Solved

Hello,After upgrading FortiGate to version 7.6.5, we encountered issues with IPsec tunnels. According to the Fortinet technical article, the default Diffie-Hellman group values were changed from  5 to 14, 20, and 21. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-tunnels-not-connecting-after-upgrade-to-v7-6/ta-p/423320 Current situation:On PC clients, the issue was resolved by changing the configuration and setting matching DH groups (14, 20, 21) on both sides of the connectionTunnels are working correctly after synchronizing the settingsProblem: The FortiClient VPN application on Android does not have the option to select DH groups higher than 14. As a result, mobile users cannot establish VPN connection after the FortiGate upgrade.Questions:Is there a planned update for FortiClient Android application with support for DH groups 20 and 21?What is the recommended temporary workaround - should we roll back the configuration on FortiGate to older DH groups

 I have 10 collectors and successfully registered 9 collectors .1 Collector giving this error.I have tried wit different user after logged in to the GUI but the same error.   phProvisionCollector --add admin 'password' 10.10.1.11 Super fsm.col1Continuing to provision the CollectorFailed to register collector!Cause:HTTP Status 401  Not authorizedThis request requires HTTP authentication. seeking expertise answer

Hi. I can't sync with the ntp server after using executetime xx:xx:xx in Fortianalyzer.It is the same even if the ntp status is disabled and enabled.Is there an ntp sync command on Fortianalyzer?In the case of Fortigate, I can find out when it was last synced through the 'execute time' command, but how do I check it in Fortianalyzer? Thank you

Hello all.  In registering the collector with the super. /opt/phoenix/bin/phProvisionCollector --add 130859572admin 'passwordomited' <FQDN SIEM> <ORG>  <COLLECTOR NAME> Error: HTTP Status 401 - Not authorized This request required HTTP authentication.   I am seeking from the community any experience or knowledge of this occurring and the creds NOT being the issue.I  have found a wealth of connectivity troubleshooting articles. But nothing about  401 Not authorized return code error as a result of phProvisionCollector. What we checked.doubled check org name, admin name, etc.checked the collector exists under their org settings in the SIEMchecked Phoenix log and found "PUT" command error 401 from the collectorwe can see the super talking back on port 443found the ssl_access_log and it to had the 401 error from the collector Have not verified time sync by running the date command on collector and super, if they are out of sync

Hi all, I need to use Forticlient VPN ver 7.2.4, but cannot find else where. how can i get its .deb file for installation?

I am currently working on an educational lab My objective is to integrate a fgt 7.0.12 with a fgm 7.4.8.The recommended step-by-step procedure and CLI commands to add the FortiGate to FortiManager

Hello, My FortiAuthenticator HTTPS certificate is close to expiring. I generated a new certificate with the same configuration and imported it through the Local Services console. The old certificate was automatically replaced by the new one, but I can see that the Web GUI is still using the old certificate. I cleaned the browser cache, i tried with the incognito browser mode but nothing works, i also waiting for one but still use the old certificate. I would also like to know whether this certificate has any impact on EAP WiFi authentication or any other FortiAuthenticator components. Thank you.

Hello, The Default-Server-Certificate expiration will expire in 5 days. We use FAC for WIFI EAP-TLS and VPN MFA. I can see that the certificat is used in LDAP service, OAuth service and maybe in other services. It is safe to keep using this certificate after the expiration, or should i renew it ? i wanna also the impact if i renew the certificate.   

Hi, I did a less-than-thorough search on the web, but was wondering if Fortinet has plans to integrate Wireguard VPN in their Fortigates?  We've all had some sports with IPSEC tunnels that drop and never come back - might be time to embrace the future. :)  Thanks! 

Hello everyone, I’m currently working on the design of a FortiSIEM deployment expected to handle 10,000 EPS, and I’d like to get some insights or recommendations from the community. Planned architecture1 Supervisor1 WorkerCollectors at each site (multiple sites)ClickHouse for event storageBefore finalizing the architecture, I have a few questions about the design choices and database placement.  1. Architecture benefitsWhat are the main advantages of separating the Supervisor and Worker compared to using an all-in-one Supervisor setup (for a 10K EPS environment)?Does it provide noticeable performance or scalability improvements in real-world deployments? or would be an all in one supervisor good enough (to optimize resources usage).  2. ClickHouse placementWhere should ClickHouse ideally be installed — on the Supervisor or on the Worker?My initial preference is to host ClickHouse on the Worker to reduce load on the Supervisor, but I’d like to confirm if th

I connected the FortiAP (FortiAP-FP431F) to the lan, and the firewall is a FortiGate VM (v7.4.9 build2829 (Mature)). I found that the FortiAP can obtain an IP address from the DHCP LAN port of the firewall, but the FortiAP device is not discovered in the WiFi controller's "Managed FortiAP" menu. What could be the issue, and how can it be resolved?

