Solved

Issue has been detected in the FortiSOAR RDK (Rapid Development Kit) pertaining to the Onchange event and the associated input fields' display behavior. Particularly, when triggering the Onchange event for certain parameters, such as 'Without a User - Application Permission', the expected behavior of enabling the server URL textbox is not observed.    Onchange issue

I'm deploying FortiClient 7.2.3 using Jamf to macOS 14 devices. The issue we are having is that even though we have a mobileconfig profile deploying the necessary certificates and PPPC settings to the devices, when the FortiClient connects to our EMS server for the first time, it prompts for admin credentials for a certificate change. But regardless if you enter the password or cancel the prompt no change is made to the certificates in keychain. After the initial connection to EMS this prompt does not re-appear. Has anyone been able to get rid of this prompt? This wasn't an issue when we were using version 6.4.8 of FortiClient. 

FGT40F

I just ran into this: We have a Windows DHCP that has a scope for a vlan.the vlan interface on the FGT100E is set to do dhcp relaying to this Windows DHCP.the Windows DHCP also has dhcp option 138 set for all scopes it has.If I now connect a client to this vlan interface and set it to request an ip via dhcp it does get an ip from the Windows DHCP. Also the correct scope is used. Networking works fine so far.However the DHCP ACK is missing the option 138 completely. If I do packet sniffing on the FGTs interface where the DHCP Server is connected to I do see the forwared request from my client and I do see the answers including the ACK. This ACK does contain option 138 but the value in the option is not what is configured on the DHCP Server. And as said the client doesn't receive option 138 at all. Did anyone exprience this or similar and has some hint for me why that happens?

Hello All, i try to use proxy ONLY for the Fortinet Client on Windows.I used this XML config (from docu).<proxy><update>0</update><fail_over_to_fdn>0</fail_over_to_fdn><online_scep>1</online_scep><virus_submission>0</virus_submission><type>http</type><address>myproxy</address><port>3299</port><username></username><password></password></proxy>BUT still the Fortinet Client connecting without Proxy.I also installed the newest Free client 7.2.4.0972_x64 Using the proxy in Windows network settings is working, means VPN via proxy is working. Any Idea why FortinNet client ignores the proxy from the configuration?Thx and rg A.  

What is the Authentication Servers for in the FortiClient EMS Cloud setup and how does it differ from the SAML Configuration thats under User Management?

Hey,  We are a small startup looking into buying a network firewall that would be easy to connect to the Fortinet VPN.  I searched for articles describing how to do that with Juniper or Cisco, and that doesn't look straightforward. Therefore, I'm seeking advice on a modern, rack-mounted device suitable for managing a very modest amount of tracking that can be easy to set up as a Fortinet client.  Best,Yevheni 

Hello, I would like to have confirmation if possible (I'm a novice in the field). I have this message "Log-forward 'ld-xxxxxxx' lag behind 99.92%, discarded 9551454767149537bytes, every 10min and I think the FAZ can't forward all logs to ELK. Can anyone confirme my thinking  Even in the graph < Receive Rate vs Forwarding Rate > I can see that number of receiving log is heigher than the forwarding one. Thank you for your help.

How can I upgrade from version FP221C-v5.2-build490 to version v6.0.6?Is there an upgrade path available?

Hi,On Vmware ESXi platform is present a FAZ with version 7.2.4 Premise, on the vcenter where I am operating the cpu and ram resources are available I have performed similar operations on other Fortinet vm's (Fortigate, ect) Under edit settings -> cpuThis is the situation             Has anyone had a similar problem is it possible to have to have 2 cores each with 8 sockets ?I don't think it's a fortinet license issue or the vm image installed on the vm. I thank you for your attention and look forward to your opinion.Best Regards 

Hi, recently i started an application on linux that i need to use a database on another network, so, i have to use a VPN to connect in this database.  When i run the command 'fortclient vpn view' i got the following message: Client Certificate: NoneAuthentication: DisabledSingle Sign On (SSO) for VPN Tunnel: DisabledAuto Connect: DisabledAlways Up: DisabledSave Password: Disabled  How do i enable the option Always Up and Auto Connect? the command 'forticlient vpn edit' don't give me this options. Sorry for my bad english    

Hello,I´d like to setup #FortiClient FortiEMS Cloud AD-connector. But the documentation lacks the information where to find the Where to find the Connector UIDhttps://docs.fortinet.com/document/forticlient/7.2.2/ems-administration-guide/787816/ad-connectorbest regardsMartin Haneke

Hi everyone,  Can you guide me how can I allow Whatsapp voice and text only and deny video calls and file transfers?  The firewalls we are using are on the version 7.2.6, Fortigate 100F.  Thanks in advance for any guidelines.  Regards Mihail

what is serial no. of firewall which we use to create service ticket?

is there a settings in fortigate that limit the SSLVPN connection duration ?we have users reporting to us that SSLVPN connection will disconnect after 8 hrs.how do i extend the hours beyond 8 ?

Hi community Can someone kindly assisting in guiding me how to enter banned words in Fortimail via CLI - in a batch? Is it possible? I have over 300 of them, clearly not to be entered one by one in the gui.

