Support Forum

The IPsec VPN (remote access) is configured, and we are using Cloud Authenticator as the RADIUS server with 2FA enabled. IKE -1 we are using and as per (Peter TAC engineer ) the EMS does not support IKE-1 in 7.4.4 version. I'm not receiving the token and TAC also unable to provide the solution yet, It has been pending from last 14 days.  Regards,Rohit

Here you can find all important FortiGate CLI commands for the operation and troubleshooting of FortiGates with FortiOS 7.4.  SystemGeneral System Commands   get system status General system information exec tac report Generates report for support config, get, show, tree set, unset, append, unselec Configuration commands <command> ? or tab Use ? or tab in CLI for help <command> | grep [-f] Grep command to filter outputs diag debug cli 7 Shows webGUI changes in CLI   Process Information   get system performance status General performance infos diag sys top [sec] [number] Control + C to stop command Process list Sort with P (CPU) / M (Memory) diag debug crashlog read Crash log  Network Network Interface Information   diag ip address list            &

Hi,I have created a remote IPsec VPN for remote users. the users can connect to the VPN.However, they can't access anything in the LAN behind the FortiGate through HTTP or HTTPS.For example, I can SSH to the FortiGate to manage it; however, I can't access it through HTTP/HTTPS.I don't have a route issue because I have ping/ssh to the FortiGate/LAN behind it. I don't have a Policy issue as I have allowed all the services.Model: 401FVersion: v7.6.4.

Hello FNAC adminsOn the support portal, image download, under FortiNAC-F > v7.00 > 7.2 > 7.2.9, I found this file: FNAC_install_7.2.9_build0166.bin.Made some searches but couldn't find anything about it.Do you have any idea?Is it for manual installation on a Linux server?If so then why it is not documented? And if so then is it supported?

Hi. VPN setting guide in the FortiSASE document doesn't have ikev1, it means IKE version can use only ikev2?And is FortiSASE's VPN IKEv2 not supported on Android?Does SASE have the ability to set up Android and SIA?Thank you

Hello,After upgrading FortiGate to version 7.6.5, we encountered issues with IPsec tunnels. According to the Fortinet technical article, the default Diffie-Hellman group values were changed from  5 to 14, 20, and 21. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-tunnels-not-connecting-after-upgrade-to-v7-6/ta-p/423320 Current situation:On PC clients, the issue was resolved by changing the configuration and setting matching DH groups (14, 20, 21) on both sides of the connectionTunnels are working correctly after synchronizing the settingsProblem: The FortiClient VPN application on Android does not have the option to select DH groups higher than 14. As a result, mobile users cannot establish VPN connection after the FortiGate upgrade.Questions:Is there a planned update for FortiClient Android application with support for DH groups 20 and 21?What is the recommended temporary workaround - should we roll back the configuration on FortiGate to older DH groups

 after changing the Admin sport to 4433 i get the "Connection lost. Press Enter to start a new session." in the clichanging back to 443 and it's all good.   factory reset, no help. any ideas?  

We have a hit and miss issue accross multiple sites.  We are using WPA 2 Enterprise authentication via LDAPS on Fortigate 60F and 80F firewalls. When I test the connectivity under User Authentication, the accounts are authenticating without issue, but when used to connect to the wireless network, it fails with a message stating "unable to connect to network" On some Fortigates it works without issue and on others it does not.  The firmware is more or less the same but the issue is across multiple firmware tracks. The firmwares I am using is the latest version under 7.0,7.2,7.4 and 7.6 I noted that on the firewalls where it works, under Log>WiFi Events, the authentication session shows the username of the person attempting to log in.  On the firewalls where wireless authentication does not work it shows the user as N/A under WiFi Events.

The RSS feed that provides product firmware release information is suddenly missing FortiOS versions 7.4.x and 7.2.x even though are still under support. These just recently went missing and only versions 7.6.x and 7.0.x are showing within the feed. Can this please be looked into?

In recent days, we have received tickets from users reporting that FortiClient is not running on their computers. The symptom is that when the FortiClient icon is selected, a blank window opens and immediately closes. When run again, it does nothing. In the task manager, the FortiClient process was visible but did not perform any action. This has already occurred on four computers, and as a reactive measure, FortiClient was uninstalled and reinstalled. This occurred on computers running versions 7.4.3 and 7.4.5. I am writing in this forum to ask about a possible solution to this problem in case it becomes widespread and to find out if it has happened to anyone else. In the release notes, there is a bug with ID 1226762 that is very similar to the case I am presenting, however, we do not have computers with AMR64 Windows.  

