Solved

Hi Community,I am reaching out because I am hitting a wall with a specific client installation and I suspect a hardware/driver conflict, but I need confirmation or ideas on how to debug this further.The Scenario: I am deploying an IPsec VPN configuration with SAML Authentication (Entra ID / Azure AD).Success: The exact same configuration works perfectly on an HP PC.Failure: It fails consistently on a specific Dell Laptop.Environment (Failing Machine):Hardware: Dell LaptopNetwork Adapter: MediaTek Wi-Fi 6E MT7922 (Wireless LAN Card)OS: Windows 10/11 [Please confirm your OS version here, e.g., 22H2]FortiClient Version: VPN-only Client 7.4.3 (Build 1790) / Hotfix 1.8758The Symptoms:The user starts the VPN connection.SAML Authentication window pops up (Microsoft Entra ID).Authentication is successful.The Issue: Immediately after the auth window closes, the FortiClient status hangs (stalls). It does not establish the tunnel.After a short moment, nothing happens, or the connection attempt si

Environment:- FortiClient VPN (free, VPN-only) 7.4.3.4323- macOS Tahoe 26.7.1 (iMac)- IPsec IKEv2 tunnel with SAML SSO/MFA, NAT-T (UDP 4500)- Not connected to EMS (log shows "Ignore Secure compliance Check as FCT is not connected to EMS")Problem:The VPN tunnel is disconnected by FortiClient itself less than one second after the macOS screen is locked. This happens even when the system is prevented from sleeping (display sleep and screensaver disabled, sleep prevented with a keep-awake utility) and while traffic is actively flowing through the tunnel.Steps to reproduce:1. Connect the IPsec IKEv2 tunnel with SAML SSO.2. Keep traffic flowing through the tunnel (e.g. a TCP check every 60 seconds to an internal host).3. Disable screensaver and display sleep, prevent system sleep.4. Lock the screen (Ctrl+Cmd+Q).5. The tunnel is disconnected within ~0.7 seconds.If the screen is not locked, the tunnel stays up indefinitely, so this is not an idle timeout, a network issue, or a gateway-side dis

Can we query fortinac license usage using snmp? I need historical license consumption every hours.

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Windows printer component splwow64.exe is being flagged.Here are the exact details of the alert: Process/Object: C:\Windows\splwow64.exe Virus Name: FSA/RISK_HIGH//2000002004 Status: Files could not be quarantined To rule out an actual file-based infection, we verified the system file on the affected endpoints: The Microsoft signature is intact (Get-AuthenticodeSignature returns the status Valid). A local SFC scan (sfc /verifyfile=C:\Windows\splwow64.exe) reports no integrity violations. The file on disk is undamaged. The SHA256 hash of the file is BC7412A5EF6D1B32F7032E1008A324006B19C5A5CE4D27BC8D26DFD6BD7EDB0E. Checking this hash on VirusTotal currently shows 0/71 detections. Since the file itself is cryptographically clean and unmodified on the disk level, we strongly suspect this is a false positive caused by a recent p

Hi everyone, I’m having an odd issue with Minecraft and FortiGate and wanted to see if anyone here has run into something similar. I read this thread https://community.fortinet.com/t5/Support-Forum/Unblock-certain-game/m-p/390777/highlight/true and it reminded me of what I’m dealing with, but the solutions there didn’t quite fit my situation. When I try to join certain Minecraft multiplayer servers (especially public ones), the connection either times out or I get disconnected after a few seconds. Singleplayer works fine, and some servers connect without any problem, which makes it confusing. I checked basic settings like allowed ports and application control, and nothing obvious is being blocked. I’m wondering if FortiGate might be identifying some Minecraft traffic incorrectly or if there’s a specific profile or setting that usually causes issues with game traffic. If anyone has experience running Minecraft behind FortiGate, I’d really appreciate hearing

Hello, I am preparing for my exam scheduled for July, but I am having trouble understanding this question. Could you please tell me the correct answer and explain why When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalidcertificate.Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choosethree.)A.AllowB.Trust & AllowC.Allow & WarningD.BlockE.Block & Warning    

 I have a query, I created gre tunnel & then gre interface at the fortigate side  & mikrotik side can't be able to ping remote gateway IP (p2p) which was created fortigate gre interface remote gateway with ping access. But can be able to ping from mikrotik side p2p IP which are using fortigate gre interface local ip. Gre  tunnel showing also up from fortigate side.What is the issue & how to solve it please help me urgently. Using fortigate version is 7.6.7   

HiI have reviewed the FortiClient website and available documentation, but I was unable to find any clear resources explaining how to deploy FortiClient together with the required configuration VPN profile via Intune for Windows users.deployment with a preconfigured setup is supported? If so, please provide the relevant deployment guide, configuration documentation, or recommended deployment method.

