Skip to main content
Tutek
Tutek
New Member
June 24, 2026
Question

FTP Push on two WANs

  • June 24, 2026
  • 3 replies
  • 68 views

Hi,

I now create additional dialup tunnels on second wan for failover, but we use ftm to get notifications during login on mobile smartphones, the config looks like:

FGT (ftm-push) # show full-configuration 
config system ftm-push
    set proxy enable
    set interface ''
    set server "PUBLIC_IP_OF_WAN1"
    set server-port 4433
    set server-cert "Fortinet_Factory"
    set status enable
end

how to configure ftm to have it working on WAN1 and WAN2 interfaces, because If I’m trying to configure it on both wan ports I get an error:
 

FGT (ftm-push) # set interface "port24" "port23"

command parse error before 'port23'
Command fail. Return code -61

 

3 replies

sjoshi
Staff
sjoshi
Staff
June 24, 2026

Ideal solution would be using fqdn instead of IP address and creating dns host entry to resolve the fqdn to both IP address.
config system ftm-push
    set proxy enable
    set interface ''
    set server "myfortigate.fortiddns.com"
    set server-port 4433
    set server-cert "Fortinet_Factory"
    set status enable
end

Thanks, Salon
    Tutek
    TutekAuthor
    New Member
    June 24, 2026

    Now all my Forticlients have as gateway dns address like vpn.mydomain.com, and this domain have dns A entry point to wan1 address, do you mind to create another A entry with ip address of wan2? How then the connection is established based on what? If two IP addresses point to a single domain?

    sjoshi
    Staff
    sjoshi
    Staff
    June 25, 2026

    You can setup one FQDN say  vpn.mydomain.com and it should resolved to wan1 and wan2 IP address.

    In this case the user can connect to any one of the IP address while initiating the traffic.

    Either you can setup dns failover

    May refer:

    https://support.dnsmadeeasy.com/hc/en-us/articles/34326987291291-How-to-Set-Up-DNS-Failover

    Thanks, Salon
      Tutek
      TutekAuthor
      New Member
      June 25, 2026

      Ok, so I have changed the server settings to: “vpn.mydomain.com” when I do on Fortigate execute ping to that FQDN then my public IP is responding.
      But once I get push notification to approve the connection, then after hit approve I have all the time the error:

      “The network connection appears to be offline. Request not send succesfully.”

      sjoshi
      Staff
      sjoshi
      Staff
      June 25, 2026

      you can take a sniff on port 4443 on the FGT and check if traffic is coming on the FGT

      Thanks, Salon
        Tutek
        TutekAuthor
        New Member
        June 26, 2026

        After authorization, popup to enter the code appears, on the Fortigate I have in sniffer:

        FGT # diagnose sniffer packet any 'port 4433' 4 0 l
        interfaces=[any]
        filters=[port 4433]
        2026-06-26 08:43:18.711858 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:18.711928 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:19.714194 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:19.714211 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:20.111762 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:20.738746 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:20.738781 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:21.763535 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:21.763553 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:22.311751 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:22.786523 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:22.786567 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:23.811311 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:23.811330 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:25.860291 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: syn 667872197 
        2026-06-26 08:43:25.860309 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:26.511742 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:34.511752 port24 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:50.511747 port23 out wan1_public_ip.4433 -> 3.129.187.38.44548: syn 3894029500 ack 667872198 
        2026-06-26 08:43:50.631980 port24 in 3.129.187.38.44548 -> wan1_public_ip.4433: rst 667872198

        on Mobile Phone I click Accept the connection, but after a while I get “The network connection appears to be offline…..”

        sjoshi
        Staff
        sjoshi
        Staff
        June 26, 2026

        seems your tcp handshake is failing

        fgt is receiving the sync packet and sending the sync-ack but do not see ack coming from the client

        Thanks, Salon
          Terms & ConditionsAccessibility statement