Support Forum

Hello guys,Issue Description: We recently attempted a firmware upgrade on our GCP HA cluster from v7.4.12 to v7.4.13. The image upload and HA synchronization process completed successfully, and both nodes rebooted. However, immediately upon booting into 7.4.13, the system experienced a false positive on the WAN health-check (Link Monitor). The firewall incorrectly detected the external ping targets (8.8.8.8 and 1.1.1.1) as unreachable. This triggered the automatic removal of the default static route on the external interface. As a result, the cluster lost all outbound Internet access. I got this error message when uploading frimware image : anyone with similar architecture have experienced this issue ??

Hello everyone, I have a few questions about how synchronization works at the HA group level.Virtual IPs (VIPs): Are VIPs synchronized across all the clusters/units that belong to the HA group, or must they be configured separately on each cluster? DKIM keys: Are DKIM keys synchronized across all the units/clusters in the HA group? Or do we need to generate or import them manually on each one? “Action on failure” in the HA group: When this option is set to “Wait for recovery and switch to configured role”, what happens when Site A comes back after being down while Site B was acting in its place? Does Site A resynchronize and apply the configuration changes made on Site B during the outage before switching back to its configured role? Or does it come back with its old configuration, potentially overwriting or ignoring the changes made on Site B? Thanks in advance,BR,

FortiAp 221e with firmware 7.4.6, connected to fortigate FG200e with firmware 8.0.2 in any physical interface, or fortiswitch vlan ,is unable to get online.It receives ip address, i can see it as an lldp neighbor ,but never goes online. Always OFFLINE.Any help ?  

Hello Community, We are currently facing an issue regarding IPSec Remote Access VPN connectivity from Linux (Ubuntu) using FortiClient VPN as the user agent. Our FortiGate is running FortiOS 7.6.6, and we want to allow remote users to connect through IPSec Remote Access VPN. However, after installing FortiClient VPN on Ubuntu, we noticed that the GUI only provides options for SSL VPN and XML configuration, and there is no option available for IPSec VPN.Since SSL VPN is not supported in our current deployment scenario on FortiOS 7.6.6, we intended to use IPSec-based Remote Access. As a workaround, we installed strongSwan on Ubuntu and configured the IPSec connection manually. The VPN tunnel was established successfully using the user created on the FortiGate, and connectivity is working properly. However, we would like to clarify the following points:Is IPSec Remote Access officially not supported in FortiClient VPN Only for Linux?If FortiClient VPN does not support

Hi everyone, I'm trying to set up remote access via IPSec to a FortiGate 60F. Since MS365 SSO is in use already for various services, this should be used also for VPN access. I've been able to successfully implement this and was able to connect from a Windows box with SSO and the FortiClient VPN-only version (7.4.3 hotfix 1.8758). EMS is not in use. However, I'm also looking for a solution for Linux, but each option that I see leads to a dead Open-source IPsec clients like strongswan and libreswan don't appear to support SSO authentication (yet). I tried to add a separate user using static credentials for EAP login, but I also haven't found a way to use these tools with both a PSK and additional EAP authentication.I was able to establish a connection with the regular Linux FortiClient, but it can't be used without an EMS except for a trial.The FortiClient VPN-only version for Linux (7.4.3 build 1736) appears to only support SSL VPN, but not IPSec.SSL VPN is obsolete

We have trouble with Forticlient vpn only 7.4.3 on Mac OS 27 Golden State. If we are trying to establish vpn connection, every time we recived time out. Oure Macbook Air is staight from suplier with clean preinstaled Mac Os Golden State. Vpn is configured as IPSec. Firewall is disabled.The same config we are using on Windows and it is working just fine.

Hello Fortinet Community,I have a FortiGate firewall and would like to implement the following requirement in my organization.Requirement: Block WhatsApp Web access through web browsers (Google Chrome, Microsoft Edge, Firefox, etc.). Allow WhatsApp Desktop application on Windows PCs. Users should not be able to access https://web.whatsapp.com through any browser. WhatsApp Desktop should continue working normally, including messaging, voice/video calls, and file transfers. My Questions: Is it possible to achieve this using FortiGate Web Filter or Application Control? Can we block only the WhatsApp Web browser traffic without affecting the WhatsApp Desktop application? Which FortiGate application signatures or URL filtering rules should be used? Is SSL Deep Inspection required for this implementation? Are there any recommended configurations or best practices to achieve this requirement? I would appreciate any guidance, CLI configuration examples, or step-by-step instructio

Hello everyone, Does FortiGate accept two VIP objects with the same external IP ? If so which FortiOS and how is it configured ? Thanks in advance.BR,

authentication code issues, only works with a push notification, code gives 'vpn error'

 HI all,I’ve run into a tricky issue on an IPsec Remote Access VPN connection with Forticlient.my FG version: ’FortiGate-50G v7.4.8,build2795,250523 (GA.M)’, FG can see internet, and here is the configuration of IPsec Phase1:FortiGate-50G # config vpn ipsec phase1-interfaceFortiGate-50G (phase1-interface) # edit IPsec\ RA\ vpn0 FortiGate-50G (IPsec RA vpn0) # show config vpn ipsec phase1-interface edit "IPsec RA vpn0" set type dynamic set interface "lan2" //yes my wan interface name is lan2 set ike-version 2 //also tried ikev1(agressive and main) set local-gw <my public ip> set peertype any set net-device disable set mode-cfg enable set proposal aes128-sha256 aes256-sha256 set dpd on-idle set dhgrp 5 set eap enable //also tried with no eap set eap-identity send-request set authusrgrp "POC_grp" set nattraversal forced //also tried

FortiAIGate 8.0.2 can see traffic logs that my UI and postman API request were caught but traffic log details show Request Refused 'The gateway refused this request (404, HTTP 404)'ChatUI & Postman API calling to FortiAIGate 8.0.2 following FortiAIGate Administration Guide [Send a normal request]:https://docs.fortinet.com/document/fortiaigate/8.0.2/fortiaigate-administration-guide/531206/appendix-a-api-endpoints-and-request-examples#select-an-api-dialectAny idea?

