Solved

ENVIRONMENTFortiOS: 7.6.x (FortiGate 120G)FortiClient EMS: 7.4.x (FortiCloud SaaS)FortiClient: 7.4.7 (Windows)Authentication: IKEv2 EAP-SAML via Microsoft Entra ID---ISSUEFortiClient endpoints managed by EMS fail to complete IKEv2 IPsec VPN tunnel establishment after successful SAML authentication. The EMS-managed client sends an EAP NAK (type 08) in response to the FortiGate's EAP Identity Request, causing the FortiGate to tear down the IKE SA with 'unexpected payload type 41'.A non-EMS-managed FortiClient with an identical manually-configured tunnel connects successfully every time. The failure is specific to EMS-managed clients.---FORTIGATE IKE DEBUG (EMS-MANAGED CLIENT)The sequence on every EMS-managed connection attempt:  responder received AUTH msg  responder preparing EAP identity request  responder received EAP msg  unexpected payload type 41  schedule delete of IKE SA  connection expiring due to phase1 downThe client response decodes as EAP type 08 (EAP NAK) — the client is re

FortiEMS 8.0 managed FortiClient 7.4.7 using FortiTokken.after first time enter user and password details it don’t ask again user credential only fortiTokken.But as per compliance i have to configure like fortiClient ask everytime user password .i already disable the option save pasword and auto login. still same and in fortiClient (Save login) grayed.

After upgrading our FortiGate device from FortiOS version 7.6.6 to 7.6.7, users at the branch lost internet access when the BambiDeep SSL/SSH Inspection profile (Deep Inspection) was used in the firewall rule.Traffic is allowed by the firewall rule, and NAT is working properly. However, HTTPS connections fail when Deep Inspection is enabled.As a temporary solution, we changed the SSL/SSH Inspection profile from BambiDeep (Deep Inspection) to Certificate Inspection, and internet access was immediately restored.  The first rule includes certificate inspection, and internet access works fine, but the second rule is the old one and includes “BambiDeep” SSL inspection; after the firmware upgrade, internet access is not working. Also ı tested the problem on new rule by adding  BambiDeep SSL inspection ant internet acces is not working. Are they any known issue about 7.6.7 version for tihs topic ?

Previously, with FortiClient version 7.2.13, when users initiated the VPN connection using SSO, FortiClient automatically detected the existing sign-in sessions for the customer's corporate accounts. When the authentication window was displayed, the available accounts were presented for selection, allowing users to authenticate without re-entering their credentials.However, after upgrading FortiClient to version 7.4.3, this behavior has changed. When using FortiClient's embedded browser for SSO authentication, users are always prompted to enter their username and password. The embedded browser no longer detects existing Microsoft Entra ID (Azure) sessions or displays the available signed-in accounts.On the other hand, we have verified that when FortiClient is configured to use an external browser for SSO authentication, the expected behavior is observed. The external browser correctly detects the existing Microsoft Entra ID (Azure) sessions, displays the available  corporate accounts,

We wanted enable auto backup of Fortigate firewalls from Fortimanager to FTP server.Please guide.

Would it be possible to get more info logged on the reason why  the disposition was deferred? is ther a setting in the configuration that regulates this? Can a whitelisted sender also be “blocked” like this? Would whitelisting of the domain or sender by the user be sufficient  to avoid this?  Could the receiver be informed when there is a mail stuck  as "Accept; Defer disposition"? With the reason why?

Hello,I have two FortiGate 1800F units running FortiOS 7.4.12. One unit is licensed, while the other is currently unlicensed. I am planning to purchase the required license for the second unit, but it may take some time.For the time being, I need to configure the two units as an HA cluster before the license for the second unit is available. Is this supported? Will HA, configuration synchronization, and failover work properly during this period? Are there any risks or limitations I should be aware of?I would appreciate your advice and recommendation.Thank you.

