Solved

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

When I attempt to Telnet into a Cisco switch located downstream of a FortiGate 50G (FG-50G), the Telnet connection fails.However, through cross-testing, I discovered an odd workaround: Whenever I modify any Firewall Policy on the FG-50G (even an irrelevant change, such as removing a service from a disabled policy), the previously failed Telnet connection to the downstream switch suddenly starts working normally.Unfortunately, if the system is left idle for a while, the Telnet connection issue returns.Network Architecture & Environment Setup Upstream & Downstream Switches: Cisco switches, connected via LACP configured to allow all VLANs. Plaintext   interface Port-channel1 switchport mode trunkend FortiGate 50G: Configured in Transparent Mode. Aggregate Interface Configuration:   edit "downlink" set vdom "root" set allowaccess ping https ssh snmp radius-acct set broadcast-forward enable set l2forward enable set stpforward enable set type aggregate set me

I am trying to upgrade my FortiClient EMS from version 7.4.7 to 7.4.8, but I keep receiving the following error message. Does anyone know how to resolve this issue?  Reverting EMS installation files dpkg: error processing package forticlientems (--configure): installed forticlientems package post-installation script subprocess returned error exit status 1 Processing triggers for postgresql-common Removing obsolete dictionary files: Errors were encountered while processing:  forticlientems E: Sub-process /usr/bin/dpkg returned an error code (1) cp: cannot stat '/tmp/ems/info/ems.*': No such file or directory  

Because SSL VPN will retired then i try to create IPSec VPN Remote Access with below setting:phase1 :edit "VPN-RA"        set type dynamic        set interface "port2"        set local-gw xxx.xxx.xxx.106        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 10.105.10.5        set proposal aes256-sha256 aes128-sha1        set localid "vpnra"        set dpd on-idle        set dhgrp 20 5        set peerid "vpnra"        set ipv4-start-ip 10.203.203.1        set ipv4-end-ip 10.203.203.200        set ipv4-split-include "LAN"        set unity-support disable        set psksecret ENC xxxxx        set dpd-retryinterval 60    nextphase2:    edit "VPN-RA"        set phase1name "VPN-RA"        set proposal aes128-sha1 aes256-sha256        set pfs disable    nextAnd below is my forticlient setting But why i always get timeout?  

Hi,a few days we updated from FortiOS 7.2.13 to 7.6.6.Now we can’t download “*.xlsx” files, because our DLP profile is blocking that.But we have only “*.xls” configured for blocking and not “*.xlsx”.When i remove the “*.xls” pattern, we are able to download “.xlsx” Files again.It looks to me that he is using “*.xls*” when entering “*.xls”. Is this a bug or a expected behavior? What do i need to enter, when i only want to block “*.xls” and not “*.xlsx”?A second problem, when i edit the DLP profile i can’t see the file types and can’t edit them. A other admin who is in the same admin group see 2 more colums in the profile table and is able to edit the file types. I switched on already all features in the feature visibility and cleard the browser cache, but no change. Has someone a hint for me?Kind regardsStefan

Hello all,we have an Exchange Hybrid setup with all our mailboxes on-prem. We need to let graph send emails via Exchange Online but we would need to relay these emails via our Fortimail appliance. So the Exchange Online environment does not send these itself without going through the Fortimail first. We found this in the cookbook:How to integrate FortiMail into Microsoft 365 | FortiMail Appliance and VM 7.4.0 | Fortinet Document LibraryAnd this technical guideline:Technical Tip: Office365 Secure Relay via FortiMail to avoid unauthorized email relay | CommunityAnd it seems like we can’t let graph talk directly to our on-prem Exchange servers:https://learn.microsoft.com/en-us/graph/hybrid-rest-support So we wondered how does the Technical Tip from fortinet make sure that we are not risking the relaying of unwanted emails. The authenticated part in the technical guideline does not apply here, no? Because our user mailboxes are all on-prem? And regarding the cookbook: our concern is that w

We use FortiMail’s webmail for IBE secure mail exchange.The Webmail interface allows users to download the de-crypted emails using “save as” without any encryption. These mails are saved as decrypted plain email format (.eml)How can we disable this function in Webmail?Is piping the WebGUI through a reverse proxy/WAF to block this particular button the only way?

If i want to make traffic shaper to prioritize traffic from LAN to host 10.10.10.10 located on datacenter for example,then are i need to create the traffic shapper only for this specific host? Or I need to make another traffic shaper for other traffic with medium priority?

