Support Forum

Hello guys, I am currently facing an issue with user authentication when connecting to dialup IPSec IKEv2 VPN using SAML authentication through FortiAuthenticator.Ending with this error:Generated some random hash or something instead of user name and reason is SAML auth resp is not detected. Here is part my configuration:config system global     set auth-ike-saml-port 1001     set remoteauthtimeout 120 config user saml    edit "saml_FAC"    set cert "*.secret-2026"    set entity-id "http://vpn.secret.cz:1001/remote/saml/metadata/"    set single-sign-on-url "https://vpn.secret.cz:1001/remote/saml/login/"    set single-logout-url "https://vpn.secret.cz:1001/remote/saml/logout/"    set idp-entity-id "http://fac.secret.cz:4433/saml-idp/ipsecvpn/metadata/"    set idp-single-sign-on-url "https://fac.secret.cz:4433/saml-idp/ipsecvpn/login/"    set idp-single-logout-url

Hello, I would like to know if someone know how can deal with this kind of information leakage. After doing some tests, i didn't see any log using this kind of app "googlesyncfs.exe". Therefore, i cannot create any policy in FortiDLP to avoid this kind of information leakage. It seems like that app ofuscates this file transfer making it really hard to monitor the activity. I've seen that there's one post about drag and drop block uploads by default using FortiDLP, but i doesn't work in this case. I really appreciate any kind of tips you can give me. Best regards.

Hi Everybody,As we (hopefully) all know, SSLVPN tunnel mode will be discontinued in FortiOS 7.6.3. This is definitely a step in the right direction and I don't challenge that decision at all.Now, there's a lot of guides to move to DialUp IPSec and ZTNA. The thing is however, it all is so cumbersome compared to SSLVPN. For instance:- With IPSec, you need to deploy either a PSK (which is not very wise) or certificates, but if you have some external user you'd need to give him a certificate and it's already hard enough if you just have a user/password combo.- With IPSec you can do SAML, sure, but you still need a PSK or a certificate.- ZTNA is nice and all, but you can't have a tunnel which is essential for many of the use cases that revolve around managing devices that are attached to the network (think of: building automation, things like that)...and the list goes on. There's just no easy solution from Forti which I am aware of.So, right now, we're evaluating another approach, basically

Hello everyone, I am new to Fortinet products and have two questions regarding password history thresholds and account lockout settings. I have already reviewed the available online documentation and community forums but was unable to find definitive answers.  Thank you. How can I check the current account lockout settings from the command line? The documentation I found only explains how to configure (set) these values, but not how to display the existing configuration.config system global set admin-lockout-threshold <failed_attempts> set admin-lockout-duration <seconds> end 2. What is the expected outcome if the Password history threshold is set to 3, while Allow password reuse → Specify is set to 8? According to the administrator guide, the reuse value must be lower than the password history threshold. In this case, which setting would take precedence, and how would the system enforce the policy?   

It was updated to this version and the eye icon that allowed you to see the password in plain text no longer appears in the wireless controller where the SSIDs are located. Any Help?

With FortiAuthenticator we have correctly installed everything for MFA with Windows. Login works properly, but the offline token is not working.We have enabled everything according to the guide, and everything appears to be configured correctly, but in the log there is a 403 Forbidden error on the REST API callI am attaching the log.Could that be the reason why the offline token is not available? What could the issue be?Thanks to anyone who can help me. 2026-02-11 10:47:05,149 [8900| 28|DEBUG] RestAPI: GetOfflineTokens queued asynchronously2026-02-11 10:47:05,165 [6592|14024|INFO ] :  Credential::FetchEmergencyToken: Sending EmergencyTokenRequest to service2026-02-11 10:47:05,165 [8900| 17|DEBUG] FAC_Agent.Service.Impl: Processing EmergencyTokenRequest for domain: xx, username: xx, UPN: xx2026-02-11 10:47:05,180 [8900| 36|ERROR] TwoFactorAuthenticator: WriteOfflineTokens: cannot proceed because of bad server response: 403...2026-02-11 10:47:05,227 [8900| 36|DEBUG] RestAPI: Ca

Hello, I opened a case with support asking about a 7.4.4 version of Forticlientvpn only for windows , they suggested we post here.  My questions are:1) Is there a version of forticlient vpn only 7.4.4 coming out for windows?2) If no can you verify if forticlient vpn only 7.4.3 for windows is not susceptible to https://fortiguard.fortinet.com/psirt/FG-IR-25-685 Thanks!