Unable to connect to SSL VPN after firmware upgrade to v7.6.7. The connection goes to 10% then I get the following error message: "Unable to establish the VPN connection. The VPN server may be unreachable." 

Due to the lack of support of the SSL VPN, I am migrating the FortiClients VPN to IPSec. Created a new IPSec Dialup config and the tunnel worked fine for a local user. However when I enable the Fortitoken for the user (I receive the token in the email) but the tunnel never goes up and FortiClient show “time out” msg. Sniffing the traffic is possible to see my local peer trying to connect on port 500/4500 but get no answer back from the firewall. Once I try the user without the token it goes completely fine. Any ideas? Cheers

I have multiple IPsec site to site VPNs and remote access VPNs but all the tunnel shows in same table and there is not any option to see this is site to site and this is Remote access VPN tunnel.To verify that I need to open every VPN every time and check this is site to site and this is remote VPN.Like there are option in sophos firewall that we can differentiate this is remote and this is site to site.I faces issue multiple time during troubleshooting and every time need to open tunnel and verify that is remote access or site to site

Hi everyone,We are currently facing a weird issue on our network and I'm hoping someone here might be able to point me in the right direction.A few of our employees in the finance and HR department need to access an online UK tax and salary calculation portal for payroll verification.However, whenever they try to open it from their office machines connected behind our FortiGate firewall, the page either fails to load or shows a block/timeout error. Interestingly, it works completely fine on their mobile data or home networks, which confirms the issue is strictly related to our corporate network setup.Here is a quick overview of our current setup:FortiGate Model: FortiGate 100FFirmware Version: FortiOS 7.2Features Active: Web Filtering, SSL Inspection (Deep Inspection), and FortiGuard Categories.I checked the FortiGate Log & Report section under Forward Traffic and Web Filter, but nothing obvious stands out immediately blocking it—though it might be falling under a strict category o

Hello,Our client used to be able to connect to our website but is now blocked since the end of July.The error:Fortinet" wasn't installed properly on your computer or the network. Ask your IT administrator to resolve this issue.NET::ERR_CERT_AUTHORITY_INVALIDPlease install a root certificate for "Fortinet". We recommend your IT administrator read the configuration instructions for "Fortinet" to resolve this issue. Antivirus, firewall, and web filtering or proxy software are among the applications that can cause this issue. What could be the reason? How can we debug it with our client? Thanks

Hi Everybody,We are running a Kubernetes cluster on Rocky Linux 10.2 VMs, with the FortiEDR Linux Collector installed on the host OS.When FortiEDR Communication Control was changed from Simulation to Prevention, the entire Kubernetes cluster became unavailable. After changing the policy back to Simulation, the cluster recovered and became operational again.I have allowed everything regarding the connections to the outside after checking with my Dev Ops Engineer and we see no new logs regarding the communication control. The affected nodes reported this kernel message:Failed to initialize the IGMP autojoin socket (err -1)FortiEDR Collector version: 6.2.0.1350I double-checked the FortiEDR Events and Communication Control logs, but there were zero events showing that anything was blocked or denied by FortiEDR.Has anyone experienced a similar issue with FortiEDR Communication Control and Kubernetes? If you have any ideas or troubleshooting recommendations, I would really appreciate your he

Hi community,I am very familiar with configuring FortiGate Web Filter policies using traditional Active Directory via LDAP and FSSO for user and group-based rules. However, we are moving to a pure cloud environment with Microsoft Entra ID (Azure AD), and I want to achieve the same group-based web filtering capability.Environment Details: FortiGate Model: FG-120G FortiOS Version: 7.6.7 Identity Provider: Microsoft Entra ID (No local Domain Controller / No FortiClient EMS) Since Entra ID does not support native LDAP out of the box like traditional AD DS, I understand that integrating Entra ID with FortiGate for user-based policies relies on SAML 2.0.My Questions: What is the recommended workflow to map Entra ID User Groups (Object IDs/Claims) into FortiGate user groups for policy enforcement? How does FortiGate handle transparent user identification and policy matching for web traffic when using SAML instead of classic LDAP/FSSO queries? Are there any best practices or step-by-st

