Solved

Hello,Seems we are forced to move from SSL to IPSEC VPN so we are actually trying it on our FTG901G v7.4.9Our authentication is direct from the fortigate to Active Directory (ldaps)It is working since we activated EAP-TTLS thank's to this trick : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-EAP-TTLS-for-IPSec-IKEv2-tunnels-in/ta-p/408602 BUT, it is not working when we add a FortiToken on the account I saw on this page that 2FA is supported from client v7.4.4 with IKEv2 ldap users : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Overview-of-compatible-IKE-versions-user/ta-p/420733The little stars lead us to this Technical Tip and this Special Notice which explain that there is no free version of the 7.4.4 Forticlient, BUT the 7.4.3 free VPN-only agent is supposed to do the same job : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multi-Factor-Authentication-support-for-Windows/ta-p/407272https://docs.fortinet

Hi,I am looking for older version of FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks,

We use LDAPS to check users belong to an AD group in our explicit proxy policies. Ever since we replaced our domain controllers with Server 2025, users receive a pop-up saying proxy authentication is required. We use regular bind type, with our AD CA's certificate. This test OK, and diagnose debug application fnbamd -1 shows the certificate working.The CNI is cn, but I've tried using sAMAccountName and uid. Looking in Event Viewer on the DCs, I see lots of event id 1216 and 15351535Internal event: The LDAP server returned an error.Additional DataError value:00000003: LdapErr: DSID-0C060666, comment: Error decrypting ldap message, data 0, v65f41216Internal event: An LDAP client connection was closed because of an error.Client IP: <ip of firewall>:17943Additional DataError value:3 The system cannot find the path specified.Internal ID:c06065f I briefly tried disabling ldapserverintegrity and LdapEnforceChannelBinding on the DCs to see if that was the cause, but no cha

Do I need an Advanced Bot Protection (ABP) license to enable biometric-based bot protection on FortiWeb?

Hello,            I downloaded FGT_VM64_KVM-v7.4.11.M-build2878-FORTINET.out.kvm from the Fortinet site but only thing in the extracted folder is the fortios.qcow2 file (103mb). Why doesn't admin or maintainer login work? I can't activate the free  license or activation via web on VPC in Eve-ng . I dont know the ip of the firewall to even try.  Could that be why I am not getting login info because wrapper.txt.is missing?  I am unable to login to get to the web gui to activate license.    Any help will be appreciated.

Hi Folks,Quick question currently running FortiSIEM 7.2.5 and planning to perform content updates via the GUI.Before I proceed, just wanted to double-check the best practices:Is taking a normal VM snapshot sufficient as a fallback?Or are there any specific prerequisites/recommended steps I should follow before doing content updates? Thanks in advance

Hi,my network has a fortinet fortigate 200F firewall and active directory with windows server 2019 (DHCP and DNS) and is connected to the Internet via two different ISPs (A and B) with their respective routers/modems configured for load balancing. There is also an external web server connected to ISP A with a static IP. The ISP A router/modem is a netgate pfsense configured so that the web server uses public IP 1 for external connections (from the Internet) and private IP 2 for internal connections (LAN). Connections to the web server work fine from the external network, but from the internal network I am experiencing a potential DNS Rebind attack issue. After some research, I think this is due to the fact that sometimes internal connections use ISP B, which is the one that does not manage the web server.So I wonder what is the best way to force the firewall to route all internal connections to the web server URL to ISP A (excluding ISP2). Where can I find a guide?Thank you.

Hello, Is it possible to customize the mail that will be sent to the user as soon as I provision a token to him? I didn't find an answer for that in the doc or this forum. Thanks in advance!