 Hi all,I would like to clarify a best practice regarding the management of local users on FortiGate when the device is managed by FortiManager.Scenario:FortiManager 7.6.xFortiGate clusters running FortiOS 7.4.xDevices are fully managed by FortiManager (policy packages and device settings)Multiple VDOMs in useQuestion:Local users are configured under:config user localThese users are used for:SSL VPN authenticationExplicit proxy authenticationFrom my understanding:Local users are defined directly on the FortiGateFortiManager does not natively manage them as part of policy packagesWhat is the recommended approach in production environments?Specifically:Is it considered best practice to manage local users directly on the FortiGate even when the device is managed by FortiManager?Is there any supported/reliable way to manage local users from FortiManager without risking inconsistencies or purge during install?How do you handle scenarios where local users are actively used (e.g. proxy o

We have about 60 FortiGates connected to a FortiManager.  The FortiManager is only used for config backups.  I want to setup firmware updates to install automatically once they are released. If we did not have a FortiManager I could simply enable automatic firmware updates.  Because it is connected to a FortiManager those are disabled.  I reached out to FortiNet Support and worked with a tech and we found no way to enable them from the FortiGate side.  Blocking FortiManager does not allow for the local setting to be enabled. In the FortiManager I am not seeing a way to setup automatic firmware updates, or enable the automatic firmware updates to be enabled on the FortiGate. I see I can schedule FortiGates to update to 7.4.11 on Sunday of this week, but it looks like I have to manually adjust that every time a new firmware comes out.  We don't want all the FortiGates to update on the same day, so we will have several of these to spread out th

I've just installed  FortiClient VPN  the .deb package from here https://www.fortinet.com/support/product-downloads .installed with `sudo dpkg -i ...` Setupd the configuration ( as I have on my windows pc and on my android ) when I try to connect I get the following in the journal:    iul 29 14:23:43 station1 kernel: iked[283119]: segfault at 28 ip 000000000045195d sp 00007ffe2a7e6900 error 4 in iked[400000+891000] iul 29 14:23:43 station1 kernel: Code: 4c 89 e5 48 89 44 24 38 48 8d 84 24 88 00 00 00 45 89 d4 45 89 de 48 89 44 24 50 48 8b 45 00 45 89 f5 31 ff 31 db 4a 8b 0c e8 <8b> 51 28 85 d2 74 42 48 8b 71 20 8d 7a ff 31 db 48 8d 46 08 4c 8d iul 29 14:23:43 station1 fctsched[283131]: /opt/forticlient/iked: invalid option -- 'P' iul 29 14:23:43 station1 regolith.desktop[281914]: 14:23:43.573 › VpnHandler UNHANDLED {"isTrusted":true} iul 29 14:23:43 station1 fctsched[283131]: DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus iul 29

I am diving into the world of ZTNA and figuring things out still. Ai is suggesting the use of a loopback interface, but I am not really seeing much in regards of any documentation of ZTNA and loopback together. It's suggestion was to create a VIP to my loopback, specifying my loopback in my ZTNA server config, then if I wanted to have the same consistency between my internal and external users, to hairpin ZTNA so those internal users hit my public IP. Thoughts?

Hi all, I tried installing forticlient VPN onto my new computer - Surface Laptop 7. However, it shows the following error. Anyone able to support to rectify this issue? 

