Solved

Hello Fortinet Community,I’ve configured two identical IPsec remote access VPNs on my FortiGate—each mapped to a different WAN interface for redundancy purposes. On FortiClient, I’ve added both VPN gateways. The issue I'm facing is that when I disable WAN1, FortiClient does not automatically failover to the second gateway. Instead, I have to manually reconnect by clicking "Connect" to establish a session with the secondary gateway. I'd like to know is it possible  to automate this failover process, so users experience minimal disruption? Is it possible to achieve automatic remote access VPN failover in FortiClient without using EMS?Thank you! 

hiI have a server configured as a vip in my fortigate to be accesses from internet. I want to block it's admin page. (my.domain.com/admin) . I tried the policy with deep packet and ssl inspection along with creating a webfilter and blocked *\admin* but still admin page reachable from internet. how can i block admin page?

Hello, everyone. I have a question. The client ZTNA has 1,500 terminals, and each terminal may have two USB mobile devices. The client's requirement is to release them in a whitelist manner. However, with so many mobile terminals, the workload is a bit large. For the mice of the same brand purchased in the same batch, information such as USB Type, Vendor ID, Product ID, and Firmware Revision is still different.I have several questions:Question 1: Is there any way to avoid manual entry one by one? The workload is too large. Question 2: Can the whitelist be released based on a certain brand? For example, HP and Dell mice, Panasonic USB drives.Question 3: For the control of such a large - number of mobile external USB devices, are there any other good suggestions?References:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-properly-identify-USB-devices-to-configure/ta-p/339955                          

Hello, We recently started migrating our SSL-VPN to IPSec. Something we just noticed is that the IPSec setup is not fully compatible for iOS version of FortiClientVPN application. FC VPN at its latest version for iOS devices supports IKEv1 only on Main Mode (we went with aggressive mode on our initial config).For remote users authentication we’re using a FortiAuth server that communicates with the firewall using RADIUS and to the AD Servers using LDAP. FortiAuth checks if the user exists on AD and then sends an authentication token to the user for 2FA. We started noticing that the last part with the authentication is problematic for FC v7.4.6 on iOS devices and after investigation with Fortinet they informed us that FC VPN on iOS rejects the authentication packets and drops the tunnel afterwards. For testing purposes, we disabled the 2FA option within the ForitAuth for the spesific user we login and the tunnel was able to connect succesfully without authentication j

Hi, We have two firewalls located in different locations: Firewall A and Firewall B. Both setups include an L3 device positioned between the LAN and the firewall. In Firewall A, the relevant subnet appears as directly connected, whereas in Firewall B, the subnet is marked as statically connected. This indicates that in the Firewall B setup, the switch acts as the gateway, causing the firewall to receive the MAC address of the L3 device instead of the end-user device. However, in the Firewall A network, even with the L3 setup, the firewall acts as the gateway for the subnet, enabling it to detect actual client MAC addresses and enforce MAC-based policies. Consequently, MAC-based policies do not function in the Firewall B setup because the L3 device serves as the gateway. In contrast, these policies work in the Firewall A setup, where the firewall directly receives the MAC addresses of the client devices.  FortiGate 

I generated a CSR on one of my Fortigate firewalls that contained over 10 SAN's entries, the certificate was signed by my internal company CA, I then imported the PEM into the Fortigate firewall successfully to use for HTTPS access, then by mistake I deleted the Certificate off the firewall instead of downloading the cert! My signed PEM file doesn't have a private key, I have a PCKS#7 cert, der and cer from my PKI team. But I do not have the private key anymore is my guess after deleting my imported signed Cert on the Fortigate. On another SAN Firewall where I need to install I import any of these signed cert formats, error is "duplicate mismatch" I gather because the signed cert doesn't have the private key and I should be downloading the imported cert from the Fortigate that imported the signed cert where the CSR was generated to the other Firewalls! Any there any way I can install these signed certs on my SANs Firewalls or do I need to generate another CSR again?&nbsp

I like to generate a weekly report that includes any active FortiGate-Policy filtered by some keywords in their name.I'm able to query them from $log-traffic, but obviously this gets only the policies with traffic.Is there a table that includes the configured policies regardless of them having traffic or not?