Hi everyone,I have a design question regarding connectivity between two FortiGate HA clusters.Currently, I have two FortiGate clusters configured in Active-Passive (A-P) mode. Instead of directly connecting the clusters, both are connected through a Cisco Core switch (Layer 2) using aggregated interfaces (port-channel). Under these aggregate interfaces, multiple VLAN subinterfaces are configured.Only one cluster (FG1101E) has a public IP address and is responsible for Internet access.The other cluster (FG100E) does not have a public IP and must route Internet-bound traffic through the FG1101E cluster.Additionally, some VLANs on both clusters need to communicate with each other (inter-VLAN/inter-cluster traffic).Given this setup, I am considering two design approaches:Assigning IP addresses from the same subnet on the aggregate interfaces of both clusters and using static routes.Running OSPF between the two clusters for dynamic routing.My main goal is to simplify routing, reduce the num

There is no EOS date for 601E equipment on the support site, is it still not decided?

I'm deploying an SD‑WAN configuration with BGP over loopback across my infrastructure.Some spokes have only one WAN link, while others have two.After configuring the dial‑up VPN on the hub (which only advertises the 10.200.0.0/16 network), and after creating the loopback interface used for BGP and the loopback used for health‑checks, I proceeded to configure the spokes.Unfortunately, I ran into the following issue on the spokes that have two WAN links.After creating the SD‑WAN rule that instructs all LAN traffic destined for the hub network (10.200.0.0/16) to use the VPN with the best latency, and after correctly configuring the SLA targets, only one of the two VPNs is detected as UP in the SLA targets.The second VPN never shows as UP.From my checks, it seems that only the first VPN is considered UP, because it is the only one responding to the SLA target ping.This makes me suspect that there may be a missing configuration command related to BGP or VPN on the spokes.Below is the config

Hi, Since my upgrade from 7.2.9 to 7.2.10, I encounter somes difficulties to access certains parts of the GUI.I reach access to the firewall after a lot of time (5 minutes).I can't upgrade to 7.4.X because the GUI crash too (No upgrades available).Is there any way to solve this problem ? (Probably WebSocket). Best regards 

Hey,we have FortiClient EMS (Linux) running at version 7.4.5 build2111 (Mature)And recently we installed a small independent elasticsearch cluster that's only supposed to get the FortiClient Endpoint Events. The FortiClient EMS Administrator Guide is not helpful at all at explaining how to get EMS to connect to that elasticsearch cluster. It keeps complaining about the CA certificate:2026-03-18T15:07:43.445Z ERROR service/event.go:103 create indices: create all indices: check if index forticlientems_alerts_745-write exists: an error happened during the Exists query execution: tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") I used the emscli to give it the proper parameters including a path to the certificate, imported it to the ubuntu trust store and tried every possible way I can t

Probably since thursday when our VPN (Forticlient 7.0.7.0245) is connected we have assigned local DNS but when trying to access or ping some internal services/servers it doesnt resolve. Tried using command below and got our local DNS serverscutil --dns | grep 'nameserver\[[0-9]*\]'when I use nslookup with hostname it also does resolve to IP. Any ideas what could be wrong? Thanks,

 Hello,I’m currently working with SD-WAN over IPsec, using a FortiExtender (FEX) with LTE connectivity.Since LTE does not provide a static default gateway, I’m unsure how to properly configure the “Local Gateway” setting.What should be defined in the Local Gateway field in this scenario?Thanks in advance.

Hi!Issuing "execute fmpolicy print-adom-package ..." does not present an option to see "CLI Template". Is it possible using CLI?Thanks!

I am trying to figure out how to add a web server certificate to Fortiems 7.4.5. to be used as the web server cert and the forticlient certificate. There are 3 options, Lets Encrypt, PKCS12 and PEM. I would like to use PKCS12. I use an outside vendor for this purpose. There does not appear to be a way to create a CSR on the FortiEMS server. There is not access to the Ubuntu server running on the backend. (using fortinet image). Its fully locked down. I thought we had to create the CSR on the server being used for Fortiems. So I tried creating the CSR using Openssl running on Windows 11. I was able to upload the CSR to the CA and then was able to download the certificates. 1. Do you need root, intermediate and server cert to create a single .pfx file for upload as PKCS12? Or do I only need the intermediate and server cert.? 2. IN what order should the certs appear in the PFX file? 3. For creating the CSR, what are the mandatory items required, common name. city,

I try to follow guide from 1. Generate TLS certificate for Microsoft Entra ID to do authentication | FortiNAC-F 7.6.5 | Fortinet Document Library to generate EAP-TLS from intune.In Method 2 Step 2 why i got error when Subject Name Format i fill to CN={{UserPrincipleName}} and the other attribut also have same error.Also whay i must fill in certification authority and certification authority name? 