LS, We have on multiple locations a distribution layer consisting of S424F switches with the S148F or E or S124F or E versions in the access layer. We have seen on one location the following error message in the analzyer. On one location we had a complete network black out.On one location we are having currently cisco switch in de access layer and are installing the S148F units and connecting them to the distribution layer. Only connecting causes intermitting networking issues. To mitigate this we have disconnected the new switches from the distribution layer and the migration project is currently paused. We are running 7.4.8 or 7.4.9 FortiOS on all our switches. Looking around, are we on our own, I did find this one.https://www.reddit.com/r/fortinet/comments/1rv2i1g/high_cpu_spikes_on_fortiswitch_148ffpoe_when/So the good news is we are not alone.  Looking into the Analyzer, Logview, Event, Switch Controller (filter=msg~"CPU_SENSOR")datetimevdtypesub

 Hi everyone,I am experiencing a very strange display behavior on my FortiLink topology after adding a new device.Context and Versions:FortiGate: FGT-200F running v7.2.13 build 1762 (Mature)FortiSwitches: 8x FSW-148F running v7.6.6 build 1137Topology managed via FortiLink.Issue Description: Up until yesterday, I had 7 switches deployed and everything was working perfectly. The physical inter-switch links (ISL) appeared correctly in the "FortiSwitch Ports" section as "dedicated to connect to peer FortiSwitch".Then, I added an 8th switch ("03" on image 1) using our standard procedure, daisy-chaining it behind another FortiLink-managed switch ("02"). Right after connecting it, ALL our switches lost the "dedicated to connect to peer FortiSwitch" status on their uplinks/downlinks.Now, the physical ports connecting the switches together appear as shown in screenshot #2:They are tagged as simple "Edge Ports".Their Native VLAN is _default.Forti_Link (_default) and Allowed VLAN is quaranti

I'm trying to install the FortiClient package on Fedora Workstation 43, which doesn't seem to be properly tested for this distro. I am using the official guide mentioned here. The reason for posting the issue here in the community is to gain the attention of FortiClient developers so they can resolve the issue promptly.   ~ sudo dnf install forticlientUpdating and loading repositories:Repositories loaded.Package Arch Version Repository SizeInstalling:forticlient x86_64 7.4.6.1867-1.el7 repo.fortinet.com 611.7 MiBTransaction Summary:Installing: 1 packageTotal size of inbound packages is 186 MiB. Need to download 186 MiB.After this operation, 612 MiB extra will be used (install 612 MiB, remove 0 B).Is this ok [y/N]: y[1/1] forticlient-0:7.4.6.1867-1.el7.x86_64 100% | 4.0 MiB/s | 186.5 MiB | 00m47s-------------------------------------------------------------------------------------------------------------------------------------------------[1/1] Total 100% | 4.0 MiB/s | 186

Hello everyone,we would like to distribute an IPSec tunnel configuration to other users, including external contractors, using the export/import of an XML file.However, I’ve noticed that when a user imports such an XML file, it overwrites all previously configured tunnels.Is there any way to create an XML file that allows users to import only one or several tunnels in a simple and user-friendly way, without replacing all existing ones?Thank you very much in advance for your help!

Hi all,Has anyone experienced an issue where, after a FortiManager upgrade, routing entries were unexpectedly removed from a routing template?In our case, four static routes (including the default route) disappeared from the routing template itself — not directly from the FortiGate configuration, but from the template in FortiManager. As a result, when templates were pushed, the routes were also removed from the managed devices, causing connectivity issues.Additionally:The routes were no longer present in the template database after the upgradeRe-adding them led to conflicts during install (likely due to ordering or object inconsistencies)I’m trying to determine whether this behavior is:A known issue related to template migration during upgradeA change in how routing templates are handledOr a one-off corruption/inconsistencyHas anyone seen similar behavior or has insight into this?Thanks!

