Support Forum

I achieved my NSE 6 at the weekend, but I didn't realise that it wouldn't extend the validity date of my NSE 4 (1-3 were extended). I am going to study for my NSE 7 in Secure Networking now, but I only have 18 months to do this as my NSE 4 will expire then.I can see on their website that you can renew NSE 4 by "Complete the online NSE 4 recertification assessment if you passed one NSE 4 exam no more than 2 years ago", but I can't find a way to do this without sitting the full exam again (not an issue if required)Just wondered if anyone has done this before? 

Hello,i have a FortiSwitch running at 7.2.9. There we have a trunk with no name.We want to delete this trunk.Because the name is the reference for every command, we don’t have any possibility.config switch trunk       edit ""        set mode lacp-active        set auto-isl 1        set members "port24"    nextIs there another way to delete this trunk?Thanks

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

Hi Team,We plan to deploy a FortiPortal Scalable Cluster with two nodes in one DC and one node in the other. If the DC with the two nodes goes down, the single node can operate independently per the configuration:config system ha set min_nodes 1endWhat will happen when the two-node DC is brought up? Will it be enough to change the single configuration to a scalable cluster? Will the changes made on the single node during the outage be replicated to the other nodes?

Dear Community, since the upgrade to FortiClient 7.4.8 we have the following problem: For example some User’s use Miro Boards (miro.com). The page works normally but when you open any Miro Board it just loads infinite. When checking the Console it says: “Websocket connection to wss://miro.com/rtc-gateway/mux?client_auth_user_id=CENSORED failed”. We previously had 7.4.4 which just worked fine. Also it works when connected to the VPN or connected to the company network. because then the integrated Webfilter from FortiClient disables itself. So the Network Team made an exclusion for all Miro Domains but it still didn’t fix the problem sadly. And when I disable on my Mac the FortiClientProxy Network Extension it immediately works. Does anybody have problems like this with the new version? I just can’t seem to be able to fix that issue and it’s driving me insane because else the new version is a blessing. Much faster surfing and generally better speed. We use FortiClient EMS for centralized

Hi,I've been attempting to setup a High Availability pair of virtual Fortigate firewalls under AWS.https://docs.fortinet.com/document/fortigate-public-cloud/7.6.0/aws-administration-guide/229470/deploying-fortigate-vm-active-passive-ha-aws-between-multiple-zones From what I can gather the normal approach is to have 4 network ports to do thisWAN, LAN, HA, Management.However I've been attempting to set this up on a c6in.large image which is limited to 3 network ports (because c6in.xlarge is double the cost) I nearly got this to work by avoiding the use of a management port and logging onto the secondary firewall using the virtual serial port via the EC2 Serial port console under AWS. This allowed me to setup both firewalls with ports for WAN, LAN, HA only. I found that switching from the Primary to the Secondary works, but switching back from the Secondary to the Primary fails to call the AWS API calls to update the routing tables / elastic ipsBased on this link

Good afternoon everyone,I installed FortiClient VPN on my Debian machine (running KDE Plasma), but I can't get past the login screen. I enter my password and it just gets stuck on "Connecting" forever.The logs show an invalid certificate error. I tried to unlock the padlock icon in the UI so I could check the "Do not Warn Invalid Server Certificate" box, but when I click on it, the application freezes completely.Does anyone know how to bypass this padlock freeze or how to enable the certificate exception via command line? Thanks in advance! 

I would like to confirm about Forticloud SSO solutions with Entra IDAfter read document it seems working as below conceptsConfigure IAM with IdP on forticloud portal (Entra ID → FortiCloud) Enable FortiCloud SSO on the FortiGateHowever, this first time for me & not sure there are any concern point that need to be aware or any required special license? anyone have experice on this please suggest me, thanks

Hello everybody,We're considering FortiAnalyzer Cloud for our FortiGate 70G-PoE in a small company (~50 employees).Our main goal is incident response and forensic investigations, e.g. identifying suspicious activity, investigating a compromised device or tracking a potential attacker using firewall logs.As I understand it, the last 100 days of logs are available for analytics and reporting, while logs from 100–365 days are archived.A few questions:How easy is it to search archived logs from 3-12 months ago?Can archived logs be re-indexed for FortiView, analytics, and reporting in FortiAnalyzer Cloud?Is it possible to analyze logs spanning an entire year, or are analytics limited to the most recent 100 days? Is FortiAnalyzer Cloud the right product for our use case, or should we consider something else (e.g. FortiSIEM)? Is there a trial license available to test these limitations before purchasing? Thanks in advance for any pointers!

