Solved

Hello everyone,Can anyone confirm whether FortiNAC-F fully supports (or has been successfully integrated) with the following:Aruba 1930 switches TP-Link TL-SG1016PE switches Sophos AP55C access points UniFi U6 Mesh Pro access pointsSpecifically, I’m interested in understanding:Level of support (CLI/SNMP/API… etc) Visibility and control capabilities (profiling, enforcement, VLAN assignment, etc.) Any known limitations or required workaroundsThanks in advance.

Hi, does anyone found a solution, to hold the VPN up and running when the screen is locked? OS: MacOS Sequoia 15.4 and MacOS Sequoia 15.5FortiClient: VPN 7.4.3.1761I had to install the newest FortiClient VPN version after a firewall upgrade as the older versions running in some connection problems.The older versions were stable and connected when the screen was locked. With the new version, the VPN disconnect each time the screen locks. In fortitray.log it is good to see, a message is send to forticlient and immediately after the message, the ssl-vpn is disconnecting. 20250508 14:55:24.613 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:390 System is locked/sleep20250508 14:55:24.620 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:404 System is going to sleep20250508 14:55:24.646 TZ=+0200 [FortiTray:INFO] VpnManager.swift:2163 Check VPN Connect without Reauth20250508 14:55:24.657 TZ=+0200 [FortiTray:DEBG] VpnManager.swift:2174 VPN Connection without reauthenticati

Is there any way to set/push a formulated (by a Jinja template) hostname to a secondary FGT in a-p HA from FMG WITHOUT flipping the HA?Or, simply impossible because FMG doesn’t hold the unique part of secondary devices, like host name, ha config?Toshi

Hi all,I’m troubleshooting a remote access IPsec issue on a FortiGate 200F running FortiOS 7.4.12 and wanted to see if anyone else has run into something similar.When NAT-T is enabled, remote users get noticeable packet loss / stalls over the tunnel during normal traffic — pings, file transfers, throughput tests, that kind of thing. When NAT-T is disabled, it gets a lot better.A few things I’ve already confirmed:the tunnel comes up fine the issue is reproducible when NAT-T is enabled the issue improves significantly when NAT-T is disabled I tested with NPU offload both enabled and disabled with offload enabled, tunnel error counters were higher on the problematic tunnel with offload disabled, those RX errors were much lower or zero in my captures, but the user-visible stalls still weren’t fully explained by the lower-level counters PDQ snapshots looked balanced during testing HPE dropping stayed at 0 in the snapshots I collected anomaly-drop output was empty we also contacted our ISP a

Hi there, I’m having issue with matching Fortigate Proxy Policies against user group membership using AD DC2. Currently I have Active Directory with 2 DC’s. I have separate ldap connections to them (because of scale of organization, and the need to granulary test the migration between them. Fortigate is configured to use Explicit Proxy and we are allowing AD groups to access specific websites in Proxy Policies.When users workstations use DC1 as primary DNS server - everything works (they can access sites allowed in polices) but after switching them to DC2 - they can’t access any website specified on Proxy Policies and fall to implicit deny. We tried switching massively - didn’t work, and we tried switching single/few groups with same result. How we perform the tests on dedicated workstation:Test workstation is joined to Domain Test workstation switches DNS server from DC1 to DC2 (currently for more than 3 weeks the station has DC2 setup as primary DNS without any other DNS servers) Tes

Hello, I have a specific deployement scenerio in my hand. My customer has a closed circuit production plant. There are handfull of PCs and a lot of cameras, industrial devices, industrial printers...etc. I have no problems with enviromental devices. The problem is this plant has limited internet connection and does not use LDAP. PCs are joined to a domain and configured in HQ. Then send to this plant. My question is: Can I use agent without LDAP integration for doing basic scans for applications and viruswall? Since there are no LDAP, I am thinking of using self signed certificates and trust them manually from client agents. But I still need to login to the agents, which I won't be able to match to an LDAP. I did some researchs, I have some ideas but I was not able to come up with a viable solution. If you guys can steer me to a right direction I will be glad.  thanks in advance.#fortinac

I have a strange case with some fortiAPs right now. 1x FAP 231G and 1x431F both on 7.6.4. I want to set a VLAN ID to have the management tagged but the variable is missing when typing cfg -s. Then i connected to the HTTPS GUI and the field is also missing. I typed in the command cfg -a AP_MGMT_VLAN_ID=200 on the CLI and I got no error. cfg -c for commit to flash. Nothing happened. Reboot and still no change, the AP won't take the VLAN ID. I have 100 more 231G on this site and also 20x431F and they all have the variable and it works fine. How is this possible? Anyone else encountering this problem?

