Solved

Hello team!! I hope you are doing well!!We have 2 Fortigates 100F in HA with many IPsec VPNs for FortiClient users.Just one user has a problem to connect from his house.  When he use another internet connection in the same computer this works fine but with his own ISP sometime does it fails (Sometimes work also)When this fails, I can see the following logs on Fortigate: date=2025-09-11 time=12:38:58 eventtime=1757605138121774900 tz="-0300" logid="0101037134" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec phase 1 SA deleted" msg="delete IPsec phase 1 SA" action="delete_phase1_sa" remip=RemoteIP locip=LocalIP remport=18052 locport=4500 outintf="port9" cookies="b77cf798b4edb960/b7f28e5eae0677b7" user="1011" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="IPsec-IT-W3" fctuid="N/A" advpnsc=0date=2025-09-11 time=12:38:38 eventtime=1757605118948074500 tz="-0300" logid="0101037127" type="event" subtype="vpn" level="notice" v

Hi Folks, I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.I hear anecdotally that others using regular Firefox are not experiencing this issue either.I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes.  Any thoughts? I'm at my wits end a bit here.I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place

Hello,I am configuring FortiNAC to work with RADIUS authentication, but I haven’t been able to find anywhere a complete list of available RADIUS attributes.Additionally, when setting up devices for EAP-TLS authentication using certificates, I noticed that NAC allows the use of “pseudo-attributes” such as TLS-Client-Cert-Common-Name or TLS-Client-Cert-Subject-Alt-Name-UPN, and so on.Is there a full list of all available attributes?When I open the dropdown menu, it only shows the first 10 attributes starting with “A.”If I type “TLS” and open the dropdown, it doesn’t show these pseudo-attributes either. Any guidance on where to find a complete list of supported RADIUS and TLS pseudo-attributes would be greatly appreciated.Thank you!

I have deployed FortiNAC in HA mode. And use its radius server to authenticate users when they are login to the network devices. When the primary unit is active user can login using their name and password only. However when secondary unit become active users should include name@domin name to access it. Can someone explain wh

Hi,I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.I'm reluctant to use this method. Is this a well-known workaround?Do you have any advice on a better way to handle this? Hardware: FortiGate 120G OS: 7.4.8Thanks,Kenji

If the Fortigate have multiple vdom, can we directly enter to the vdom global without issuing 'config global'?Currently when i ssh to the fortigate i must enter that command first before i can execute 'get system global'

I currently have two FortiGate 60F devices running in an active-passive HA pair. I am monitoring the active device in N-Central via the management IP, but I am wondering what is the recommended method to monitor the standby unit as there is not a management IP of the standby device. I was planning on monitoring fgHaSystemMode (OID: .1.3.6.1.4.1.12356.101.13.1.1) via SNMP and querying against the OID to ensure that the value of this 3 to match active-passive as I will know if the passive device is down if this value is either standalone or active-active. Currently we are only monitoring the active device so we would not be aware if the secondary goes down 

Hi,We are preparing to migrate from FortiClient EMS 7.2.10 to 7.4.4.We deployed EMS on a Hyper-V VM.Copy/Paste doesn't work in EMS CLI 7.4.4.How can I enable the clipboard functionality? 

Hello,We have an HA pair of FortiGate VM04s in our Azure development environment that we are using to test for a redesign. The FortiGates were built with the "ELB/ILB Sandwich", as Azure/Fortinet documentation outlines. We also have a GLB placed in front of the ELB, in order to gain the flexibility a global IP provides. The backend IP of the GLB is the single ELB public IP.We have tested the following successfully:- We can terminate an IPSec VPN to the ELB, directly connected to the two outside FortiGate vNICs- We can terminate an IPSec VPN to the GLB However, we have not been able to successfully terminate separate VPN tunnels to the GLB and ELB simultaneously. The ability to do so would greatly ease our cutover process, as we currently have a standalone FortiGate-VM in production with a regional IP and dozens of vendor IPSec tunnels terminating to it. If we can prove that it's possible to terminate to the GLB and ELB simultaneously, we can slide our production regional IP over t

Hi i have a problem to ativate double stack for  vpn ssl   config vpn ssl settings set dual-stack-mode enable end Response in cli mode   set dual-stack-mode enableTo enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.node_check_object fail! for dual-stack-mode enable    I have only one vpn policie. do you have an idea ? Regards

Hello, I’m looking for a 10G Single mode SFP module to connect a switch and Fortinet routers over a short distance (around 2–10 meters). Could you recommend the right option?Best regards,

Hi, I have a new deployment for FortiGate as an edge firewall. The latency design involved DC FW acting as both DC and Edge. Now I will implement Fortigate as Edge and do point-to-point with DC FW. The Q is. I do have:- one Internet link with 2 IPSec over the Internet link.- 2 MPLS links. One to Cloud servers with paloalto fw, second for my 10 Fortinet branches. For the internet, I will have only 1 link. And over that will build 2 IPsec (One to be a Load balance SDWAN with MPLS to my branches, Second to be a passive link with MPLS to my cloud service). What is the best practice to build that topology? Should I add all three 3 WAN interfaces under the SD-WAN Zone, and with that ZONE create 2 IPSec? Or I have to keep the 3 WAN interfaces without SDWAN zone as normal WAN interfaces, as there is no Load balancing except the connection with branches. Then create SDWAN for IPsec. Kindly for advice for the best practice solution.