Good day, i have block instagram from application Control. it works in laptop or pc that connected through this network. but for user who using mobile phone with Wifi access, still able to access Instagram application smoothly. my question is, how to block instagram for user access from mobile phone Iphone or Android. Thank you for Help  

We use FortiMail’s webmail for IBE secure mail exchange.The Webmail interface allows users to download the de-crypted emails using “save as” without any encryption. These mails are saved as decrypted plain email format (.eml)How can we disable this function in Webmail?Is piping the WebGUI through a reverse proxy/WAF to block this particular button the only way?

Hello, I am currently using a laptop that runs FortiClient to connect via REMOTE IPSEC VPN to the primary and backup firewalls.On this laptop, I am using version 7.07 345, which is obsolete. I have a new PC on which I just installed the latest version, 7.4.34726. I created a backup of the configuration on my old PC that I'm trying to import onto my new PC. Unfortunately, when I try to restore this backup on the new PC, FortiClient doesn't even ask me for the password.I asked ChatGPT+ for help, and we switched to the Command Prompt (cmd—run as administrator) and ran the following commands:    - FCConfig.exe -m all -f cheminfichierSave.conf -o import -p MOT_DE_PASSE   - FCConfig.exe -m all -f cheminfichierSave.conf -o import i -1 -p MOT_DE_PASSENeither of these two orders is going through. Could you please let me know what steps to take?Thank you, and have a great day.GwénaëlleNote: This post was machine translated in accordance with our Fortinet Community Guidelines.

Hello Team,Our FortiClient EMS uses a manually uploaded Let’s Encrypt server certificate containing two DNS SANs.Certificate renewal is already automated through our Salt master. After each renewal, we currently download the certificate and manually upload and apply it in EMS.We want to automate only the certificate deployment and activation steps while keeping certificate renewal managed by Salt. Or happy explore option auto renwal in EMS with two DNS SANs.Please provide the supported API or CLI procedure for importing the renewed certificate, matching private key, and intermediate chain, and assigning it to the applicable Web server and Endpoint control services.Please also confirm the required authentication and permissions, any service restart requirements, and whether this operation can run unattended on our EMS version. Thanks,

I would like to Integrate Tufin with Remedy in such a way that the CRQs requesting Fortimanager security policies configurations get automated, meaning that Tufin would be able to see the CRQs on Remedy and automatically configure the rules on Fortimanager:Tufin pick up Remedy ticket, figure out which firewall, check for conflicts, push rule to FortiManager. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes.Is there any documentation or support that I could have access to accomplish this? Thank you & best re

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

If i look from authentication log one host have some authentication request and if we see from below pic there are 4 authentication request.Three of that is failed and one is success. Failed authentication due to timeout and this timeout mean the network devices can’t connect to the fortinac?    

Hello, our organization recently obtained a few MacBook Neos and Airs to test, running on macOS 27 Golden Gate. However, after installing FortiClient and connected to the office network, at random times, the Wi-Fi and Bluetooth would switch off and cannot be turned back on manually. After 2-3 minutes of this, the MacBook will then freeze then immediately restart on it’s own. Following a restart, everything seems normal, but this issue can repeat multiple times in a day, but as the day goes on, it becomes stable. This happens the moment I disconnect and reconnect back to the office network. Especially after bringing home and returning to the office with the MacBook. This issue does not happen with a private home network or hotspot. Resetting the MacBook does not resolve the issue either. When FortiClient is not installed, the MacBook behaves normally. 2 older MacBooks obtained last year does not experience this issue. We have disabled / blocked Apple Account login, Mail, Calendar, iClou

