Solved

Hi,I'm testing the FortiClient EMS solution on a trial license. After updating to version 7.2.6, the system detected the PHP CVE-2024-11236 Out of Bounds Write Vulnerability. Is there a way to report this to have the vulnerable application version updated?

Hello all,I need your help with problem.I have central location and few branch locations.All branch locations have internet routed via IPSEC vpn established with central location.The problem is that devices at branch locations have internet acces while Fortigate itself doesn't (for license updates etc). So what I'm missing here.  Branch office IPSEC phase 2 remote subnet is set to all (so devices can access internet). Ping and traceroute from branch office fortigate doesn't return anything, firewall isn't blocking (or at least logs doesn't show anything) anything related to fortigate directly.Central location is fortigate 70G while branch locations have 40F if it does matter.It is probably really simple solution but couldn't find solution yet :)Thanks!

Hello everyone,I have a Fortigate 60F device running Fortios 7.6.4.I can't use NPU for my internet exit rules. The CPU is 100% busy. I can use NPU for local traffic, but not when exiting to the internet. What could be the reason?I look forward to you

  I  downloaded  VM  from fort iCloud  Sit  and I cant make evaluation LIC when I put my mail and password get this massage in  CLI  for FortiGate  FortiGate—VM64 login: Requesting Fort iCare Trial license,requesting Fort iCare Trial license, proxy : (null)

Hi,Im trying to obtain firmware for my FortiWeb WAF Azure and AWS VM, which is on a PAYG license.The FortiWeb is registered in FortiCloud and shows as one of my assets.When I go to Firmware Download section and select FortiWeb as my product, I get a message indicating that I do not have a contract for this product?Opened a ticket with Support and first they said, with a PAYG license I can download firmware from Azure/AWS market place, with a link directing to the page when you want to purchase and deploy a FortiWeb VM. Not the actual firmware to upgrade my current FortiWeb.After pointing this out to, support came back and said I need to go to VM images, select my product and download the image, but when I follow those steps I see that these images are for New deployments and not for firmware upgrades.Can someone please indicate where I need to go to download my firmware, and is it possible that there might be some sort of registration issue with my FortiWeb? It does show that its licen

We have a FortiClient VPN access to several customers. I try to update the FortiClient version on my machine by downloading a new version from https://www.fortinet.com/support/product-downloads#vpn (download "FortiClient VPN-only" for Windows).This does not work: a form is shown where I enter my contact data and click "Download". The button changes to "Submitting...", and after some time it reverts to "Download" again, without any download coming up.  Does anybody have an idea on how to get new FortClient versions? To my understanding, this component is free to download? Best regards Wolfgang

Please explain this setting:

The goal is to cater for two types of user accounts which require VPN access; internal staff accounts added to a dynamic group and member accounts used by third-party users which are manually assigned to a group as required.  My question is whether it is possible to set multiple Object Ids in the below config on the FortiGate corresponding to multiple Groups assigned to the FortiGate Enterprise App in Entra. Any alternative suggestions for how this scenario can be handled are welcome. 

Hello everyone, in the config wizard I would like to know if the "domain" field has to be a real domain as in the prod domain or do I have to make a subdomain for FortiNAC and config it in my DNS server ? BR,

Hello colleagues! Got confused with a simple case with IPsec on the first view. The situation:We have a 3rd party partner who is not smart enough unfortunately. We have to establish an IPsec tunnel via 2 different link , but with policy base only(don't ask why). The partner has the only single IP for IPsec tunnels where I have to connect , the route for this IP I receive from BGP from both "outside" links (with \30 link's subnets) , one as a main and another as a backup. We have a subnet on a vlan-interface that we announce into the BGP and we have to establish the IPsec Phase1 with the source IP from the subnet. So the problem is that the subnet that we have to use as IPsec source is different from the Outside's interfaces. In my opinion in theory it's possible, looks like a simple routing , an IP packet from my FG will be NAT-ed (SrcNat) with one of IP's from the announced subnet , there is a route toward the partner's IP, the backward packet will get the outside interface with the s

Hello Fortinet Community,I am facing an unexpected behavior when publishing a web application using a Virtual Server.ContextWeb application hosted on an internal server listening on port 80Virtual Server configured with:External port: 3000Mapped to internal port: 80Purpose: publish the application on a non-standard external port (3000) while the backend remains on port 80Observed behaviorFirewall policy allows only port 3000Accessing https://webapp.com:3000 → Does NOT workAccessing https://webapp.com:80 → Does NOT workFirewall policy allows only port 80Accessing https://webapp.com:3000 → Works correctlyAccessing https://webapp.com:80 → Does NOT work What I am trying to understandAt which stage does FortiGate evaluate the firewall policy in relation to:DNAT / Virtual Server port translationWhy the policy seems to match on the post-NAT (internal) service/portWhether this behavior is:By designSpecific to Virtual ServersDifferent from standard VIPs or central NAT QuestionI would

I've been trying to install the SSL VPN Only forticlient install on an employee's workstation and the install process gets almost all the way finished but then errors out and rolls back. There is no actual error message listed in the installer. I can see the MSIexec logs in windows starting the install and ending it but there are no errors there either. There also doesn't appear to be a log file created locally by the installer in the software or app data directories. I've tried multiple versions of the offline install from fortinet's downloads page as well as the default auto installer. I noticed that after a failed install the registry creates a "Fortinet>Volatile" entry under local computer with a "requires reboot" value of 1 but even after a reboot the install just fails again. Removing the Fortinet registry value does not change the outcome either. As a work around I installed the full forticlient with only the required install components and the SSL VPN. This install

