Solved

SSL VPN was replaced to IPSEC on FGT version 7.6. I already configure IPSEC IKEv2 with EAP enabled.But why in forticlient android when select IKEv2 there is no field to enter the credentials?

Hey guys, so I did a "small" mistake.We bought two new FortiGate clusters (120G and 100F, both active-passive) to replace our old Palo Altos. One cluster is already running and the other is in the lab to set up.While starting to configure the second cluster, I realized that I mixed them up. The running cluster should be the 100F, but those firewalls are currently on my table. What is the best way to replace the running cluster with the other hardware?The issue I have is that I don't have much time. The second cluster has to be installed next tuesday and the already running cluster is already full productive. How can I exchange them with the least interruption? Thank you so much for your answers!

Good morning, I am struggling with an issue with FortiClient SSL VPN (Standalone VPN) on a Windows 11 computer. I have installed the FortiClientVPNOnlineInstaller.exe from the FortiClient downloads page. The install finishes correctly. I am able to set up the VPN. I've used the exact same VPN configuration on other computers with no problems. On this computer, when I click "Connect" it seems that nothing happens.The expected response would be for FortiClient SSL VPN to open a web page for me to log into my SSO to authenticate. I've performed the following troubleshooting steps:1. Restarted the computer.2. Uninstalled FortiClient VPN/reinstalled FortiClient VPN.3. Checked, double-checked, and triple-checked the configuration. Even tried multiple remote gateways that should work.4. Ran SFC scan on the computer.5. Performed a Network Reset via Windows Network Settings on the computer.6. Ran DISM /RestoreHealth on the computer.7. Flushed the DNS cache.8. Tested the FortiClient VP

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hello to everybody, Two days ago, the following system events appeared:  I haven't activated this and I do not know how this could happen. My FortiGate does not support WiFi (or this is what I thought...). Please, what do I have to do to turn off the Wireless Controller? Thank you for your help. 

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?

Hi All We have successfully integrated with RADIUS, and all user authentications are working fine. However, we need to import user groups from Active Directory into FortiSASE users and groups.The RADIUS Group ID value is required for this. Could you please let us know where we can find this value?   Thankz 

Hi everyone,I am finalizing a network deployment and looking for validation on my topology design to ensure I amfollowing Fortinet Best Practices for High Availability. My Environment:Management: FortiGate (FortiLink mode).Core Layer: 2x FortiSwitch 1024E configured as MCLAG Peers (ICL link is up and healthy).Access Layer: 2x FortiSwitch 100 series (Standalone access switches).Current Physical Topology: I have connected two separate access switches to the Core pair in a "triangle"(dual-homed) topology. Here is the exact cabling map: Access Switch 1:Port 23 -> connects to Core Switch A (1024E) Port 10Port 24 -> connects to Core Switch B (1024E) Port 10Access Switch 2:Port 23 -> connects to Core Switch A (1024E) Port 11Port 24 -> connects to Core Switch B (1024E) Port 11(Note: The 100-series switches are not stacked/ringed together).The Goal & The Question: My primary objective is redundancy: if one of the Core switches (1024E) fails, the Access switches must ma

Hello everyone, I would like to know if it's possible to use Fortigate as a DNS server for the Isolation network in the config wizard of FNAC?  Thanks in advance.BR,

Hi FSM adminsI have 3 collectors all healthy and working fine as syslog collectors.However when I try select the collector for Windows/Linux collector agent, only 2 are shown in the list.What can be the cause?

Hello community! I know variations of this question have been asked in the past, but it's been a little while so I was wondering if there was anything new on this topic. You can see below the network devices and that's what I need to work with. The network architects designed it this way, even if I read here that the best configuration would be with switches in between both clusters. Now it's too late, project funds are exhausted so we can't order extra hardware. A bit more context, first cluster will be used for SDWAN and IPSEC VPN and to take care of BYOD and other unsecured devices. First cluster will also have two VDOMs, one for guest network and the other for reaching the second cluster. Second cluster will be used to protect a process network. In some specific cases, process network might reach one VDOM or the other. In some specific cases, guest VDOM might reach the other VDOM to get to process network. How can we configure two directly connected FG81F cluste

Hello AllWe have a new deployment and have created TACACS+ servers and Group  When I try and push, it doesnt say theres a change pending, doesnt even detect a change.  The TACACS are referenced to a group and an account too that Ive created. Is there a way to force these changes to be deployed? 

Two to three months ago, we migrated to the EMS FortiClient VMware appliance 7.4.4.We are a Windows store, so Linux knowledge is minimal.Now we want to upgrade to EMS 7.4.5 because of some bug fixes and the database backup feature.Is the recommended upgrade method to download a new VM image and perform the necessary actions as described in the article below?https://community.fortinet.com/t5/FortiClient/Technical-Tip-Recommended-method-for-upgrading-to-FortiClient/ta-p/423615Do I have to ignore the upgrade option/alert below via the GUI?Automatically upgrading EMS to latest patch release | FortiClient 7.4.5 | Fortinet Document LibraryThanks

Hi everyone,while creating a profile for a FEX device, i'm unable to add a new meber of type VAP in the Switch Interface. the VAP list is empty, even if the SSID i've created isn't in bridge mode. Accessing the web interface of the FEX it allows me to add a VAP port with the SSID, but i need a massive/remote deploy without accessing every single FEX.Someone know ho to solve this? 

Hello everyone, While reading this article "FortiSwitch FortiLink Integration" and to be more specific, the RADIUS/syslog/L2 MAC traps config, there is always a note saying to skip the step if you configured one of the three. I do understand that L2 MAC traps is the most recommended, but I wanna know why can't we use two together, is it to optimise performances ? Thanks in advance.BR,

Hello All!On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22: C:\Windows\System32>ping 192.168.22.1Pinging 192.168.22.1 with 32 bytes of data:Reply from 192.168.22.1: bytes=32 time<1ms TTL=63Reply from 192.168.22.1: bytes=32 time=1ms TTL=63Request timed out.Request timed out.Ping statistics for 192.168.22.1:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 1ms, Average = 0ms In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces. Here is an output of sniffer:diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100interfaces=[any]filters=[host 192.168.22.1 and host 192.168.10.51]6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request6.892478 192.168.10.51 -> 192.168

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.what happens if my primary HQ is down? can load-balancer take over authentication function.if so which will be active.  

Hello everyoneI have a DNS configuration plan and want to evaluate it separately for local and internet access.When the central DNS company.xxxxx performs a DNS query, I want my local users to use the DNS I specify when accessing the internet. I don't want them to go to company.xxxxx DNS when accessing the internet, and at the same timeWhen SD-WAN connects to the internet, I want it to route to whichever xxxxx - xxxxx DNS has the best jitter, packet loss, and ping values.Is there anyone who can help?

I am not getting any audio on new 380B when making or receiving calls (new system).The volume is all the way up, I disable bluetooth for now still no ringing, and no audio when playing voicemail. Thanks

Hi All, I am unable to select Current Version and Target Upgrade Version in Upgrade Path Tool , Did anyone facing this issue..  tried with differnet browser and from diffrent PC .. But no luck#fortigate #upgrade path tool #FotiOS