 Upon opening Forticlient VPN a bunch of users seem to get this error, the only work around so far was uninstalling and re-installing. However noticing that this problem comes back again after a while. System is Windows 11 25h2 with latest updates. Visual C++ latest redistributables installed.  What other    

Hello Community: any idea of strategy for the migration of FortiManager and FortiAnalyzer managing an SDWAN architecture of concentrator in HA and spokes from a VM of a Service Provider to my Data Center with physical appliances. Best regardsCC

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

I'm a home lab user, and as such I don't have a full EMS configuration setup. However, I do have a couple of linux boxes out in the wild (my kid, and myself each have a couple). When we were running SSL VPN on my 60F, there was no issue. However, with it having been depricated and my possibly moving to a 90G in the near future, I'm looking for the next best option. After doing some research, it appears that the FortiClient VPN (Free) version no longer supports IPSec on Linux. In the past, if I wanted to connect Linux to a SonicWall, WatchGuard, or pfSense box, I would use OpenVPN. So, I'm asking the community if they have used it to access their home lab remotely without having to rely on a secondary server sitting behind their gate.

Hello there,We have a couple of challenges in deploying FortiGate and FortiWeb on EVE-NG Community in the Lab. As you know, the current exam version is based on FortiOS 7.6 and this renewing is probably going to continue, which means we have to get ready for next versions. The problem is:1. When we download FortiGate 7.6.4 & 7.6.3, both version looks incompatible with EVE-NG on VMWare workstation (25H2 and 17.5) and Hyper-V. The former hangs in "Formating shared partition and the later hangs in a stage ahead (somewhere logging about IPS..... ). Some folks advised using V7.2.x or... . But, this is not the answer I'm looking for. Same problem with last to versions of Fortiweb. 2. As you all may knows, Fortinet has made changes in licensing policies. Reports says V7.6 needs a valid license even for lab setup. This makes the case a little complicated, because we could use a 2-months Eval license before. If your recommend is to raise a ticket and asking for Evaluation license,

Hello community , If I use certificate inspection in an SSL/SSH inspection policy, users don’t need to have the certificate installed on their machines for basic URL filtering. However, for blocked pages, will users see the block banner? I assume they won’t. In that case, I would need to install the certificate on their devices, right? If so, does that mean there’s no real benefit to using certificate inspection if you don’t want to install certificates on guest machines? please suggest. basically customer want filtering but with no certifcate install.

Hi,I use the FortiClient Single Sign-On Mobility Agent and I am facing an issue: FAC registers all user IP addresses.Let’s consider two users: one connected remotely through VPN and one connected from the corporate LAN. The home network IP address of the remote user overlaps with the IP address of the user in the corporate LAN. As a result, one of the users is removed from FortiGate/FAC with the following error:Internally logoff and removing FortiClient item 11024-HR.xxx.xxx:192.168.12.26 [xxx.xxx/j**bleep**h] (all IPs conflicting).I believe that during the initial FAC/EMS configuration I chose the option to register all IP addresses, but now I cannot find this setting. I am not sure whether I am simply overlooking it or whether it disappeared after an update.How should this be handled?Regards,Lukasz

Hello everyone,We are currently in the design phase of an ingress security architecture in AWS and have not implemented anything yet. We are seeking guidance, reference architectures, and best practices to help us design this correctly.Proposed Architecture (Under Consideration)Internet → External NLB (TLS pass-through) → FortiGate-VM instances (inspection layer) → Internal ALB → Web applicationsThe external NLB would be internet-facing and handle TCP/TLS pass-through (no SSL termination).Traffic would be forwarded to FortiGate-VM (NGFW) instances for inspection.After inspection, traffic would be sent to an internal ALB, which would perform:HTTPS terminationHost-based routing (e.g., app1.example.com, app2.example.com, etc.)The internal ALB would route traffic to backend targets (EKS / ECS / EC2).GoalsAt the FortiGate layer, we aim to:Apply web filtering policiesPerform deep SSL inspection (if feasible)Allow only clean/validated traffic to reach the internal ALBAllow specific domains, U