Hi allNothing important or urgent.According to Fortiguard RSS feed about updates, a new version of FAC (8.0.4) has been released over 24h ago.However, I am not seeing any release notes on the fortiauthenticator page or see a download folder for 8.0.4 (so no firmware or release notes there either).Usually it doesn't take that long after a release info to see downloads and release notes. So, I am not sure if I am just impatient.Anyone know if the info and firmware files have been withdrawn?Thanks

We have become aware of the following security advisories regarding a vulnerability in FortiClient:https://fortiguard.fortinet.com/psirt/FG-IR-26-156https://advisories.ncsc.nl/2026/ncsc-2026-0296.htmlWithin our organization, we exclusively use FortiClient VPN-only for Windows. We do not use the full FortiClient client or FortiClient EMS.Therefore, we would like to know whether the vulnerability described in FG-IR-26-156 also affects the FortiClient VPN-only client.Additionally, we would appreciate clarification on the following:* Is FortiClient VPN-only affected by this vulnerability?* If so, which versions are affected?* Which version does Fortinet recommend installing to address the vulnerability?* Is an updated version of FortiClient VPN-only currently available?* Does the VPN-only client update automatically, or do we need to manually deploy the updated version to all our laptops?We would appreciate your clarification so that we can take the appropriate measures if necessary.Kind r

Hi community, I have a question about FAZ logging. Which I can’t seem to find the right answer to and I’m hoping you guys may have experienced something similar.Basically I need to undertake some work on a FAZ VM itself where I don’t want new logs to be ingested to the database for a few hours while I do some work. It will be coming up and down so I don’t want it to start taking new logs when it boots up again.I have about 50 Gates logging to this FAZ and it is not feasible to go to each one and turn off the FAZ logging. I’m ideally looking for something like a pause button on the FAZ if it were to exist. I’m on a VM running 7.4.10. I have seen some recommendations about disabling the port on the FAZ used by the Gates so traffic can’t make it through and using a separate management port to continue to connect to the device which I believe is potentially my only option.Any other thoughts?

Hi Community,I am reaching out because I am hitting a wall with a specific client installation and I suspect a hardware/driver conflict, but I need confirmation or ideas on how to debug this further.The Scenario: I am deploying an IPsec VPN configuration with SAML Authentication (Entra ID / Azure AD).Success: The exact same configuration works perfectly on an HP PC.Failure: It fails consistently on a specific Dell Laptop.Environment (Failing Machine):Hardware: Dell LaptopNetwork Adapter: MediaTek Wi-Fi 6E MT7922 (Wireless LAN Card)OS: Windows 10/11 [Please confirm your OS version here, e.g., 22H2]FortiClient Version: VPN-only Client 7.4.3 (Build 1790) / Hotfix 1.8758The Symptoms:The user starts the VPN connection.SAML Authentication window pops up (Microsoft Entra ID).Authentication is successful.The Issue: Immediately after the auth window closes, the FortiClient status hangs (stalls). It does not establish the tunnel.After a short moment, nothing happens, or the connection attempt si

Environment:- FortiClient VPN (free, VPN-only) 7.4.3.4323- macOS Tahoe 26.7.1 (iMac)- IPsec IKEv2 tunnel with SAML SSO/MFA, NAT-T (UDP 4500)- Not connected to EMS (log shows "Ignore Secure compliance Check as FCT is not connected to EMS")Problem:The VPN tunnel is disconnected by FortiClient itself less than one second after the macOS screen is locked. This happens even when the system is prevented from sleeping (display sleep and screensaver disabled, sleep prevented with a keep-awake utility) and while traffic is actively flowing through the tunnel.Steps to reproduce:1. Connect the IPsec IKEv2 tunnel with SAML SSO.2. Keep traffic flowing through the tunnel (e.g. a TCP check every 60 seconds to an internal host).3. Disable screensaver and display sleep, prevent system sleep.4. Lock the screen (Ctrl+Cmd+Q).5. The tunnel is disconnected within ~0.7 seconds.If the screen is not locked, the tunnel stays up indefinitely, so this is not an idle timeout, a network issue, or a gateway-side dis

Can we query fortinac license usage using snmp? I need historical license consumption every hours.

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Windows printer component splwow64.exe is being flagged.Here are the exact details of the alert: Process/Object: C:\Windows\splwow64.exe Virus Name: FSA/RISK_HIGH//2000002004 Status: Files could not be quarantined To rule out an actual file-based infection, we verified the system file on the affected endpoints: The Microsoft signature is intact (Get-AuthenticodeSignature returns the status Valid). A local SFC scan (sfc /verifyfile=C:\Windows\splwow64.exe) reports no integrity violations. The file on disk is undamaged. The SHA256 hash of the file is BC7412A5EF6D1B32F7032E1008A324006B19C5A5CE4D27BC8D26DFD6BD7EDB0E. Checking this hash on VirusTotal currently shows 0/71 detections. Since the file itself is cryptographically clean and unmodified on the disk level, we strongly suspect this is a false positive caused by a recent p

