Solved

Hello, i created a Test-LAB with FortiManager v7.6.6 build3654 (Mature) VM Trial licensed and FortiGate v7.4.11 build2878 (Mature) VM Trial licensed. Now ill try to Join my Gate into my Manager and got the Error. I checked with the "Compatibility Tool" and it looks good for my Case. I use Windows 11 Pro with Hypedr V and booth VM Imgaes are HyperV from Download Center. The Screenshots are attached. Thanks for help. I tried a lot of proposed solutions FortiGate = 192.168.178.241FortiManager = 192.168.178.240  Log Spoiler (Highlight to read)ConnectedFMG-VM64-HV # diagnose debug application fgfmsd 255fgfmsd debug filter: disableFMG-VM64-HV # diagnose debug timestamp enableFMG-VM64-HV # diagnose debug enableFMG-VM64-HV # 2026-02-23 05:41:29 proxy_session.c,__session_frontend_accept,833: 192.168.178.241:1156 -> 192.168.178.240:541.2026-02-23 05:41:29 __use_cert,734: start idx = 02026-02-23 05:41:29 use certificate issuer = /C=US/ST=California/L=Sunnyval

Hello guys, What will happen to my fortimail once licenses expire?Will it be able still to send/relay emails?What about protection, antispam, content and URL filtering? Thank you in advance.

Hello,I am currently working with FortiManager Cloud (7.4) and FortiGate devices running in multi‑VDOM mode.I would like to know whether it is possible to hide or exclude specific VDOMs on FortiManager Cloud, so that:they are not visible in the Device Manager,  they do not consume a device / VDOM license, while still existing on the FortiGate (i.e. without deleting the VDOM on the device itself).From what I understand so far, it looks like:all Traffic‑type VDOMs present on a FortiGate are automatically visible in FortiManager Cloud, each of them is counted as a managed device/VDOM for licensing purposes, and there is no supported way to “unmanage”, hide, or exclude a single VDOM only on the FortiManager Cloud side.Can someone please confirm whether this is indeed not possible on FortiManager Cloud today?And if so, is there any official Fortinet documentation or statement that explicitly confirms this behavior or limitation?Thanks in advance for your clarification.Best regards,B-W

So i've recently acquired two FortiAP-221c's with POE injectors and I am having a little bit of trouble finding out what seems to be simple information. Maybe one of you can help me out. If I were to put one (or both) of these AP's in my home, what would I NEED to make them work. Is a Fortigate required because of the built in Wireless controller? I know they need to be authorized to enable the antennas, is a fortigate or VM software the only options I have?

Hello, I have a 40F.Default config has a virtual hardware switch called "lan" whose member interfaces are: "lan1", "lan2" and "lan3".I would like to remove those member interfaces from the "lan" switch using Ansible. Do you know how to do that ? https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_system_virtual_switch_module.html#examples I tried the tasks bellow, leaving the port empty, but no success.If I specify just one port, like lan1, it removes the others. I need to remove them all. task1- name: Remove member interfaces from "lan" virtual hardware switch  fortinet.fortios.fortios_system_virtual_switch:    vdom: "{{ vdom }}"    state: "present"    system_virtual_switch:        name: "lan"        port: task2- name: Remove member interfaces from "lan" virtual hardware switch  fortinet.fortios.fortios_system_virtual_switch:    vdom: "{{ vdo

Hi Everybody,I just installed a new Forti Client EMS 7.4.6 installation with a trial license on VMWare.EMS is nicely setup, using a signed cert etc.Now when trying to make a installer package i'm unable to do that.According to the documentation and EMS training I should be able to select between "Create installer " and "Create installer config" but don't get that option.It just let's me go through the creat installer wizard and at teh end I just can do a "download".Is it something i'm doing wrong or is it some bug/feature on a newly released version (released at 17-3-2026) as usual with FortiNet? referenced documentation was the ems 7.4 training and the EMS 7.4.6 quickstart guide: https://docs.fortinet.com/document/forticlient/7.4.6/ems-quickstart-guide/942839 Kind regardsRoger Beurskens

I have performed multiple FortiEMS upgrades over the past year,s tarting from 6.4.7, and the FortiEMS server version was always the same as the Forticlient installer package version.That is not the case with 7.4.7. The installer package version is 7.4.6.I find that confusing..Is an installer package 7.4.7 in the works?