Hi Team, I am using FortiGate with Version 7.4.9. I have ISP connected to WAN interface and my clients on LAN interface. Currently I have configured Prefix Delegation for IPv6 to get the LAN addresses from ISP and it is working as supposed to be, with SLAAC addressing towards the client for the PD prefix.Now along with this, I want to configure a ULA as a secondary address in my LAN interface. How can i achieve this. I could not find any option in CLI. Please provide any insight on this or let me know if Am missing anything. Warm RegardsMidlaj

Hello, I have encountered strange issue on our FortiClient configuration. We have deployed FortiClient via EMS Cloud to 500+ stations and for some time everything runned smoothly but suddenly lot of stations started to disconnect with this error even tho the configuration on both sides remained unchanged. The VPN connection is re-established randomly. For the specific error - VpnParameterConfigError i did not find any community posts, I reviewed configuration on both sides as the error is pretty explanatory but did not find any misconfigurations. As this is currently production environment, i cannot really troubleshoot this issue and make lot of changes on the current VPN configuration at the moment and need to wait for a weekend. If anyone encountered this beforehand please shine some light on this issue. Thank you Below I attach screenshot from the FortiClient (its in Slovak as the customer has it set this way) Rougly translates to: Last r

Hi, We have a FortiExtender 511G that we want to connect to a private 5G solution. To connect to this private 5G service it is mandatory to set the modem to 5G only mode. I have not found this option in the GUI or CLI. I only found a post on this forum how to do this for the FortiExtender 511F ( https://community.fortinet.com/t5/FortiExtender/Technical-Tip-Switching-Carrier-Service-Mode-to-FortiExtender/ta-p/336389 ). However the used AT-commands are not recognized by the modem of the 511G.  The FortiExtender is in LAN extension mode and runs firmware v7.6.4 and the modem runs FEM_20_EM9291-24-01-01-NAM. So is it possible to set the 511G's modem to 5G only? And how do I do this?Thanks in advance.

Hey Team, I am facing an issue with FortiGate VM evaluation licensing and would appreciate guidance. Scenario: I initially deployed a FortiGate VM for lab/testing purposes.At first, I was able to see and apply the Evaluation license.Later, after deleting the instance and re-deploying (also tried changing instance type from t2/t3), the Evaluation license option is no longer available.Now the firewall only shows options for Full License upload or FortiFlex token.I also tried uploading the previously downloaded trial license under Full License, but it did not work.Environment details:Platform: AWS (EC2)Usage: Lab / learning purposeInstance types tried: t2.small / t3.small / t3.mediumRegion: N. VirginiaThis is not a production setup. 

Hi, We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection? I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some o

On Fortigate 90G faceplate shared ports wan1, wan2, sfp1, sfp2) shows grayed out.There physical connectivities on sfp1, sfp2 and it working fine. We are able to do the configuration  for those interfaces but the only concern is it shows grayed out on gui faceplate.Please guide..

Anybody else having issues with getting the 'free' ipsec client to work?I've been messing around with this for a couple of weeks and so far, with 5 different machines and 4 different clients - only 1 machine will connect.I've already engaged support but since this is the 'free' client - they have exhausted all that they can help with.I don't need all the 'add-on' stuff with the vpn, just need it to connect - stay stable and provide some basic routing (thru it).What happens is that i install, configure, connect - and it hangs.  nothing until the connection drops off a few minutes later. packet captures seem to indicate that 'all' the tcp packets aren't getting sent/received and therefor phase 1 never completed. 

I am getting vulnerability warnings from NIST, which indicate I need to be using version 7.4.4.x of FortiClient, but your website does not provide beyond version 7.4.3.1761 for the VPN only version. Please provide an update for the VPN only version. https://nvd.nist.gov/vuln/detail/CVE-2025-31365

Hi,Has anyone encountered when executing a command below to get this output?Model FSW 124F-FPOE most of them and managed via FortiLink. diagnose switch physical-ports summaryPortname Status Tpid Vlan Duplex Speed Flags Discard__________ ______ ____ ____ ______ _____ ____________ _________prt_switch_phyport_summary: unable to get port1(#1) statusprt_switch_phyport_summary: unable to get port2(#2) statusprt_switch_phyport_summary: unable to get port3(#3) statusprt_switch_phyport_summary: unable to get port4(#4) statusprt_switch_phyport_summary: unable to get port5(#5) statusprt_switch_phyport_summary: unable to get port6(#6) statusprt_switch_phyport_summary: unable to get port7(#7) statusprt_switch_phyport_summary: unable to get port8(#8) statusprt_switch_phyport_summary: unable to get port9(#9) statusprt_switch_phyport_summary: unable to get port10(#10) statusprt_switch_phyport_summary: unable to get port11(#11) statusprt_switch_phyport_summary: unable to get port12(#12) statusprt_

Hi,For some reason, everyone using edge at my company is suddenly getting nonstop notification from FortiClient System Tray Controller saying: "Microsoft Edge" extension policy anomaly detected, please restart the browser.This happens anytime you try to open any websites and they just get stuck in loading until it fails. I restarted the browser and I even shut all Edge operations in task manager, nothing works. I cant seem to find any solutions online so was wondering if anyone was familiar with this issue and if they managed to resolve. Thanks!

Hello All, We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used. Thanks in advance

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.