all. I would like to obtain information about my network, mainly related to bandwitch usage. I go to install to obtain this information a netflow collector.I have read about some problems with some third party Netflow collectors and I would like to answer about your experience to install a good Collector to work with Fortigate Firewall.  Please, could you recommend me a netflow network analyzer, free if its possible and it works well with fortigate, to can monitorice the bandwitch of my network in a way that I can get more information  than the information that a widget or fortiview gives me?Thanks ¡¡¡

fortigate FG201f running 7.4.12 b2902forticlient 7.4.8, managed by forticloudintune pki (CloudPKI)the payload (via sniff) appears to be sent, but fortigate ignores as the tunnel has been ignored.wanting to set up a device cert based TCP IPSEC tunnel.  end goal is for the device to connect without user involvement.from the ike debug logs:session started on tcp 8443proposal acceptedcert requestedcert sent (in 6 piecescert received and reassembledclient details sent, mostly correct except the OSVER.  this is a Win 11 devicepeer is matched“AUTH payload not received”tunnel is closed How do I diagnose why the tunnel was closed?  Why is the OSVER wrong? debug log:ike V=root:accepts ike tcp-transport(vd=0, vrf=0, intf=0:27, 162.252.yyy.yy:8443->142.167.xx.xx:58204 sock=42 refcnt=2 ph1=(nil)) (1).ike V=root:0: comes 142.167.xx.xx:58204->162.252.yyy.yy:8443,ifindex=27,vrf=0,len=606....ike V=root:0: IKEv2 exchange=SA_INIT id=225ee7034892962d/0000000000000000 len=606ike 0: in 225EE7034892962

Trying to create IPSEC Dialup using device certificates.  The authentication is not succeeding.This is the ike debug log:ike V=root:0:EMS-TCP-VPN:179: received FCT-UID : 66FEE5B1BADB40A799FEAAD9D836EFF4ike V=root:0:EMS-TCP-VPN:179: received EMS SN : FCTEMS8825002268ike V=root:0:EMS-TCP-VPN:179: received EMS tenant ID : 00000000000000000000000000000000ike V=root:0:EMS-TCP-VPN:179: received peer identifier DER_ASN1_DN 'CN = xxxx-000000'ike V=root:0:EMS-TCP-VPN:179: match gw peer ID by FNBAMike V=root:0:EMS-TCP-VPN:179: AUTH payload not receivedike V=root:0:EMS-TCP-VPN:179: schedule delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:0:EMS-TCP-VPN:179: scheduled delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:destorys tcp-transport(vd=0, vrf=0, intf=27:27, 162.252.xxx.xx:8443->142.167.xx.xx:53461 sock=42 refcnt=0 ph1=(nil)) (0).ike V=root:0:EMS-TCP-VPN: connection expiring due to phase1 downike V=root:0:EMS-TCP-VPN: going to be deletedike V=root:0:EMS-TCP-VPN: res

When we migrate from SSL VPN to IPsec VPN, we currently use different firewall policies based on user groups to separate access for each vendor. In that case, would the firewall policies be configured as follows?config firewall policy    edit 1        set name "vendor1"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER1"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor1"    nextedit 2        set name "vendor2"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER2"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor2"    nextend But if we use IPsec VPN, do we need to create

We are currently in the process of switching over to the FortiClient VPN (v7.0.0.0029) from the DrayTek Smart VPN Client and I notice that all of my traffic is now being piped through the VPN, instead of just the traffic that requires it. Our FortiClient is set up to use IPsec VPN. The DrayTek VPN has a setting named Use default gateway on remote network and I always have this switched off.  I'm trying to find a similar setting in the FortiClient VPN. Sorry.  I'm not overly familiar with all the network jargon, so please forgive me for that.  I see a bunch of settings under Advance Settings, but nothing that appears equivalent to the DrayTek setting. Thank you in advance for any assistance provided.

Hey everyone,We currently have a couple of FortiGate VM appliances running FortiOS 7.2.13 and are using FortiClient SSL VPN tunnel mode for client remote access.I understand Fortinet is sunsetting SSL VPN tunnel mode in FortiOS 7.6.3. the business is not ready to pivot off SSL VPN so in the meantime, they want to know whether upgrading to FortiOS 7.4.x is a reasonable short-term bridge (Fortinet’s lifecycl page says says it’ll be supported until March 31, 2028/November 11, 2028). Questions:1. For those who have upgraded, has FortiOS 7.4.x been stable for production SSL VPN tunnel mode?2. Is SSL VPN tunnel mode supported throughout the 7.4.x branch, including later releases such as 7.4.8 or newer, or is there a specific 7.4.x version we should target/avoid?3. Since SSL VPN is hidden from the GUI by default in 7.4, is it still considered fully supported in 7.4.x, or is it more of a transitional feature?4. Can I upgrade directly from 7.2.13 to a 7.4.x release, or should I follow a specifi

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 ) the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.https://sites.google.com/site/unblockedgames4mehttps://sites.google.com/site/unblockedgames77https://sites.google.com/site/punblockedgames/ The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name. I put in a simple IPV4 policy, source = any,  Destination = "sites.google.com/site/unblockedgames4me",  blockand it doesn't work.  because it is a block there is no SSL inspection or anything like that.... When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to blo

Hi, I do have HA Active Passive FortiGate - Active and Running. Recently, I added a new FortiManager. Kindly guide how I can add FortiGate as an HA to FortiManager. There is an option on FortiManager to add an HA Cluster. But that means that this is for a new deployment, and now I'm in production. I followed the normal way to add a node from FortiManager - Add Primary IP - Then I noted that the Secondary became out of sync. Kindly guide me to the correct way.