Hi , I'm Currently facing an issue with My Fortinac-VM i already Download the new version 9.4.7 but when i press install it's sending me to the page to start the download when i press it nothing happen any suggestion  

Hello,I have to go through the "Automatic Patch Upgrades" wizard each time I connect to my FortiGate. I am using version 7.4.6 of FortiOS.Does anyone know the solution to this problem?

Hello,I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.Could you please provide information on how automatic updates are handled in this setup?As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?I would like to perform updates manually when I want, and I do not want automatic updates to be applied.Is there anything that needs to be configured separately on the FortiManager side? Thaks all.

Hello, I have been search the posts here and I am seeing a few different replies to this.Can some one please clarify the reason for this error? One suggests Adding the ip hostname of supervisor to  /etc/hosts. Is that all that has to be done?   I still get the error when I select to down load to the client, does some DNS cache need to be cleared or something?  Another suggests In some of these cases we will need to see the error from the Collectors side. There are 2 locations for collector upgrade logs to find out why the collector failed : /usr/local/upgrade/logs/ansible.log /opt/phoenix/log/collector-upgrade.log  we will need to see why Your have 3 options 1- Spin up a new collector in the customers environment with the build that we need This will bypass the upgrade all together and just spin up a new collector and provision it as the same hostname and IP as the old one 2- A

FortiClient 7.4.3.1736 has no reaction after set username, password and click on Connect. In forticlient-logs/confighandler.log are messages as:20250428 16:00:13.520 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:13.644 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:30.087 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:31.506 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:57.295 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250428 16:01:01.375 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:01:29.

Hi, just wanted to point out an spelling Error in the second image of the guide from this link:https://docs.fortinet.com/document/fortiextender/7.6.0/admin-guide-fgt-managed/201700 The image shows a FortiGate with the description ForitGate. This has been the way since 7.0.0 till 7.6.0. Version 7.6.1 uses a new image without the spelling error.Old:New:   

I opened a ticket on this but maybe this will be faster...  I am running FortiClient 7.2.4.0850 on a MAC runing macOS 14.5.  But I also have a need to run CloudFlare WARP once a week.  But the logs for WARP show that the ztagent is running and that port 53 has been redirected to the Fnet app. I do not currently have ZTNA setup at all in FortiClient.  But regardless, there must be a way to shut down the client fully for a short time so I can run WARP for a few hours a week.  When I do try to shutdown the forticlient processes they auto restart on my MAC. Does anyone know if there is a way to kill them off for a few hours then manually start them up?  And yes I am connected to an EMS. 

Try to config ZTNA Shortcuts on SASE end point already integrated with Entra ID. Need clarify  config user samledit "saml_ztna"set cert "Fortinet_CA_SSL"set entity-id "https://fgt9.myqalab.local:7831/samlap"set single-sign-on-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/login/"set single-logout-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/logout/"set idp-entity-id "http://MYQALAB.LOCAL/adfs/services/trust"set idp-single-sign-on-url "https://myqalab.local/adfs/ls"set idp-single-logout-url "https://myqalab.local/adfs/ls"set idp-cert "REMOTE_Cert_4"set digest-method sha256set adfs-claim enableset user-claim-type upnset group-claim-type group-sidnextend The entity-id single-sign-on and single-logout URLs from SASE and  idp URLs from SMAL authenticator ( In My case it's Entra ID )  i follow below guidelines https://docs.fortinet.com/document/fortisase/latest/spa-using-ztna-deployment-guide/976373/configuring-authen

Hi FortiSIEM Community,I have a question regarding the requirements for High Availability (HA) and Disaster Recovery (DR) setups in FortiSIEMMultiple Instances Requirement: Is it correct that both HA and DR require more than one FortiSIEM instance? Specifically, can HA or DR be configured with just a single FortiSIEM instance, or do they both necessitate multiple instances?Thank you for your assistance!

When I tested it through FortiVPN with a Windows 10 laptop, it worked fine, but when I tested it through FortiClient with a Windows 11 laptop, it didn't work.It is the same environment except that Windows 11 laptop has EMS interworking as FortiClient.What is the problem? 