Hi, i have a Fortigate 200D Firewall with FortiOS 6.0.16 and a Huawei 4G Webstick Modell 3372h. I can't bring the Connection to the LTE-Network up. I searched around and found this https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Huawei-E3372-h-modem-stick/ta-p/193600 The Problem is, that i have the AT-Command Version of this Stick and this HowTo is for the Web-Interface Version. When i try to configure the Stick as lte-modemdiagnose sys lte-modem infosays, that the Modem is not connected.  So i tried to configure the Stick as "normal" Modem. The Modem itself seems to work properly: diagnose sys modem queryUSB status: Connectedmanufacturer: huaweimodel: E3372IMEI number: 868230032061123SIM state: Validservice status: Valid Servicesignal level: 3/4network name: E-Plusnetwork type: E-UTRANlocation area code:active profile(AT&V):COMMAND NOT SUPPORT^RSSI:18^HCSQ:"LTE",45,47,136,26 But in the Debug Messages a Timout occures (At

Hello,I followed this technical tip:Fortinet Technical Tip – Quickly isolate hosts that have disabled or uninstalled the Persistent AgentIt works very well when I stop and restart the Persistent Agent. The host is correctly detected as At-Risk, and I can see the VLAN change from the remediation VLAN back to the production VLAN as expected.However, when I completely uninstall the Persistent Agent and then reinstall it, the host remains in "Agent Not Communicating" status. The status does not change after the agent has been reinstalled.After reinstalling the agent, I have to delete the host from FortiNAC and restart the workstation before it is detected correctly again.Is this expected behavior?I also have a question regarding the following statement from the technical tip:"An Event Mapping can be created that immediately changes the host status to 'At-Risk' as soon as an event 'Persistent Agent Not Communicating' is created."Does this Event Mapping apply to all hosts, regardless of thei

So for whatever reason on new devices that we have set up the past couple of months we cannot seem to connect to our VPN at all on these new devices. However, the older devices seemingly have no issue.  We have tried reinstalling the C++ libraries, reinstalling FortiClient, and updating the NIC driver but have had no luck.  All of these new devices are running Windows 11 Pro 24H2 and its a mix of 2 Dell Latitude laptops and one Microsoft Surface Pro 9 if that helps with anything.  Also tried looking for some of the older versions on the support page but we don't have the firewall tied to our account so it doesn't let us search through the download page.  I have tried version 5.4.3.0870 of FortiClient that we had saved but that didn't work either although I am not sure if that version is Windows 11 compatible or not.  Not sure where to go from here any help is appreciated!

I add Fortigate to the Fortinac and why i get below event? Actually the Fortinac connect to the Fortigate using SSH and not telnet. 

Hi All, VersionFortiGate-81F v7.4.8,build9191,260511 (FIPS-CC-74-8)FIPS-CC mode: enableFortiSwitch-148F-FPOE v7.4.8,build0929,250909 (GA)Security mode: none In our environment, Federal Information Processing Standards (FIPS) is required due to the contract we have. I have been running into the following issues while testing FIPS mode on our equipment.The FortiSwitches appear under Managed FortiSwitches. I can see the firmware version, status, and join time, but I cannot SSH into the switches from the GUI. It also does not show the Connecting From status or the switch IP address.Under FortiSwitch Ports, the port connecting the FortiGate and the FortiSwitch shows as down. When I assign a VLAN to a FortiSwitch port, the VLAN assignment is accepted, but it does not actually take effect on the connected device.However, from the FortiGate CLI, I can SSH into the switch without any issues. The switch status is visible, but it appears that the configuration is not being fully synchronized to t

I believe when we add the switch to the fnac for 1st time then fnac inventory will collect below data such as Name, Default Vlan, Current Vlan from the switch. When we have changes on the switch, example i make port description and change the default vlan then why in the fnac is not updated? Resync the interface is not helping  

Hi everyone,I am attempting to set up a new IPsec VPN connection using the standalone FortiClient VPN only v7.2.1.0779 app, but several configuration options appear to be missing from the user interface: Missing Single Sign-On (SSO): When creating an IPsec VPN profile, there is no option or toggle for Single Sign-On (SSO / SAML) anywhere in the GUI. Missing Mode Config Parameters: Under Address Assignment, selecting Mode Config does not reveal options for Encapsulation, IKE UDP port, or IKE TCP port. Any insights or guidance would be greatly appreciated. Thanks!Missing option in my appSSO setting i expectedMode configuration setting i expected 

We can select 802.1x authentication set to user or computer if we use wired. How about for wifi? There is no option to select that option on the wireless card properties.