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's. In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this.  I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too.  Looking for some suggestions on how to tackle this one?Denny    

Hello, We have two questions:Is there a guide to make virtual IPs work on SSL VPN interfaces?May hairpin NAT work using secondary IP interfaces?We are trying to make hairpin NAT work on 3000F. Any help will be much appreciated. We followed this KB on hairpin NAT (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448#M2442). Our use case is similar to Example 1. Campus1 (VPN / LAN IPs) --- FW (WAN IPs) -- internalServer (VIP). At the FortiGate side, the VPN tunnels land on an SSL interface (ssl.root); ssl.root is defined on a WAN interface (port35). Two firewall policies are defined:a NAT ingress rule, from ssl.root to port35, allowing internal users (VPN admin pool) to reach the virtual IP (defined as destination address object) balancing on an internal server.an egress rule, from port35 to a DMZ, allowing the NAT'ed requests to reach the load balancer virtual IP.This translates into these policies: # show firewa

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:FortiGate-120G HardwareI am looking for advice and community experience regarding the possibility of implementing a port knocking mechanism on a FortiGate firewall.My goal is to restrict access to specific services and dynamically allow connections only after a predefined sequence of connection attempts (port knocking).I have reviewed the official documentation and forum discussions, but I would appreciate clarification from those with hands-on experience:1. Is native port knocking supported on FortiGate?Scenario:• 4 ports in a specific sequence• 2–3 seconds timeout between each attempt• Final goal: open a real port (e.g. SSH, RDP, Web) only for that IPStep-by-step process1️. Initial state• The firewall completely blocks the real port (e.g. SSH 22).• It only listens for connection attempts on the knocking ports.Example ports:• Port 1 → 4000• Port 2 → 5000• P

■Customer Environment・FortiGate 400E・PC1 (RDP executor)・PC2 (RDP receiver) ※Both PCs are windows 10.※The firmware for the fortigate400E is v7.2.5. Also, the FortiClient firmware is v7.0.7.※SSL-VPN connection is used.※A policy has been added to allow communication from the internal segment to the VPN terminal segment. ■InquiryI want to make an RDP connection from inside the company to a remote access terminal outside the company.However, when I RDP from an in-house terminal(PC1) to a remote access terminal(PC2), the FortiClient disconnects.The forticlient notice states that the tunnel "SSL-VPN connection" has been disconnected because another user has logged in to this computer.The screen on the PC1 side showed the RDP screen, but remained dark. I would like to know why forticlient disconnects when I do RDP. If anyone knows the cause of this, please let me know. FortiGate  FortiClient  

Hi , Fortinet Community, I want to install Fortiweb 600F in my Client Infra. I want to install it in Reverse Proxy Mode. Client Network design is this1. Server->Distribution->Core Switches->FortiWeb->Fortigate FW-> ISP Internet + MPLS Links Client has multiple branch offices in country hospital which run erp/web applications from remote locations which will be sitting behind Fortiweb.  Please suggest me either reverse proxy mode is perfect for it?And Suggest what will be network topology and subnets/VIPS.Lets Suppose my server form is using 20.20.20.0/24 subnet and Fortigate firewall working as edge firewall running 10.10.10.0/24 subnet.needs experts and seniors help. Kindly suggest better approach. Can be vips subnet different, how it will route , how other traffic will route, currently gateways of servers configured upon fortigate firewall 

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:1. FortiGate-120G Hardware2. FortiSwitch-1048E4. FortiSwitch-148F-FPOE5. FortiAP-234FWhat concerns me is that, for some of the offices, the only available option for a SSTP VPN tunnel is, due to the fact that the providers block our other VPN solutions.From forums, documentation, and various sources, it is stated everywhere that SSTP cannot be used.Is it true that it is not possible to use SSTP at all?The other question is whether it is possible to control Layer 2 traffic between computers.By this I mean: if one computer attempts to attack another computer, and both are connected to the same switch, is there an integrated tool on the switch that would allow me to detect and block such an attack?Thank you in advance for your time.