Good day,Trying to install fortigate on ProxMox but unable to do so. I followed the install guide but when the VM is started it gets stuck on formatting disk screen. any help would be great.  

How do i find the status of All VPNs in FortiAnalyzer ?

Hello everyone,I am currently experiencing an intermittent connectivity issue affecting multiple macOS devices in our environment.The devices connect successfully to the WiFi network through FortiAP units (mostly model 231K). However, after some time, they suddenly lose network connectivity and internet access, even though they still appear as connected.From the FortiGate perspective, the affected devices are still visible under the WiFi Clients list, but they are unable to pass traffic properly.We have already performed extensive troubleshooting, including:Reviewing logs and event records on the FortiGateOpening a ticket in TACTesting different configuration adjustments on the SSIDModifying FortiAP operational profiles and performance-related settingsDespite all these efforts, the issue persists.It is also important to highlight that this behavior has been observed across different MacBook models, which suggests it is not hardware-specific.Has anyone experienced a similar issue with m

I've followed the instructions in https://docs.fortinet.com/document/forticlient/7.2.0/new-features/792170/entra-id-integration-7-2-1 and ended up creating 2 separate Enterprise Applications where one was used to configure the Client Secret (for the Administration > Authentication Server), and the other was used for the SAML URLs (for User Management > SAML Configuration). While this works, and I am able to register FortiClients by authenticating against Entra ID, I wonder if I did it  correctly. Could this have been a single Enterprise Application? Or if not, and they had to be separate, what is the Enterprise Application with the Client Secret used for?And what is the Enterprise Application with the SAML URLs used for? Also what is this?To configure the Azure tenant app for initiating passthrough (domain):Is this an alternative to registering an Entra ID user's endpoint to EMS using SAML (which is my goal)?

Hi all,I currently have the following setup:FortiManager Cloud → FortiGate → FortiLink → FortiSwitchAll configuration is pushed via FortiManager templates.What would be the best practice to safely remove a FortiSwitch from the FortiGate in this scenario? Thanks.

FortiVPN client is compatible with MacOS Tahoe 26.4? I tried install but getting below error. 

Hello team!!! Some time ago I asked some questions here about FGT-Entra ID synchronization using SAMLNow finally I could make it work with Fortinet Support.Just 1 question about this:When the user will be prompted to enter credentials again? I tried restarting the Client OS and the credentials were not asked, just were asked the first time I tried to navigate. Thanks in advance.Regards,Damián  I just tes 

Hello, in one of our branches we have this FG60F cluster and we have problems. It is a critical one, not more than 20 users but it is a warehouse with antennas and we need 24x7. Some months ago it entered in conserve mode and we dont really know what the people there did, but we had problems to get the HA working again. After that we deactivated IPS, SSL, etc. and some other memory issued configurations but at the end we updated the cluster to 7.4.5 and after that the memory usage in general was much lower. We checked and it was always between 50-55%. This morning it happened again and right now they are using the slave unit (we dont know yet what the guys did). I wanted to check System Events in Forticloud since we removed local logging but I dont see any information there for the master unit. Any suggestions? It seems crazy that we use a cluster and with this conserve mode issue we loose basically both FGs. Thanks! 

Hello everyone, I would like to know what's the network's behaviour when FortiNAC is down (unrecheable) or doing a firmware upgrade ? Are the users stuck in the isolation VLAN or the behaviour is as if FortiNAC never existed ? Is FNAC 7.2.7 version stable, or should I upgrade to the latest versions 7.6.x ? BR,

Hi everyone! We have an existing FG 501E which we'll be decommissioning in a few weeks. We plan on replacing it with FG 100F. In order to lessen the risk and errors, I plan on backing up the old firewall config and just restore it to a newly factory-reset FG100F.However, our existing 501E has Global, and 2 vdoms(including root). On the 100F, we plan on NOT using a vdom. Just put everything in global configuration. Question:1. Is it possible to backup and restore this properly?2. Is it possible to not use a VDOM and just put everything in global config?

Hello,I would like to understand the behavior of the network when FortiNAC becomes unreachable or stops (service down).In this scenario:What happens to the access ports on the switches?Do they fall back to the default VLAN automatically?Are already authenticated endpoints still allowed to communicate, or are they impacted?Also:What are the best practices or recommendations to handle this situation?Is there a way to ensure continuity (fail-open vs fail-close behavior)?Any feedback or real-world experience would be appreciated.Thank you.