Our internal tools use FMG API to manage it and we were looking to create a Threat Weight Template using API.I have checked:https://fndn.fortinet.net/index.php?/documents/file/521-fortimanager-76-json-api-full-reference/https://how-to-fortimanager-api.readthedocs.io But did not find the API endpoints.If someone has done it before or has any API collection they can share ?

When we use DHCP fingerprint for device profiling then we need to add ip helper on L3 interface. How if the L3 using fortigate, there is no ip helper command?

Hello, apologies if this has been posted before, but I could not find anything in the forums.We are a K-12 that recently switched to a FortiStack (Gate (100F), switches (148FPOE), WAPs (231G and K series). We are coming from Cisco Meraki and missing a big feature (or cannot find said feature) that I’m hoping to duplicate with FAZ. Being K-12, we have students lose devices on campus. We were able to log into the Meraki portal., look up a device hostname/mac and see what access point that endpoint last connected to. This helped students track their lost device.I cannot find anything simliar in the FortiWorld. I've piecemealed a dataset in FAZ from the Gate Event logs that gives me the client mac, last connected AP, and the last_seen time. I’ve parsed that along with a query based off Gate > Application Control > aware-New-Endpoint-Devices dataset. It looks like it would be what I need but I think the last_seen time is when it was FIRST connected to a particular access point. I real

Hello, I have a frustrating case where a H-A cluster successfully authenticates against an external LDAP server using port 636, but is not able to browse the users in it.Testing a user is successful as well. Look at the attached screenshots.I changed the “cnid” field several times, including “sAMAccountName”.The version we are using is 7.4.12. 

Hi everyone,I'm currently setting up FortiXDR and I'm a bit confused about the required FortiAnalyzer configuration.Our environment consists of:FortiClient EMS Cloud FortiXDR license Local FortiAnalyzer VM (no FortiAnalyzer Cloud license)We do not have a FortiAnalyzer Cloud license, only a local FortiAnalyzer VM.My question is:For FortiXDR, where should the FortiClient logs (configured in the System Settings Profile) be sent?Should the FortiClients send their logs to a FortiAnalyzer Cloud instance, even though we don't have a FortiAnalyzer Cloud license? Or is it supported to send the logs directly to our local FortiAnalyzer VM while still using FortiXDR?Most of the users work from home, so we are currently using a DNAT with TLS configuration.Has anyone successfully deployed FortiXDR with EMS Cloud + local FortiAnalyzer?Kind regards,MG4

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

My port switch config isinterface GigabitEthernet1/0/1switchport access vlan 100switchport mode accessswitchport voice vlan 200authentication order dot1x mabauthentication port-control autoauthentication periodicmabsnmp trap mac-notification change addedsnmp trap mac-notification change removeddot1x pae authenticatorspanning-tree portfastend I think i no need to add two bold command above since the radius will be used and not snmp. Am i right? 

Hello,We are experiencing an issue with RADIUS authentication on FortiNAC after upgrading the appliance.The problem only affects newly added switches. Any switch that is added to the FortiNAC inventory after the upgrade is unable to authenticate via RADIUS.Existing switches that were already present in the inventory before the upgrade continue to work correctly, including switches on which I have recently enabled RADIUS. However, as soon as a new switch is added to the inventory and RADIUS is configured, all RADIUS authentication requests are rejected.The RADIUS server is reachable and RADIUS tracking is configured correctly. On the Aruba switch, the RADIUS server status is healthy and there are no connectivity or shared secret issues.The following message is logged on the FortiNAC RADIUS server: Mon Aug 3 16:02:03 2026 : Auth: (24) Invalid user (RADIUS not enabled on device): [ArubaTstRadius] (from client 10.11.49.12 port 0)Mon Aug 3 16:02:03 2026 : Auth: (24) Login incorrect (RADIU

Hi! I would like to install the FortiClient VPN including the VPN settings with Microsoft Intune. We have more than 150 Windows PCs for installation.So, is it possible to do this? Note please, the vpn settings for remote access is IPSec. Bests,FortiEng 

Why link status for each port is different between the device and fortinac? On the device port g1/0/27 - 31 is up but in the NAC is different