Hello, we are using the free version of FortiClient to connect users to our Fortigate and have since used SSLVPN. We are trying to transition to IPsec but I'm having trouble trying to automate the process of installation and configuration. I've tried this technical tip:Deploy the FortiClient VPN configuration ... - Fortinet Community which mostly works with the exception of the PSK, I have to enter it manually on every device for it to connect. Is there a workaround for this? According to the technical tip it should work this way Thanks in advance

Hi, Good day, here's my scenario. I have an existing FG100F in my infrastructure that's connected to the production environment. I have another FG100F that's connected to 2x stacked C9300 that I'll introduce to my network (main reason for this change is the replacement of old C3560 to C9300 with SFPs as well).  See diagram below   FG100F-1 is the Prod firewall that I have access to. Its connected to FG100F-2 on the mgmt port (mgmt-mgmt).  I can access FG100F-2 via CLI (thus I can also ssh towards the 2 C9300 switches) although I would really love it if I can access the console webpage of FG100F-2 so I can compare the firewall rules from the 2 firewalls. So is there a way to access the 2nd firewall thru mgmt? Should I have connected it to a different interface besides mgmt? I'm wary doing too many changes on the 1st firewall since its in Prod but I'll make the necessary changes to access the web console of the 2nd firewall. Thanks

Dears,Kindly note that we are experiencing SSL VPN disconnections and slowness after we upgrade the frameware to 7.0.17. The issue affects all users, and the only temporary workaround is to restart the firewall.Unfortunately, after some time, the same issue occurs again. We would appreciate your support in investigating the root cause and providing a permanent solution. Regards,

We are using services from a partner using Fortinet. Our platform is Linux, and I am connecting using Strongswan. Connection works ok (phase 1 and phase 2). I get a tunnel, but it appears that the routes are not created. Traffic is not routed over the VPN.  What do I need to do to establish the routes to route the traffic over the VPN? 

I have many times connected  #FortiGate to the internet with PPPOE in different countries. But last week I encountered a major problem, and my device could not connect to the service providerThe modem was put into bridge mode.Test several different FortiGate Firmware versions .I called Deutsche Telekom technical support and asked them for help, and they said to be careful how to write the Username, but again the connection was not established.After a whole search, I found out that the VLAN7 tag is active from the provider's side, I activated it and was able to connect to PPPOE.   

I am traying to test multicas for a prouect using VLC. I have enable ping with igmp v3, configured a static RP, created multicast polices and regular policies and it's not working.I decided to test from the Fortigate to the other aide of the network to see where was the problem. I started testing then on the same switch that has the vlan thru FortiLink and it does work.Enabled another port on the Fortigate with a different submet and created the needed policies and it does not work.I tried disabling multicast-forward with no luck, I also increased the TTL to 100 in the VLC.I see the source transmitting the video in the captures and I also see the potential receiving requesting the appropriate group thru the 224.0.0.22, he is requesting the group that is transmitting the video but the Forti does not forward the video. This does not make sense to me, they are both connected on the same Fortigate

Hi In summary between 45 Minutes to every 3 hours, every single IpSec VPN Tunnel gets torn down with a DPD-error. An example log I have included below. GeneralAbsolute Date/Time2026-01-04Last Access Time14:45:21VDOMrootLog DescriptionIPsec DPD failedSourceLocal IPXXXXFortiClient ID7D7A0CD5D9574D5AB509F5519F68B9F8UserXXXXGroupN/AXAUTH UserXXXXXXAUTH GroupFortiClient UsersActionActiondpdStatusdpd_failureSecurityLevel       ErrorEventAssigned IPXXXXXCookiesc7e291824a726956/c9f2b20f46158b9fLocal Port4500Outgoing Interfacewan1Remote IPXXXXXXRemote Port64917VPN TunnelForticlient VPN_0MessageIPsec DPD failureOtherLog event original timestamp (µs)1767537921187226000eventtime_raw_value1767537921187226120Log ID0101037136TypeeventSub TypevpnAlternate UserN/AADVPN Shortcut0 Below is the my current configuration for IpSec VPN Phase 1:config vpn ipsec phase1-interfaceedit "Forticlient VPN"set type dynamicset interface "wan1"set ip-version 4set i