I would like to have some informations to move reperedestempliers.fortiddns.com dyndns domain actualy on a fgt30e ) to other FGT60e  can you help me ?

Hi I'd like to know how to restrict encryption to TLS 1.2 / TLS 1.3 only when accessing the FortiADC WebUI.On FortiGate, this can be done by using the global setting set strong-crypto enable.However, on FortiADC (version 7.6.x), this command does not appear. Does anyone knows this ?

 Dear expert,i am seeking your guidance and assistance to fix the routing problem. Recently we got direct-connect ( MPLS) link to connect AWS EC2 from on-prem data center. not configured yet. apart from that site-to-site IPsec VPN tunnel also established with AWS and working fine. All BGP handling is taken care by ISP with regards to direct-connect. The issue isoutgoing data from local lan ( port 9) is not going to AWS through port 4 (10.18.152.4/24). working From port4 to gateway of ISP router gateway 10.18.152.1 is reachable.From port4 to AWS EC2 subnet 10.18.144.0/24 is reachable. AWS EC2 subnet to ISP Router GW 10.18.152.1 is reachable.From port 9 to port 4 / 10.18.152.4 is reachable not workingLAN port 9 to port 4's gateway 10.18.152.1 is not reachable.AWS EC2 to port 4 (10.18.152.4) is not reachable. FW polices areport 9 to port 4 > all traffic allowedPort 4 t port 9 > all traffic allowed static route are configured in

Hello Everyone: We need to reset an FAP-234F-A to factory defaults because we don't have the admin password. Here are the details: 1. We have the unit connected to a FortiGate 40F, which has the default IP address of 192.168.1.99 for now while we set things up. The FAP-234F-A is set to 192.168.1.2 and we can ping it and browse to the GUI. 2. The QuickStart Guide for this unit says that it comes with a special POE injector that has a reset button on it because the AP doesn't. Probably because it's a ruggedized outdoor unit and having a reset button would compromise the ruggedness. The model number of the PO injector that shows in the QSG is EPA5006GPR-4P. It's made by EnGenius, but the only one they have is the EPA5006GR, so we bought that one. It has a reset button on it but pressing it for more than 10 seconds doesn't reset the AP to factory defaults. It does nothing. Probably because it's slightly different than the EPA5006GPR-4P and the pinout

Hello Everyone: We need to reset an FAP-234F-A to factory defaults because we don't have the admin password. Here are the details: 1. We have the unit connected to a FortiGate 40F, which has the default IP address of 192.168.1.99 for now while we set things up. The FAP-234F-A is set to 192.168.1.2 and we can ping it and browse to the GUI. 2. The QuickStart Guide for this unit says that it comes with a special POE injector that has a reset button on it because the AP doesn't. Probably because it's a ruggedized outdoor unit and having a reset button would compromise the ruggedness. The model number of the PO injector that shows in the QSG is EPA5006GPR-4P. It's made by EnGenius, but the only one they have is the EPA5006GR, so we bought that one. It has a reset button on it but pressing it for more than 10 seconds doesn't reset the AP to factory defaults. It does nothing. Probably because it's slightly different than the EPA5006GPR-4P and the pinout

Hello everyone, I’ve been reading a few articles about FortiNAC configuration and got a bit confused. Some sources mention that it’s not recommended to configure RADIUS, L2 MAC traps, and syslogs together, and that the preferred option is just L2 MAC traps. But in another article, I read that configuring syslog is recommended.  https://community.fortinet.com/t5/FortiNAC/Technical-Tip-An-example-of-a-simple-network-deployment-of/ta-p/266446 BR,

Hello everyone, So I know when a guest (rogue) first connects to a switch port, they are isolated and need to register/auth with the captive portal based of the group membership/enforcement group configured on that port. I get this part. My question is for corporate devices, do they need to authenticate via the captive portal each time they connect ? BR,