I can't add any FGTs to my FMG within Eve-NG, debugs are showing it to be a SN issue, found several post to do below, but I don't seem to have that option on 7.4.6 The fix is to disable cert check:FMG-VM64-KVM # config system global(global)# set fgfm-peercert-withoutsn enable Any help would be greatly appreciated? Thanks

Hi everyone.I would like to display antivirus log in my Fortigate F60 (OS 7.2.11).In the forum I've noticied that I have to set the value "av-virus-log" to enable.In the CLI, I've edited the profile and I've entered the command "set av-virus-log enable".But there is no impact, when I want to show the different value of my profile, the value does'nt exist.Have you an idea ?Thank you in advance  

Hello everybody,regarding ZTNA, we found a bug after yesterday Forticlient EMS 7.2.5 upgrade.This is happening only on macOS devices.We have a ZTNA destination profile:On Windows device, rule are correctly retrivied. But, on macOS, I can see no destination (I have all the tags I need):Debbuging this problem, I was looking at the Forticlient ztna.logs, and I found (I removed some rules for simplification): 2024-10-11T16:24:28.238 TZ=+0200 info ztna mergeCfg:{"enabled":1,"rules":[{"name":"EMS","mode":"transparent","enabled":0,"destination":"10.1.0.217:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"},{"name":"VMAgostini","mode":"transparent","enabled":0,"destination":"10.1.0.215:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"}],"portals":null,"gateways":null,"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-10-11T16:24:57.148 TZ=+0200 info ztna sync portal select portal err:e

Hi Team,Is there a way to enable Interface Pair View on a FortiGate 121G without removing the existing policies? From what I’ve found, it seems that enabling this option via CLI may result in the deletion of current policies.I’d appreciate any guidance that would allow this without impacting the existing configuration.

Hello FortiSIEM Community,I have a couple of questions regarding the upgrade process to FortiSIEM version 7.3.2 Where can we download the upgrade package "FSM_Upgrade_All_7.3.2_build0374.zip"?I understand this package is required for the upgrade, but I would appreciate guidance on the exact location or steps to download it.Upgrade Process Clarification:The Fortinet documentation mentions that the Supervisor and Worker nodes should use the same package for the upgrade. Does this mean that once we upgrade the Supervisor, Worker, the entire FortiSIEM system will automatically be upgraded to version 7.3.2?Ref: Upgrading to FortiSIEM 7.3.x | FortiSIEM 7.3.2 | Fortinet Document Library Thank you in advance for your assistance and insights!

Hello,I have a request regarding license renewal.I’ve received two new Contract Registration Codes for renewing licenses — one for a FortiGate and one for a FortiSwitch device.These devices were already licensed previously, and now I need to renew them.As I understand it, for FortiGate, the process is:System → FortiGuard → Enter Registration CodeIs that correct?As for the FortiSwitch, it is managed through the FortiGate.How should I apply the license in this case?Do I need to register it separately, or is it handled via the FortiGate interface?I would appreciate your guidance on the correct steps.Thank you in advance!

Hi everyone, I have a question regarding how FortiGate handles override of blocked categories in Web Filtering. Let me explain my setup:I have Web Filtering enabled with a custom profile where the "Streaming Media and Download" category is set to block. The goal is to allow certain users to override the block and access specific sites within that category after authentication.To do this, I enabled "Override blocked categories" and assigned the built-in monitor-all profile. Inside this monitor-all profile, I kept "Streaming Media and Download" set to block, but I also configured a URL Filter exception, where I added a wildcard like *youtube.com and set the action to "exempt".The expected behavior is:When a user tries to access YouTube, the override page should appear.The user logs in with credentials.Due to the URL Filter exemption, access to YouTube is allowed.All other sites under the "Streaming Media and Download" category remain blocked.However, this doesn’t seem to work as intended

 hello,i have problem with my vpn ipsec i tried to connect to vpn but i have error during phase 2   and on wireshark i'm stuck at here same on forticlient log,  i have no idea why config :same auth-encryption for vpn settings and client good selectors for phase 2 ( src and dest addresses  ) why quick mode failed ? i can share log from CLI thanks