Support Forum

I installed the FortiGate VM and im experiencing issues when logging in for the first time. After entering the username=admin and then entering the password. The FortiGate prompt for the password to be changed. It prompts for a new password and then just after entering the password the Prompt doesn't go to Confirm Password it instead skips and prompts for a new password again. The system does not allow me to confirm the password. Any idea?  FortiGate-VM64-KVM login: admin                                                                                    &nbsp

All my Android clients running FortiClient VPN 7.4.3 (ipsec/ikev1 + psk + xauth connection type) are unable to connect to my FortiGate after upgrading it's OS from 7.6.4 to 7.6.5.The client fails with "could not estabilish session on ipsec deamon" message. Using "diag debug app ike -1", I can see that phase 1 is completed, user authenticated, tunnel is up (visible on firewall ipsec monitor, but 0 bytes), but phase 2 is never completed. After "negotiation result" is ok and a few lines more, it says: ike V=root:0:VPN-IPSEC_6: tunnel up event assigned address 10.201.109.168ike V=root:0:VPN-IPSEC_6: EMS: FCT UID not ready then the firewall starts a loop of "retransmission" (R-U-THERE/R-U-THERE-ACK), until the client quits.Nothing was changed on the firewall except the OS update.Testing with other clients (not FortiClient) everything works fine.Any idea on the cause/solution?

Hi, I have an issue with use of VRFs.I configured the FGT like descriped in the following instruction: https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/752950 The FGT has two IPsec tunnels, one for primary and one as backup.All traffic has to go through the tunnels, which means there are two default routes with exit interfaces of the VPNs.If I don't use VRF routing, I have to route each specific IP addresse or range e.g. IP of the peer, LDAP or TACACS+ servers and so on via WAN interfaces...So I configured a VRF for the customer intranet, which contains tunnel interfaces and LAN.The other VRF is for the two WAN interfaces primary and secondary. At the end I have multiple (default) routes:- two default routes through the tunnels in VRF1 (different AD)- two default routes through the physical WAN interfaces in default VRF (different AD)- two blackhole routes for each VRFconfig router staticedit 1set device "VPN-RZ"set comment "VRF=1"nextedit 2set dis

What are some of the ways you can place rogue hosts in a isolation vlan ? I know that you can choose a managed switchport and set the port to Forced Remediation/Registration/Default. But that doesn't seem scalable. What happens if a rogue host shows up on a port that is set to "Role Based Access".  In my case, it doesn't pass a Device Profiling Rule so it's just connected, potentially on a production vlan. I would like to create a User/Host Profile that identifies a rogue, and a corresponding NAC Policy to move it to the desired isolation/registration VLAN.  Any ideas ?

I need the installer for the las version of Forticlient VPN 7.0.x (for Windows and MacOS). Is there anywhere I can find it? I've seen some posts within this community that contained a link, but they were all expired. 

Hi , Fortinet Community, I want to install Fortiweb 600F in my Client Infra. I want to install it in Reverse Proxy Mode. Client Network design is this1. Server->Distribution->Core Switches->FortiWeb->Fortigate FW-> ISP Internet + MPLS Links Client has multiple branch offices in country hospital which run erp/web applications from remote locations which will be sitting behind Fortiweb.  Please suggest me either reverse proxy mode is perfect for it?And Suggest what will be network topology and subnets/VIPS.Lets Suppose my server form is using 20.20.20.0/24 subnet and Fortigate firewall working as edge firewall running 10.10.10.0/24 subnet.needs experts and seniors help. Kindly suggest better approach. Can be vips subnet different, how it will route , how other traffic will route, currently gateways of servers configured upon fortigate firewall 

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:1. FortiGate-120G Hardware2. FortiSwitch-1048E4. FortiSwitch-148F-FPOE5. FortiAP-234FWhat concerns me is that, for some of the offices, the only available option for a SSTP VPN tunnel is, due to the fact that the providers block our other VPN solutions.From forums, documentation, and various sources, it is stated everywhere that SSTP cannot be used.Is it true that it is not possible to use SSTP at all?The other question is whether it is possible to control Layer 2 traffic between computers.By this I mean: if one computer attempts to attack another computer, and both are connected to the same switch, is there an integrated tool on the switch that would allow me to detect and block such an attack?Thank you in advance for your time.

Hello Fortinet Community,I Am experiencing an issue with Security Posture Tags on FortiClient EMS Cloud.Environment:FortiClient EMS CloudVersion: 7.4.4 build 2034 (Feature)Client OS: Windows 11Feature tested: Security Posture TagsTag type: OS VersionRule configured:OS Version = Windows 11 (Latest update within 30 days)Issue description:The posture tag is not applied consistently.Sometimes the rule is correctly evaluated and matched, but shortly after, the same endpoint becomes non-matched, even though the system remains compliant (Windows 11 fully up to date).  Tag is matchedTag is not matchedObservations:The endpoint remains compliant (Windows 11 + recent updates)The tag Is sometimes matched, then later not matched without any OS change (always)Questions:Is this a known issue or bug in EMS Cloud 7.4.4?Is There any workaround or recommended fix?Are there specific EMS or FortiClient settings that should be adjusted?Thank you in advance for your help and feedback.

