New Member

Solved

FortiClient 7.4.1 to 7.4.3 Update broke SAML via FireFox Dev Edition?

10 replies
4421 views

Hi Folks,

I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.

It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.

I hear anecdotally that others using regular Firefox are not experiencing this issue either.

I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes.

Any thoughts? I'm at my wits end a bit here.
I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place to start.

To get back to normal though, I'm not above hounding them if it comes to it!

Cheers.

sam_shannon_dialogAnswer

New Member

Eventually found the solution to be a very strange one.

If the proxy settings for the browser are "Use System" in Firefox/Dev Edition, FortiClient will always crash when the browser tries to finalise the auth with it. Even if the "System" proxy settings are to use no proxy.

The solution is as simple as changing the browser proxy setting to "None".
Though it may also be possible to futz with the windows proxy settings in a way that also fixes it, there's not a lot you can edit when it's not configured to use one in the first place.

sam_shannon_dialogAuthor

New Member

Replying to add, I've found entries in the Event Viewer (should've looked there sooner!), corresponding with every failed attempt.

I don't see an 'attach log file' mechanism, so here goes:

Log Name:      Application Source:        Application Error Date:          25/08/2025 11:46:12 AM Event ID:      1000 Task Category: Application Crashing Events Level:         Error Keywords:       Description: Faulting application name: FortiTray.exe, version: 7.4.3.1790, time stamp: 0x67db43fc Faulting module name: ucrtbase.dll, version: 10.0.26100.4768, time stamp: 0xdbb54def Exception code: 0xc0000409 Fault offset: 0x00000000000a4ace Faulting process id: 0x454C Faulting application start time: 0x1DC1561B5BF1F06 Faulting application path: C:\Program Files\Fortinet\FortiClient\FortiTray.exe Faulting module path: C:\Windows\System32\ucrtbase.dll Report Id: 3cc35272-204d-493f-a960-1ae004cc7f61 Faulting package full name:  Faulting package-relative application ID:  Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">   <System>     <Provider Name="Application Error" Guid="{a0e9b465-b939-57d7-b27d-95d8e925ff57}" />     <EventID>1000</EventID>     <Version>0</Version>     <Level>2</Level>     <Task>100</Task>     <Opcode>0</Opcode>     <Keywords>0x8000000000000000</Keywords>     <TimeCreated SystemTime="2025-08-25T01:46:12.8376535Z" />     <EventRecordID>36007</EventRecordID>     <Correlation />     <Execution ProcessID="2304" ThreadID="5088" />     <Channel>Application</Channel>     <Security UserID="S-1-12-1-4002431670-1296531492-3726831525-3275369221" />   </System>   <EventData>     <Data Name="AppName">FortiTray.exe</Data>     <Data Name="AppVersion">7.4.3.1790</Data>     <Data Name="AppTimeStamp">67db43fc</Data>     <Data Name="ModuleName">ucrtbase.dll</Data>     <Data Name="ModuleVersion">10.0.26100.4768</Data>     <Data Name="ModuleTimeStamp">dbb54def</Data>     <Data Name="ExceptionCode">c0000409</Data>     <Data Name="FaultingOffset">00000000000a4ace</Data>     <Data Name="ProcessId">0x454c</Data>     <Data Name="ProcessCreationTime">0x1dc1561b5bf1f06</Data>     <Data Name="AppPath">C:\Program Files\Fortinet\FortiClient\FortiTray.exe</Data>     <Data Name="ModulePath">C:\Windows\System32\ucrtbase.dll</Data>     <Data Name="IntegratorReportId">3cc35272-204d-493f-a960-1ae004cc7f61</Data>     <Data Name="PackageFullName">     </Data>     <Data Name="PackageRelativeAppId">     </Data>   </EventData> </Event>

AEK

SuperUser

Hi Sam

Can you redo the test when Windows' firewall is disabled?

AEK

sam_shannon_dialogAuthor

New Member

Not without negotiating the process with my company IT department, so I'll add that to the backlog of checks to try if nothing I can try without them gets any results.

Will let you know, cheers!

sferoz

Staff

Hi sam_shannon_dialog,
Is the same issue occurs on other browser chrome,IE,edge etc. Are there any other changes apart from the FCT upgrade?
Can you help share the FGT version, TAC case no if any created for the issue for more investigation.

sam_shannon_dialogAuthor

New Member

Hi,
No, as mentioned, Chrome and Edge do not experience the same issue.

No other changes apart from the FortiClient upgrade.

Not sure what FGT is, nothing in my task manager shows a 'G'-starting word after FortiClient:

Unless it refers to FortiGate? Which is not something me or my company manage, so I can put in a request to find out, but who knows when that'll happen.

Not sure what a TAC case no is, but this is the sole avenue of support available to me. Anywhere else I ask about the VPNOnly FortiClient software I get rebuffed because they don't offer support for it.
Cheers.

ebi1

New Member

hello,

since a few days ago I have a similar problem on one windows 11 client with saml authentication: when the external browser (any browser) callback on 127.0.0.1:8020 it does not find anything listening on port 8020;

there is notthing using port 8020 and I also see the error posted by Sam for fortitray.exe and ucrtbase.dll in event viewer;

the problem is not the firewall/antivirus (it's ESET , we have rules to allow forticlient, but we did also test disabling it);

reinstalling forticlient and visual c++ runtime (ucrtbase.dll belongs to this runtime) does not fix.

Using FortiClient internal browser fix the problem, maybe because it does not need to callback on the web service on tcp/8020, but is not an option for us to use internal browser.

it looks like a client side problem, as we have hundreds of other client working correctly with the same configuration

any hints? did someone saw problem like this?

ebi1

New Member

hello,
for the records, I tell all of you that we did solve with some OS file cleanup:

DISM.exe /Online /Cleanup-image /Restorehealth

sfc /scannow

PS someone did suggest to also follow this tip: https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-not-appearing-in-system-tray-on/ta-p/344280

sam_shannon_dialogAuthor

New Member

After subsequent testing, I've determined that the issue does not arise when tested on:

Edge
Chrome
Firefox

So it's an issue seemingly specific to Firefox Developer Edition.

I've tested with Firefox Dev Edition in Troubleshooting mode (disabled extensions, themes, and custom settings) and it still failed in the same way.

I also tried installing a User Agent switcher and having it pretend to be Chrome, but it still caused the same error.
The installed version of vcredist seems to be the correct (ie: latest) one.

Still at a complete loss as to the cause. The only change was the version of FC is newer...

sam_shannon_dialogAuthorAnswer

New Member

Eventually found the solution to be a very strange one.

If the proxy settings for the browser are "Use System" in Firefox/Dev Edition, FortiClient will always crash when the browser tries to finalise the auth with it. Even if the "System" proxy settings are to use no proxy.

The solution is as simple as changing the browser proxy setting to "None".
Though it may also be possible to futz with the windows proxy settings in a way that also fixes it, there's not a lot you can edit when it's not configured to use one in the first place.