Our municipality and affiliated public institutions have invested in Fortinet equipment and solutions for over a decade. It is extremely disappointing that a mature product branch has been left with a serious, reproducible regression affecting essential public services.Technical details: OS: Windows 11 Pro 25H2 and 26H2 Product: FortiClient VPN-only (IPsec) Affected builds: 7.4.3.4726 and 7.4.3.6002 (probably all versions from ~7.4.1?) Steps: Connect FortiClient IPsec → disconnect → attempt Windows native L2TP/IPsec VPN. Result: Windows VPN fails with RAS errors 789/791. Confirmed workaround: Restarting the Windows IKEEXT service immediately restores connectivity. Network routing and adapter states appear normal after disconnect. This issue has been publicly reported since at least February 17, 2025, with no confirmed permanent fix. Even the latest security-maintenance build, 7.4.3.6002, still reproduces it.Related reports: Feb 17, 2025: https://community.fortinet.com/suppo

Hello Fortinet Community,We are experiencing recurring FortiClient VPN connection issues with one of our customers and would appreciate your advice.System Information:Device: MacBook Pro (Apple M1 Pro) Operating System: macOS 27.0.1 FortiClient VPN: 7.4.3.4323 (Free VPN Version) VPN Type: SSL-VPNProblem Description:The VPN connection works normally for several days. However, after some time, FortiClient becomes unresponsive when attempting to reconnect.Restarting the Mac does not resolve the issue. The VPN only starts working again after reconfiguring the connection, but the problem returns after a few days.Troubleshooting Already Performed:Verified the VPN configuration. Successfully tested connecting and disconnecting the VPN. Checked Fortinet network extensions and background services – all active. Reviewed FortiClient logs without identifying a definitive cause. Verified that the VPN works correctly immediately after reconfiguration.Our Questions:Is FortiClient VPN 7.4.3.4323 offic

Does anyone else experiences issues with login into customersso portal ( https://customersso1.fortinet.com/saml-idp/ ) when trying to access anything that requires authentication with it?I dont get the the push notification in the mobile app and upon entering the token manually I get  Invalid token code entered or your session has timed out. Please re-enter your credentials. Is there a known issue with this service ? L.E. figured out my manual input issue is due to entering the wrong token assigned to the account ( having multiple ones in the app ) , but the push notification from the app still doesnt work

If we refer to the Fortinet article below:Technical Tip: Implementing IPsec VPN SAML-based authentication using loopback Interface | Community it states that:IKE with SAML authentication does not support multiple SAML servers on the same interface, as the SAML server is directly bound to the interface and allows only one instance to be configured.What is the recommended design if I have two Internet connections for VPN redundancy?Since the SAML server is bound to an interface, does that mean we cannot enable the same SAML server on the secondary Internet interface?Has anyone implemented IPsec VPN with SAML authentication in a dual-ISP redundant setup?

How do I get FCREMOVE.exe for a free copy of Forticlient I am unable to download the tools and I have a free copy of Forticlient installed and I can not remove it It is not showing in add/remove programs.  We can't uninstall   We can't install.  We are stuck Any ideas?

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Office component EUROTOOL.XLAM is being flagged as high risk.I have reviewed the hash (2C4AFE4AFEDE252158A732EDB0C3754B9CB984A7CC2EB6EEFAC47C1EF38C9753)  , file location and metadata on a number of devices and all comes back clear.Since the file is cryptographically clean and unmodified I strongly suspect this is a false positiveHas anyone else seen similar in their orgs? Thanks in advancePASMC

FortiAIGate on 8.0.2 without GPU on the node.Helm install method with values.yaml applied latest image tags. All pods are up. License applied in GUI. Workspace & model setup done but detectors for DLP, Regex & NL are missing, is GPU-enabled node a must to see/enable all the detectors?

Hi,can someone explain to me what the FortiAuthenticator-VMS-DR license (HA/DR/Load Balancing node license for FortiAuthenticator VM Subscription, with FortiCare Elite Support) is used for?It is not listed in the Ordering guide. If I understand it correctly, does this license allow for the deployment of a cluster (a second unit)?Zhank you

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

After upgrading a FortiGate HA cluster to FortiOS 7.6.8, the HTTPS GUI was no longer accessible. Browsers returned ERR_SSL_PROTOCOL_ERROR, while curl reported SEC_E_DECRYPT_FAILURE.The GUI worked when TLS 1.2 was explicitly enforced. The issue was resolved with:config system global    set admin-https-ssl-versions tlsv1-2    set tls-session-cache disableendA reboot was required for the TLS session cache change to take effect. After the reboot, the GUI was accessible again.Is this a known issue in FortiOS 7.6.8?

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on.