Hi, I have created an fortigate administrator login using below video, however in my case I'm unable to bypass Two factor authentication while creating user on fortigate device. Fortigate running version 7.6.4 https://youtu.be/WWIJHZrFTW8?si=ZTT2cTcDkZ-v6-qe

Hi, Initially, several FortiGate 70G HA pairs became out of sync due to an unknown FortiAP entry, AP-11N-SERIAL-0001, appearing under Managed FortiAPs. Deleting the unknown AP entry from the primary FortiGate resolves the HA synchronization issue. Eventually, I found another entry in System Event log on FortiGate showing that the unknown AP was added after a discovery request was received. Source IP: 66.132.224.63 Event: AP AP-11N-SERIAL-0001 added Reason: Discovery request was received Any insights or relevant known issues would be appreciated. Thank you!

If i want to make traffic shaper to prioritize traffic from LAN to host 10.10.10.10 located on datacenter for example,then are i need to create the traffic shapper only for this specific host? Or I need to make another traffic shaper for other traffic with medium priority?

Hello,I have an FMG running version 7.4.7 on Azure, and this FMG has 2 ADOMS, each of which manages a “pair” of FortiGate devices operating in HA (via an Azure ELB).We need to perform scheduled backups once a week from the FMG.Is this possible?Is it possible to export the backups to a TFTP server from the FortiGates, but with everything managed through the FMG?Thank you for your feedback.

Hi allNothing important or urgent.According to Fortiguard RSS feed about updates, a new version of FAC (8.0.4) has been released over 24h ago.However, I am not seeing any release notes on the fortiauthenticator page or see a download folder for 8.0.4 (so no firmware or release notes there either).Usually it doesn't take that long after a release info to see downloads and release notes. So, I am not sure if I am just impatient.Anyone know if the info and firmware files have been withdrawn?Thanks

Hello everyone,I need assistance with configuring FortiNAC guest self-registration to assign different VLANs based on the location of the Cisco access point.Environment:FortiNAC: Version 7.6.7, deployed at HQ. Cisco WLC: Catalyst C9800 running version 17.9.4a, deployed at HQ. Access Points: Deployed at both HQ and Site A. Guest SSID: Configured for FlexConnect, with local switching at Site A. FortiNAC: Guest self-registration and the relevant policies are already configured.Issue:I want guest clients connecting through APs at HQ to be assigned to the HQ guest registration and guest VLANs, while clients connecting through APs at Site A should be assigned to the corresponding Site A VLANs.Currently, when a guest connects through an AP at Site A and completes the self-registration process, FortiNAC assigns the client to the HQ guest VLAN. I have already created the necessary policies in FortiNAC, but I am unable to get the VLAN assignment to work correctly according to the AP's location.M

Hi,I just downloaded FortiOS 7.6.7 for VMware, but when I use the CLI, I am able to log in with my username and password:Username: adminPassword: [Assigned password]However, when I try to authenticate via the web interface, I get a credential error.Does anyone have any ideas?

Hi everyone,Since upgrading my FortiGate 70G from 7.6.6 to 7.6.7, I can't access the admin GUI via my Nginx Proxy Manager. Direct local IP access works perfectly...The initial HTML loads, but all subsequent parallel requests for static chunks and API calls instantly fail after a login attempt. My NPM logs show: 104: Connection reset by peer in SSL handshake while SSL handshaking to upstream 2026/10/10 08:40:08 [error] 937#937: *53149 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 192.168.20.2, server: forti.local.net, request: "GET /favicon/favicon-16x16.png HTTP/2.0", upstream: "https://192.168.1.1:443/favicon/favicon-16x16.png", host: "forti.local.net", referrer: "https://forti.local.net/login?redir=%2Fprompt%3FviewOnly%3D" What I tried (without success):    Restarted the httpsd process.     Forced proxy_http_version 1.1 in Nginx to prevent HTTP/2 connection spikes.     Toggled SNI (proxy_ssl_server_name) and session reuse.     Tried SSL-offloading