Hello Fortinet Community,I Am experiencing an issue with Security Posture Tags on FortiClient EMS Cloud.Environment:FortiClient EMS CloudVersion: 7.4.4 build 2034 (Feature)Client OS: Windows 11Feature tested: Security Posture TagsTag type: OS VersionRule configured:OS Version = Windows 11 (Latest update within 30 days)Issue description:The posture tag is not applied consistently.Sometimes the rule is correctly evaluated and matched, but shortly after, the same endpoint becomes non-matched, even though the system remains compliant (Windows 11 fully up to date).  Tag is matchedTag is not matchedObservations:The endpoint remains compliant (Windows 11 + recent updates)The tag Is sometimes matched, then later not matched without any OS change (always)Questions:Is this a known issue or bug in EMS Cloud 7.4.4?Is There any workaround or recommended fix?Are there specific EMS or FortiClient settings that should be adjusted?Thank you in advance for your help and feedback.

Hi all,Regarding the newly published CVE-2025-62631 (https://www.fortiguard.com/psirt/FG-IR-25-411), I was unable to find any information about a fixed release for FortiOS 7.2.x. Not sure whether a fix for 7.2.x branch is planned, and if so, when it is expected to be released?

HiCustomer have web connection to local server and I get following error:Profile defaultAttack Name HTTP.URI.SQL.InjectionAttack ID 15,621Reference https://fortiguard.fortinet.com/encyclopedia/ips/15621Incident Serial 73,033,816Direction outgoingSeverityHighMessage web_misc: HTTP.URI.SQL.Injection It seems that Firewall discovers and block malicious access.Now i disable ips on policy rule.How can enable it on this specific server?  

We currently have a dial-up SSL VPN configuration that requires a user to connect using both their Windows AD (LDAP) credentials AND a local computer certificate issued from our internal Windows CA.  On top of that, we use FortiToken with push notifications for MFA on the LDAP user accounts. With the recent push to migrate away from SSL VPN and switch over to using IPsec IKEv2 VPNs instead, I have not been able get the same requirements to work via IPsec. Our setup includes:FortiOS – 7.4.8FortiEMS – 7.4.3FortiClient – 7.4.3FortiToken  Subscription (not cloud)Windows NPS for RADIUS (not FAC) Is this even possible with the above?  Seems like it is supported, but I can not get it to work with NPS. According to the article below, I should be able to get FortiToken MFA push notifications working using local RADIUS user accounts:https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-RADIUS-and/ta-p/220818 …but as soon

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store). All of the Certificates mentioned above are still valid and not expired.&nbs

Model: ForitGate-50GI would like to assign the same IP range subnet to between physical interface and internal wifi interface:Lan 1: 192.168.1.1/27internal wifi: 192.168.1.1/27 by default system be return warning msg some Lan1 or wifi interface subnet used. as above case, does it should be add a FortiAP or switch device to solve it? 

Hello everyone,We need to replace our Sophos UTM and were thinking of doing so with Fortinet systems.Since we use quite a few Sophos UTM services, I'm wondering which Forti system I can use to map which services, or whether it's even possible to map all services.Here are the “services” I need to provide: Network ProtectionFirewallIPSVPN: IPSec / SSLReporting Email ProtectionEmail receptionVirus protectionEmail encryptionSpam protection (Quarantine , daily SPAM-report) Web ProtectionWeb-ProxyVirus protectionHTTPS-ScanningWebserver ProtectionWAF (Web Application Firewall) for On-Premise Exchange OWA access GeneralActive-Passive ClusterAD synchronizationReportingIs it possible to deploy all services with Fortinet?

Hi everyone, I’m having an odd issue with Minecraft and FortiGate and wanted to see if anyone here has run into something similar. I read this thread https://community.fortinet.com/t5/Support-Forum/Unblock-certain-game/m-p/390777/highlight/true and it reminded me of what I’m dealing with, but the solutions there didn’t quite fit my situation. When I try to join certain Minecraft multiplayer servers (especially public ones), the connection either times out or I get disconnected after a few seconds. Singleplayer works fine, and some servers connect without any problem, which makes it confusing. I checked basic settings like allowed ports and application control, and nothing obvious is being blocked. I’m wondering if FortiGate might be identifying some Minecraft traffic incorrectly or if there’s a specific profile or setting that usually causes issues with game traffic. If anyone has experience running Minecraft behind FortiGate, I’d really appreciate hearing