Hello community,Since I have configured some mail alerts with the automation in our FortiGate-VM I noticed that the "High CPU" message gets triggerd every day exactly every 8 hours (0:00; 8:00; 16:00). But the cpu spikes only for a very short time, since I don't even see the spike in the CPU widget or GUI process monitor.I tried configuring the generation of the local reports to other times than those 3 times with the CPU spikes, but it still happens.I also looked at the times where IPS and AV database updates (setting is automatic), but it never was at those times from the CPU spikes in the last weeks.Also rotation of logfiles only happens at 0:00 so this does not explain the other times from the CPU spikes. I also run some CLI commands for monitoring the system performance, when a mail alarm is sent, here is the output from it:========== #1, 2025-08-14 08:00:07 ========== FW-SAAS config global FW-SAAS (global) get system performance status CPU states: 83% user 14% system 0% nice

hello, I need to restrict IPSEC VPN I need to connect only from UAEI Make this step but problem when I connect VPN (connection fine but no data send for example I cannot ping to any server or pc or login to FortiGate).

I'm preparing to migrate from FortiEMS 7.2.10 to 7.4.4 in a test HyperV environmentI've downloaded and configured version 7.4.4. I don't have any Linux knowledge.Now I want to perform the migration steps.But I'm getting the following error during the first command:Error: unknown command "sudo" for "emscli"How can I enable sudo? 

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.I am at a bit of a loss at what else to look at.

Hi, while configuring Tier 1 (Core) and Tier 2 (Distribution )FortiSwitch. I want to test 2 device ping each other, with the same vlan (for example VLAN2). Let say I don't want to mind the FG, only the L2 first. Do I need to set the VLAN2 with IP address to the Tier 1 (Core) and Tier 2 (Distribution) or it will work even if I set only to Tier 2. Thanks

The upgrade order is 7.2.8 > 7.2.9 > 7.2.11, but I accidentally guided the upgrade to 7.2.11 right away. Is there anything that could be a problem? These are 101F and 61F. Thank you

I am looking for assistance getting a multiple IPsec tunnel configuration working on a single WAN IP. Utilizing IKEv2 for Entra SAML authentication.  I have two IPsec configurations, each are configured the same with the exception of PSK and Local ID. Forgot one other note: The second tunnel is configured to use IPv4 Split-Tunnel. I can successfully connect to the "primary" one or the employee one I setup first. As long as my PSK/Local ID and DHG/Encryption in my forticlient is set correctly it authenticates and connects. If I attempt to switch to the Vendor intended tunnel and use that configuration, I get through Entra Authentication and it hangs and fails to connect.  Details120G running v7.4.8Using Forticlient free v7.4.3.1790 Hoping someone can point me in the right direction of what I am missing. I was really expecting the Local ID to make this simple to configure. I have tried changing Encryption & DH groups on the second tunnel phase1/2 (o

Hello. I am standing up a FortiClient #EMS ppliance for the first time, and I have somewhat limited experience with Ubuntu. Our platform is Hyper-V.  The vhdx was properly installed and booted.  I was able to login with user 'ems' and successfully changed the password. So far so good. However, it seems to me that after login, I am now in the 'bash shell', and the instructions for configuring an IP, seem to be based on being in the terminal. None of the commands available in bash seem to allow me to do this. And the instructions here don't work, as they are for terminal.  I tried "execute ls /etc/netplan" but it told me "folder /etc/netplan is not accessible" Can you please help me configure IP? I imagine once that's done, we can ssh into the terminal or maybe even a webpage? Deploying EMS as a VM image | FortiClient 7.4.4 | Fortinet Document LibraryConfiguring the VM IP address by modifying Netplan configuration filesTo configure the VM IP addres

Hello I am installing fortiSIEM 7.3.1When I try to access the gui, it fails with error below"Proxy ErrorThe proxy server received an invalid response from an upstream server.The proxy server could not handle the requestReason: Error reading from remote server"

Hi all,Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?Thanks in advance RegardsFrédéric 

I have a TRUNK-LAG configured for Aggregate mode. This interface contains VLANs 40–48. I want to add VLAN 49 as tagged on the TRUNK-LAG and untagged on SWVL-49. How can I do this?   

Hi, we changed to a FGT90G cluster and we have to change from SSL VPN to IPSec. We are running 7.4.7 and I think it will be the last image with SSL activated. We only used SSL VPN since it seemed easier to configure with different Groups, etc. Now trying to do the same with IPSec we have several problems. Our IPsec configuration:>In the IPSec Client Address range we used another range than SSL VPN (X.X.X.50-100 and IPSec X.X.X.150-X.X.X.200.>We enable Enable IPv4 Split Tunnel and define in Accessible Networks ALL since we want to have access to the LAN and also the MPLS networks>In XAUTH  User Group we have INHERIT FROM POLICY to use the same user groups we had before with SSL VPN Now our problems:> With the Forticlient 7.2 we cant connect, the client shows connecting but nothing happens. Also in the FG I dont see any information about the IPSec access. With older versions, I tried a 6.4 the connection works. > Since SPLIT Tunnel i

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?