I try to install the FortiNAC on Azure for my HA but i try search FortiNAC on the marketplace and i didn’t find fortinac as documented in thisarticle FortiNAC Azure Deployment GuideHere available images from Azure Marketplace. 

Hello Fortinet Community,I have a customer requirement regarding remote access VPN connectivity.My understanding is that FortiGate supports both SSL VPN and IPsec VPN for client-to-site connections. However, I have also seen recommendations to move away from SSL VPN in newer releases, and I am planning to deploy this solution on FortiOS 7.6.The customer's requirement is very specific: they want to ensure that only one concurrent VPN session is allowed per user account. For example, if a user connects through FortiClient using their username and password, a second person should not be able to use the same credentials simultaneously from another PC and establish another VPN session.Is this behavior supported natively by FortiGate/FortiClient? If so:Is there a specific setting to limit concurrent logins per user? Does it work for both IPsec and SSL VPN? Are there any best practices or recommended approaches to enforce this requirement?I would appreciate any guidance or configuration recom

ENVIRONMENTFortiOS: 7.6.x (FortiGate 120G)FortiClient EMS: 7.4.x (FortiCloud SaaS)FortiClient: 7.4.7 (Windows)Authentication: IKEv2 EAP-SAML via Microsoft Entra ID---ISSUEFortiClient endpoints managed by EMS fail to complete IKEv2 IPsec VPN tunnel establishment after successful SAML authentication. The EMS-managed client sends an EAP NAK (type 08) in response to the FortiGate's EAP Identity Request, causing the FortiGate to tear down the IKE SA with 'unexpected payload type 41'.A non-EMS-managed FortiClient with an identical manually-configured tunnel connects successfully every time. The failure is specific to EMS-managed clients.---FORTIGATE IKE DEBUG (EMS-MANAGED CLIENT)The sequence on every EMS-managed connection attempt:  responder received AUTH msg  responder preparing EAP identity request  responder received EAP msg  unexpected payload type 41  schedule delete of IKE SA  connection expiring due to phase1 downThe client response decodes as EAP type 08 (EAP NAK) — the client is re

FortiEMS 8.0 managed FortiClient 7.4.7 using FortiTokken.after first time enter user and password details it don’t ask again user credential only fortiTokken.But as per compliance i have to configure like fortiClient ask everytime user password .i already disable the option save pasword and auto login. still same and in fortiClient (Save login) grayed.

After upgrading our FortiGate device from FortiOS version 7.6.6 to 7.6.7, users at the branch lost internet access when the BambiDeep SSL/SSH Inspection profile (Deep Inspection) was used in the firewall rule.Traffic is allowed by the firewall rule, and NAT is working properly. However, HTTPS connections fail when Deep Inspection is enabled.As a temporary solution, we changed the SSL/SSH Inspection profile from BambiDeep (Deep Inspection) to Certificate Inspection, and internet access was immediately restored.  The first rule includes certificate inspection, and internet access works fine, but the second rule is the old one and includes “BambiDeep” SSL inspection; after the firmware upgrade, internet access is not working. Also ı tested the problem on new rule by adding  BambiDeep SSL inspection ant internet acces is not working. Are they any known issue about 7.6.7 version for tihs topic ?

Previously, with FortiClient version 7.2.13, when users initiated the VPN connection using SSO, FortiClient automatically detected the existing sign-in sessions for the customer's corporate accounts. When the authentication window was displayed, the available accounts were presented for selection, allowing users to authenticate without re-entering their credentials.However, after upgrading FortiClient to version 7.4.3, this behavior has changed. When using FortiClient's embedded browser for SSO authentication, users are always prompted to enter their username and password. The embedded browser no longer detects existing Microsoft Entra ID (Azure) sessions or displays the available signed-in accounts.On the other hand, we have verified that when FortiClient is configured to use an external browser for SSO authentication, the expected behavior is observed. The external browser correctly detects the existing Microsoft Entra ID (Azure) sessions, displays the available  corporate accounts,

We wanted enable auto backup of Fortigate firewalls from Fortimanager to FTP server.Please guide.

Would it be possible to get more info logged on the reason why  the disposition was deferred? is ther a setting in the configuration that regulates this? Can a whitelisted sender also be “blocked” like this? Would whitelisting of the domain or sender by the user be sufficient  to avoid this?  Could the receiver be informed when there is a mail stuck  as "Accept; Defer disposition"? With the reason why?

Hello,I have two FortiGate 1800F units running FortiOS 7.4.12. One unit is licensed, while the other is currently unlicensed. I am planning to purchase the required license for the second unit, but it may take some time.For the time being, I need to configure the two units as an HA cluster before the license for the second unit is available. Is this supported? Will HA, configuration synchronization, and failover work properly during this period? Are there any risks or limitations I should be aware of?I would appreciate your advice and recommendation.Thank you.