Guys, I have two 40F in AH A-A. I configured the load balance using the command set load-balance-all enable . But that the load is not balancing. Has anyone been through this that can help me??

Hello! I have few questions regarding FortiGate license. Product is 60F v6.4.6 build 6083 GA. I am providing a screen shot below: Qs1: Is creating a FortiCloud account a must for adding license/ renewal?QS2: If there is no forticare support license, will I still have to create the account in forticloud?QS3: from the picture, 4 entitlement is expired and 1 is for register. Which is the most important to do licensing/ renewal first and why?QS4: How much time will it take for (New license and renewal) the licenses to be added to the fortigate product? (can see it in the fortigate interface) 

Hello, Could someone give me one help? Made this request to my fortinet, gives 200 but looking at console, not works. curl -k -X PUT --location "https://*****/api/v2/cmdb/firewall/addrgrp/OFF" \--insecure \-H "Authorization: Bearer ****" \--header 'Content-Type: application/json' \--request PUT \--data-raw '{"method": "PUT","url": "/api/v2/cmdb/firewall/addrgrp/OFF","params": {"datasource": true,"with_meta": true,"vdom": "root"},"data": {"member": [{"name": "X.X.X.1"}]}}'{"http_method":"PUT","revision":"519**","revision_changed":false,"mkey":"TAOFF","status":"success","http_status":200,"vdom":"root","path":"firewall","name":"addrgrp","serial":"FG*","version":"v7.4.3","build":2573}%

Hi, I am trying to figure out Traffic Shaping on my FortiGate FGT200F running Firmware 7.4.3, I can see that you can create Traffic Shaping profiles in Policies & Objects and assign based on criteria but also can see that you can assign to Firewall policies. Which should you use or recommend to use? I have taken over the FortiGate's from another person and they appear to be using both but think they must be clashing with each other. Thanks   

Lets say I have the following portal config:config vpn ssl web portaledit "VPN_Contractors_General"set tunnel-mode enableset forticlient-download disableset auto-connect enableset keep-alive enableset save-password enableset ip-pools "VPN_Contractors_General"config split-dnsedit 1set domains "louis.net,louis.com,louisgod.com"set dns-server1 10.100.74.21set dns-server2 10.100.90.21nextendnextend Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General.  Now in my VPN SSL Settings I have the following:config vpn ssl settingsset banned-cipher SHA1 SHA256 SHA384set https-redirect enableset servercert "star_louis_com_20250306"set idle-timeout 900set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"set dns-server1 10.100.74.21set dns-server2 10.100.90.21set source-interface "port1"set source-address "all"set source-address6 "all"set default-portal "full-access"config authentication-ruleedit 2set groups "TDS_FirewallSSO

Hello, I have several questions on FortiToken (e.g. to Login to FortiCloud: 1. How to create a second FortiToken on another smartphone?2. How to find and backup the recovery phrase / masterkey for an already created Token?3. How to use 3rd party OTP for FortiCloud login? best regardsMartin Haneke

Hi, Can I still connect to VPN even if I am connected to office WIFi/LAN? Is there a settings on FortiClient EMS for that?

Good day, IKEv2 Dial-In Clients [198.18.25.0/24] connect successfully via FortiGate to the Intranet 192.168.0.0/16.But they cannot connect to a branch office network [172.16.0.0/16] which is also connected as a Site-2-Site VPN on that FortiGate The firewall policies are set to "allow" accordingly for these IKEv2 clients.The Intranet 192.168.0.0/16 can reach the destinations in 172.16.0.0/16 over that Site-2-Site VPN. Phase 2 is up:name=Site2Site ver=2 serial=1 XXXXXXXXXXXX:0->YYYYYYYYY:0 tun_id=YYYYYYYYYYY tun_id6=::YYYYYYYYYYY dst_mtu=1500 dpd-link=on weight=1bound_if=16 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=0 overlay_id=0proxyid_num=4 child_num=0 refcnt=7 ilast=1 olast=1 ad=/0stat: rxp=10256 txp=6843 rxb=12044848 txb=1178486dpd: mode=on-demand on=1 idle=30000ms retry=3 count=0 seqno=6natt: mode=none draft=0 interval=0 remote_port=0fec: egress=0 ingress=0proxyid=Site2Site proto=0 sa=1

Hi all, I'm having some issues with port forwarding. I'm running fortinet v7.0.5. I have a Windows Server running Tomcat 8.5 which is running my website. I've succesfully managed to import my SSL certificates into tomcat (on my windows server, going into https://localhost:8443/ i can see the certificate (shows as error, because the domain doesnt match, but all of the information about the CA etc is there, so its working okay). But when i go through https://domain.com:8443/ i get Unable to connect - An error occurred during a connection to domain.com. If i go to https://domain.com (without the port) i get The connection has timed out - An error occurred during a connection to  Now i have a public ip on my fortinet wan, which is used mostly just for ssl-vpn to remote into my workspace when im at home. I've added 2 VIP's one for port 80 and one for port 8443(https) - port 8443 seems to get hits, but cant load, and port 8443 reports as closed when using tools to ch