Hi everyone!On my FortiAuthenticator running version 6.6.10, I've connected a remote LDAP server and already imported the first batch of users. As a second step, I've set up a sync rule for it.I'd like to clear up a few doubts regarding the sync rule, and confirm whether the following understanding of the automatic enablement (for new users imported via the sync rule) is correct:Under Synchronization attributes → OTP method assignment priority: do I just need to move SMS to the top of the list and flag/enable it? Is that the only step required ? (see screenshot below)*   What sync interval would you recommend? Is every 30 minutes a reasonable value ?   Finally, if I understood correctly: for users that already exist on FAC (previously imported), the sync only updates already-mapped attributes (e.g. phone number, email) — is that correct ?* Thank you all in advance!"This is the way"

Hello Fortinet Community,I have a customer requirement regarding remote access VPN connectivity.My understanding is that FortiGate supports both SSL VPN and IPsec VPN for client-to-site connections. However, I have also seen recommendations to move away from SSL VPN in newer releases, and I am planning to deploy this solution on FortiOS 7.6.The customer's requirement is very specific: they want to ensure that only one concurrent VPN session is allowed per user account. For example, if a user connects through FortiClient using their username and password, a second person should not be able to use the same credentials simultaneously from another PC and establish another VPN session.Is this behavior supported natively by FortiGate/FortiClient? If so:Is there a specific setting to limit concurrent logins per user? Does it work for both IPsec and SSL VPN? Are there any best practices or recommended approaches to enforce this requirement?I would appreciate any guidance or configuration recom

I am fail to assign FortiToken. I already check DNS settings and license but no findings. Is there any thing wrong currently on FortiCloud?

Hi AllI would like to know if there is a method to export FGT Policies into Excel (csv) format.Please advise any available options. Am using FortiOS v7.4.12 Many thanks

Greetings Forti Community, I use a web application that I reach on a IP address in my company network over IPsec VPN.It appears that the application sends a HTTP POST request to the server that can't get through the VPN tunnel, because the package is to big. After I change my client VPN network interface to MTU 1350, it can send the package and the access works. I change it with the following command:netsh interface ipv4 set subinterface "Ethernet 3" mtu=1350 store=persistent After that I've tried to set the MTU of the VPN IPsec Tunnel to 1350 and restart my client, I still couldn't access the web application. I've also tried different MTU values on the Firewall, but it didn't really change anything. Only if I do it on the client per command line.If I restart my client and start the FortiClient VPN, it seems that this resets my MTU on my client VPN network interface. So I'd have to execute the command to change my client MTU every time after I start the FortiClient.&nbsp

Hi all,We're migrating a FortiGate-80F to FortiOS 8, and as part of this we need to move our remote VPN access from SSL-VPN to IPsec/IKEv2. Our affected fleet is 50 workstations running Linux/Ubuntu 22.04.The free FortiClient VPN edition on Linux doesn't support IPsec/IKEv2 (only the licensed FortiClient Standalone edition does, as far as we understand), so we're evaluating FortiClient Standalone.We're trying to figure out the licensing requirements for:- FortiClient on Ubuntu 22.04, establishing an IPsec/IKEv2 tunnel to a FortiGate 80F;- Authentication using the FortiGate's local user accounts (not a remote/cloud identity source);- 50 Linux users.A few open questions, in case anyone here has hands-on experience:1. Does FortiClient Standalone on Linux fully support IPsec/IKEv2 VPN tunnels to a FortiGate, and is this supported when using the FortiGate's own local user accounts for authentication (rather than a remote/cloud identity source)? 2. According to the FortiClient Standalone Use

Hello,I am facing an error code to a random number of windows hosts (approximately 30/400 windows 11 home & windows 11 pro devices).The mentioned devices has recently appeared in the state " Running (OS settings outdated" and the error code is "OS settings outdated". I have tried to reload & uninstall and re install the collector with no luck. The collector version is 5.2.6.0065.Any ideas will be helpful in order to further troubleshoot the issue.BR

Hi everyone,Today, I upgraded two FortiGate units in an active-passive HA setup from 7.6.6 to 7.6.7.After the upgrade, I tested HA failover and noticed that the secondary IP did not move to the passive FortiGate as expected.When I downgraded back to 7.6.6, everything worked normally again.Has anyone experienced a similar issue with FortiOS 7.6.7? If so, is there any known fix or workaround?Thanks!

https://cybersecuritynews.com/hackers-selling-fortinet-fortigate-1-day-vulnerability/Do we know if there's any truth behind this claim?  

I have 2 cisco switch managed by fnac and i add the 3rd cisco switch.After i configure the dot1x on the 3rd switch then the authentication is rejected with below errorWhat mean of RADIUS not enabled on device? IN the inventory the RADIUS was enabled.