Hi, i have a Fortigate 200D Firewall with FortiOS 6.0.16 and a Huawei 4G Webstick Modell 3372h. I can't bring the Connection to the LTE-Network up. I searched around and found this https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Huawei-E3372-h-modem-stick/ta-p/193600 The Problem is, that i have the AT-Command Version of this Stick and this HowTo is for the Web-Interface Version. When i try to configure the Stick as lte-modemdiagnose sys lte-modem infosays, that the Modem is not connected.  So i tried to configure the Stick as "normal" Modem. The Modem itself seems to work properly: diagnose sys modem queryUSB status: Connectedmanufacturer: huaweimodel: E3372IMEI number: 868230032061123SIM state: Validservice status: Valid Servicesignal level: 3/4network name: E-Plusnetwork type: E-UTRANlocation area code:active profile(AT&V):COMMAND NOT SUPPORT^RSSI:18^HCSQ:"LTE",45,47,136,26 But in the Debug Messages a Timout occures (At

Hello,I followed this technical tip:Fortinet Technical Tip – Quickly isolate hosts that have disabled or uninstalled the Persistent AgentIt works very well when I stop and restart the Persistent Agent. The host is correctly detected as At-Risk, and I can see the VLAN change from the remediation VLAN back to the production VLAN as expected.However, when I completely uninstall the Persistent Agent and then reinstall it, the host remains in "Agent Not Communicating" status. The status does not change after the agent has been reinstalled.After reinstalling the agent, I have to delete the host from FortiNAC and restart the workstation before it is detected correctly again.Is this expected behavior?I also have a question regarding the following statement from the technical tip:"An Event Mapping can be created that immediately changes the host status to 'At-Risk' as soon as an event 'Persistent Agent Not Communicating' is created."Does this Event Mapping apply to all hosts, regardless of thei

So for whatever reason on new devices that we have set up the past couple of months we cannot seem to connect to our VPN at all on these new devices. However, the older devices seemingly have no issue.  We have tried reinstalling the C++ libraries, reinstalling FortiClient, and updating the NIC driver but have had no luck.  All of these new devices are running Windows 11 Pro 24H2 and its a mix of 2 Dell Latitude laptops and one Microsoft Surface Pro 9 if that helps with anything.  Also tried looking for some of the older versions on the support page but we don't have the firewall tied to our account so it doesn't let us search through the download page.  I have tried version 5.4.3.0870 of FortiClient that we had saved but that didn't work either although I am not sure if that version is Windows 11 compatible or not.  Not sure where to go from here any help is appreciated!

I add Fortigate to the Fortinac and why i get below event? Actually the Fortinac connect to the Fortigate using SSH and not telnet. 

Hi All, VersionFortiGate-81F v7.4.8,build9191,260511 (FIPS-CC-74-8)FIPS-CC mode: enableFortiSwitch-148F-FPOE v7.4.8,build0929,250909 (GA)Security mode: none In our environment, Federal Information Processing Standards (FIPS) is required due to the contract we have. I have been running into the following issues while testing FIPS mode on our equipment.The FortiSwitches appear under Managed FortiSwitches. I can see the firmware version, status, and join time, but I cannot SSH into the switches from the GUI. It also does not show the Connecting From status or the switch IP address.Under FortiSwitch Ports, the port connecting the FortiGate and the FortiSwitch shows as down. When I assign a VLAN to a FortiSwitch port, the VLAN assignment is accepted, but it does not actually take effect on the connected device.However, from the FortiGate CLI, I can SSH into the switch without any issues. The switch status is visible, but it appears that the configuration is not being fully synchronized to t

I believe when we add the switch to the fnac for 1st time then fnac inventory will collect below data such as Name, Default Vlan, Current Vlan from the switch. When we have changes on the switch, example i make port description and change the default vlan then why in the fnac is not updated? Resync the interface is not helping  

Hi everyone,I am attempting to set up a new IPsec VPN connection using the standalone FortiClient VPN only v7.2.1.0779 app, but several configuration options appear to be missing from the user interface: Missing Single Sign-On (SSO): When creating an IPsec VPN profile, there is no option or toggle for Single Sign-On (SSO / SAML) anywhere in the GUI. Missing Mode Config Parameters: Under Address Assignment, selecting Mode Config does not reveal options for Encapsulation, IKE UDP port, or IKE TCP port. Any insights or guidance would be greatly appreciated. Thanks!Missing option in my appSSO setting i expectedMode configuration setting i expected 

We can select 802.1x authentication set to user or computer if we use wired. How about for wifi? There is no option to select that option on the wireless card properties.

Hi AllI would like to know if there is a method to export FGT Policies into Excel (csv) format.Please advise any available options. Am using FortiOS v7.4.12 Many thanks