Hi, we want to create a site-to-site VPN via Fortimanager, but don't want to enable VPN community. Is the following procedure correct? our Fortimanager os version is 7.4.x. 1. login to Fortimanager Device Group2. choose the firewall 3. click VPN  and choose interface mode4. create phase 1 5. create phase 26. install the config via installation wizardCan anyone please help to advise? Thanks in advance!  

Working on a FortiManager–FortiGate integration scenario and observed an interesting behavior — looking for insights from the community.I configured the following directly on FortiGate:Firewall policiesAddress objects & groupsStatic routesPrefix listsRoute mapsEverything works perfectly on the firewall.However, when I perform “Import Configuration” into FortiManager:Policies, objects, and static routes are imported correctlyPrefix list and route map names appear, but their entries/content are missingOn the other hand, when I perform a “Retrieve Configuration”, I can see the full configuration including prefix list and route map entries.So the questions:Why does FortiManager import process not fully bring in prefix list / route map configurations?Is this expected behavior (device-level vs policy-level separation), or a limitation/bug?What is the recommended production approach to manage routing objects like prefix lists via FortiManager?Would appreciate insights from anyone who has

Hello There,1- I have been facing an issue with IPsec and need your opinions plz.i have sdwan zone with 5 wan links for internet, site-to-site is configured binding wan1 and works fine, once i confure ipsec-remote vpn on wan1 it works fine too but site-to-site goes down after some time and does not come up unless i completely delete the remote vpn.2- I decided to setup remote vpn on another wan link to avoid any possible conflict having at wan1, but remote vpn does not work at all at WAN2 or WAN3, even though the sdwan rule also created for port 500 4500 via wan2-wan3.

Hi everyone,I’ve deployed an IPsec dial-up VPN to allow users to connect via FortiClient.The VPN uses IKEv2 and a RADIUS server, and all users belong to the emergency group.After configuring FortiClient with all the correct phase 1 and phase 2 parameters, I consistently get the following error when trying to connect:"WRONG CREDENTIAL EAP FAILED CONNECTING TO 8.x.x.x"Below I’ve included the phase 1 and 2 configuration, along with the log captured from the FortiGate.The log clearly shows that the user is correctly identified, as well as their group membership.However, shortly before the error, this message appears:ike V=Vpn:1:Emergency:1804 EAP 14757603831873 result FNBAM_DENIED ike V=Vpn:1:Emergency: EAP failed for user "jjonh"Phase1 configuration:edit "Emergency"set type dynamicset interface "WAN"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 8.8.4.4set proposal aes256-sha256set dpd on-idleset dhgrp 14set eap enableset eap-identity s

Due to a recent vulnerabiliy reported on 7.4.9 i need to upgrade to 7.4.11 but in the fortigate GUI unders system firmwares i can only see upgrae to 7.4.10 available. However on the support portal 7.4.11 image is available for download ?  Does this mean 7.4.11 not recommended for upgrade ? why it is not showing in upgrade path 

Hello everyone,I’m encountering a strange behavior with my FortiNAC architecture (v7.4.2) running in Layer 3 mode. Everything was working perfectly for months, but suddenly, the VLAN assignment logic seems broken.My Setup:FortiNAC Version: 7.4.2Mode: L3 with Registration VLAN activated.DHCP: Pool declared directly on FortiNAC for the Guest/Registration scope.Switch Configuration: Standard Radius config applied to the ports.Port Group Membership: Initially, only "Role-Based Access" was checked.Troubleshooting attempted: To mitigate this, I recently had to check "Forced Registration" in the Port Group Membership settings. However, I never needed this before; it used to work perfectly with only "Role-Based Access" enabled.Question: Why did the default behavior change? Has anyone seen a bug in 7.4.2 where unknown hosts bypass the Registration VLAN and get Production access by default?

Hi,I'm configuring my first Fortinac.I have a problem whit switching vlan. When I plug on switch an pc  Fortinac receive snpm trap but the switch to isolation vlan is done after 40/50 seconds about.So pc get IP of production and after switching VLAN it don't get a IP of isolation subnet until I do ipconfig /renew.here what I see on switch:Aug 28 15:06:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to upAug 28 15:06:59: %SYS-5-CONFIG_I: Configured from console by admin on vty1... Could you help me? Thanks in advance