Hi everyone, I’m having an odd issue with Minecraft and FortiGate and wanted to see if anyone here has run into something similar. I read this thread https://community.fortinet.com/t5/Support-Forum/Unblock-certain-game/m-p/390777/highlight/true and it reminded me of what I’m dealing with, but the solutions there didn’t quite fit my situation. When I try to join certain Minecraft multiplayer servers (especially public ones), the connection either times out or I get disconnected after a few seconds. Singleplayer works fine, and some servers connect without any problem, which makes it confusing. I checked basic settings like allowed ports and application control, and nothing obvious is being blocked. I’m wondering if FortiGate might be identifying some Minecraft traffic incorrectly or if there’s a specific profile or setting that usually causes issues with game traffic. If anyone has experience running Minecraft behind FortiGate, I’d really appreciate hearing

Hello, I am preparing for my exam scheduled for July, but I am having trouble understanding this question. Could you please tell me the correct answer and explain why When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalidcertificate.Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choosethree.)A.AllowB.Trust & AllowC.Allow & WarningD.BlockE.Block & Warning    

 I have a query, I created gre tunnel & then gre interface at the fortigate side  & mikrotik side can't be able to ping remote gateway IP (p2p) which was created fortigate gre interface remote gateway with ping access. But can be able to ping from mikrotik side p2p IP which are using fortigate gre interface local ip. Gre  tunnel showing also up from fortigate side.What is the issue & how to solve it please help me urgently. Using fortigate version is 7.6.7   

HiI have reviewed the FortiClient website and available documentation, but I was unable to find any clear resources explaining how to deploy FortiClient together with the required configuration VPN profile via Intune for Windows users.deployment with a preconfigured setup is supported? If so, please provide the relevant deployment guide, configuration documentation, or recommended deployment method.

Unable to connect to SSL VPN after firmware upgrade to v7.6.7. The connection goes to 10% then I get the following error message: "Unable to establish the VPN connection. The VPN server may be unreachable." 

Due to the lack of support of the SSL VPN, I am migrating the FortiClients VPN to IPSec. Created a new IPSec Dialup config and the tunnel worked fine for a local user. However when I enable the Fortitoken for the user (I receive the token in the email) but the tunnel never goes up and FortiClient show “time out” msg. Sniffing the traffic is possible to see my local peer trying to connect on port 500/4500 but get no answer back from the firewall. Once I try the user without the token it goes completely fine. Any ideas? Cheers

I have multiple IPsec site to site VPNs and remote access VPNs but all the tunnel shows in same table and there is not any option to see this is site to site and this is Remote access VPN tunnel.To verify that I need to open every VPN every time and check this is site to site and this is remote VPN.Like there are option in sophos firewall that we can differentiate this is remote and this is site to site.I faces issue multiple time during troubleshooting and every time need to open tunnel and verify that is remote access or site to site

Hi everyone,We are currently facing a weird issue on our network and I'm hoping someone here might be able to point me in the right direction.A few of our employees in the finance and HR department need to access an online UK tax and salary calculation portal for payroll verification.However, whenever they try to open it from their office machines connected behind our FortiGate firewall, the page either fails to load or shows a block/timeout error. Interestingly, it works completely fine on their mobile data or home networks, which confirms the issue is strictly related to our corporate network setup.Here is a quick overview of our current setup:FortiGate Model: FortiGate 100FFirmware Version: FortiOS 7.2Features Active: Web Filtering, SSL Inspection (Deep Inspection), and FortiGuard Categories.I checked the FortiGate Log & Report section under Forward Traffic and Web Filter, but nothing obvious stands out immediately blocking it—though it might be falling under a strict category o

Hello,Our client used to be able to connect to our website but is now blocked since the end of July.The error:Fortinet" wasn't installed properly on your computer or the network. Ask your IT administrator to resolve this issue.NET::ERR_CERT_AUTHORITY_INVALIDPlease install a root certificate for "Fortinet". We recommend your IT administrator read the configuration instructions for "Fortinet" to resolve this issue. Antivirus, firewall, and web filtering or proxy software are among the applications that can cause this issue. What could be the reason? How can we debug it with our client? Thanks

Hi Everybody,We are running a Kubernetes cluster on Rocky Linux 10.2 VMs, with the FortiEDR Linux Collector installed on the host OS.When FortiEDR Communication Control was changed from Simulation to Prevention, the entire Kubernetes cluster became unavailable. After changing the policy back to Simulation, the cluster recovered and became operational again.I have allowed everything regarding the connections to the outside after checking with my Dev Ops Engineer and we see no new logs regarding the communication control. The affected nodes reported this kernel message:Failed to initialize the IGMP autojoin socket (err -1)FortiEDR Collector version: 6.2.0.1350I double-checked the FortiEDR Events and Communication Control logs, but there were zero events showing that anything was blocked or denied by FortiEDR.Has anyone experienced a similar issue with FortiEDR Communication Control and Kubernetes? If you have any ideas or troubleshooting recommendations, I would really appreciate your he