Hi,I followed this article:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Correctly-configuring-Two-Factor-Authentication/ta-p/191794I created an AD group named “ssl-vpn” and assigned a user to it. When I create a group on the FortiGate and add the LDAP remote group, MFA is bypassed. The FortiGate only checks whether the user belongs to the AD group. I verified this by removing the user from the AD group after that, the user is no longer able to connect.However, when I configure it exactly as described in the article, authentication is redirected to the FortiToken MFA. In this case, the FortiGate only checks that the user exists in AD, but it does not verify membership in the “ssl-vpn” AD group.I tested this by removing the user from the “ssl-vpn” group in AD, and the user is still redirected to FortiToken MFA and is able to connect successfully.What I am trying to achieve is the following flow:First, verify that the user is a member of the “ssl-vpn” AD group.Only if the use

Hi. I can't sync with the ntp server after using executetime xx:xx:xx in Fortianalyzer.It is the same even if the ntp status is disabled and enabled.Is there an ntp sync command on Fortianalyzer?In the case of Fortigate, I can find out when it was last synced through the 'execute time' command, but how do I check it in Fortianalyzer? Thank you

 Hi all,Is there anywhere to download a full FortiOS JSON reference/schema file?On a live FortiGate, I can retrieve schema/details for some API areas, but not for CMDB.These endpoints work and return schema/info:GET https://<fgt>/api/v2/serviceGET https://<fgt>/api/v2/logGET https://<fgt>/api/v2/monitor…but this does not:GET https://<fgt>/api/v2/cmdb → returns { "status": "error" }Is there an official way to retrieve a CMDB schema/field reference in JSON (or generate one), or is the only option to rely on the docs and/or query each CMDB path individually?from what I can tell on FNDN, the JSON schema/reference can only be downloaded endpoint-by-endpoint, and there doesn’t seem to be any option to download a single combined “full” schema file.I noticed the schema responses include references like:  "id": "http://schema.fortinet.com/fos/api/v2/monitor/azure/application-list.json","$schema": "http://json-schema.org/draft-07/schema# …but http://sc

Hello,I am performing an EICAR test on a FortiGate 60F running v7.4.6 with only the Antivirus feature enabled under Security Profiles in the policy.While accessing the EICAR test files from Chrome, I noticed that sometimes the FortiGate displays the replacement block page, but other times it does not.Do you know why the block page is not displayed in certain cases?Here is what I observed: ・Block page does not appearAfter clicking the download button, the FortiGate log shows that the file is blocked by Antivirus, but the browser displays “This site can't be reached” instead of the replacement block page.Even on subsequent attempts, the block page does not appear.- eicar.com- eicar.com.txt ・Block page appears normallyAfter clicking the download button, the file is blocked by Antivirus and the browser correctly shows the replacement block page.- eicar.com.zip- eicar.com-2.zip  If anyone knows the reason for this difference in behavior, I would appreciate your insights.

Hola gente, tengo un problema con el rendimiento de mi vpn sistema to site , tengo microcortes solo con los servidores con distro linux, especialmente con sap B. One. No se si hay una configuración especial que se deba hacer?

I have a bunch of sites that have a FortiGate and a Netgear switch.Port 1 on the firewall is a hardware switch (LAN), and Port 1 then connects to the Netgear. We also have a voice VLAN as a sub-interface of the hardware switch.We are migrating these switches to FortiSwitch soon and are seeking the most effective way to do so. We have a couple of sites that use FortiSwitch, but it is an aggregate interface with FortiLink, not a hardware switch interface.Is there an easy way to do this migration without having to completely redo the entire config? We have a fortimanager if that makes any difference.

I have a FortiWifi 30D-POE with power light flashing green. The power adapter is flashing green as well. Console shows nothing. Is there a fix?

Hello, I need to buy some licenses because IPsec over TCP is unsupported and broken in the free client. We have nearly 50 users but only 18 have connected in the last week. Should I buy licenses for everyone? Can I configure EMS Cloud to automatically recycle licenses for all the occasional users? I'm trying to figure out if I should get one 25-pack or two.Is IPsec over TCP reliable enough to replace SSL-VPN?