Hello everyone,I noticed today that our EMS sends the message "ZTNA Certificate signed" to all registered clients every 10 minutes. We do not have ZTNA installed and we have not activated it on the clients. Is it because the feature was also installed? Or is there any way to avoid the "spam notification"? Regards.

So, I am having the following issue:I just recently had 2 offices merge in another state and when they brought over the VOIP devices they now have the following issues.- Call will ring and someone will pick it up and it will keep ringing.- Call will jump from one persons phone to another.- Calls will constantly drop voice data (at a very specific time around 11am to 1pm est)We have talked to our provider and they have claimed up and down that it is our network ( issue never happened until we merged these two office locations physically). I talked with some of their support and they asked for a pcap when the issue was happening, but now they are saying that the pcap does not contain "SIP or UTP" data. Is there any way to filter this on the FortiGate 60E? Any Help is appreciated!

Hi all,Regarding the newly published CVE-2025-62631 (https://www.fortiguard.com/psirt/FG-IR-25-411), I was unable to find any information about a fixed release for FortiOS 7.2.x. Not sure whether a fix for 7.2.x branch is planned, and if so, when it is expected to be released?

hi all,may i know the difference creating new vlink with this method compare to using vlan. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Create-new-npu-vlink-for-NP7-model/ta-p/302817 is there any limitation or things to note when creating new vlink with this method ?thank you.

greetings all,here is the topology. let's focus on the left part. MPLS router is a Cisco router, the left L2 switch connected to MPLS router is FortiSwitch (108F).we occasionally lost MPLS connection, and we did see there are some input drops on port 2 (blue arrow pointing to it in the above diagram) of the FortiSwitch (left  L2 switch in the above diagram). see below screenshot.vendor engineer recommended to replace the cable between the mpls router and the left L2 switch. Yes, of course we can do it, but may I know what's the common reason for input drops. MTU on MPLS router is 1500 by default, I don't think this is the problem.Thanks a lot!

This is a weird one. When Forticlient is installed on an iPad, the current update filesize is 12.16Gb. When Forticlient is uninstalled, the iPad only tries to download 3.6Gb. I'm assuming that what's happening is, for some reason, Forticlient changes whether the iPad can use the full update or just the incremental update, but I have no clue as to why that would be the case. Has anyone run into this before?

i have fortigate v 7.4.3  and i see that i use high outbound bandwith and this is not correct their is no one use this value   does it related to update my fortigate

I need to know EOS for FG 3000D

HiCustomer have web connection to local server and I get following error:Profile defaultAttack Name HTTP.URI.SQL.InjectionAttack ID 15,621Reference https://fortiguard.fortinet.com/encyclopedia/ips/15621Incident Serial 73,033,816Direction outgoingSeverityHighMessage web_misc: HTTP.URI.SQL.Injection It seems that Firewall discovers and block malicious access.Now i disable ips on policy rule.How can enable it on this specific server?  

We currently have a dial-up SSL VPN configuration that requires a user to connect using both their Windows AD (LDAP) credentials AND a local computer certificate issued from our internal Windows CA.  On top of that, we use FortiToken with push notifications for MFA on the LDAP user accounts. With the recent push to migrate away from SSL VPN and switch over to using IPsec IKEv2 VPNs instead, I have not been able get the same requirements to work via IPsec. Our setup includes:FortiOS – 7.4.8FortiEMS – 7.4.3FortiClient – 7.4.3FortiToken  Subscription (not cloud)Windows NPS for RADIUS (not FAC) Is this even possible with the above?  Seems like it is supported, but I can not get it to work with NPS. According to the article below, I should be able to get FortiToken MFA push notifications working using local RADIUS user accounts:https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-RADIUS-and/ta-p/220818 …but as soon

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store). All of the Certificates mentioned above are still valid and not expired.&nbs

Hey forum. Real life issues has risen in our short time with fortigate and IPsec.Boss man had issues connecting to the VPN while at a car dealer. Tried on the old ssl Palo Alto and connected right away.How is the issue of many places block IPsec traffic? I think we had our marketing guy get blocked at hotel but he didn’t complain until he came back.

In the device edit section, there is a place to enter the FortiGate user and password.Why is this item needed?The OS of FortiAnalyzer is v6.0.8. https://docs2.fortinet.co...ing-device-information

Hi Team, I am facing the issue where dialup vpn ipsec tunnel is not coming up while another ipsec tunnels are up via same wan connection. When i am debugging at dialup server site - below is the error message.from Dialup Server ( Responder)mmm-tt-tmes-rvm-01 # 2025-12-03 13:36:51.231140 ike V=root:0:ISP2_MGMT:1188888: negotiation timeout, deleting2025-12-03 13:36:51.231237 ike V=root:0:ISP2_MGMT: connection expiring due to phase1 down2025-12-03 13:36:51.231247 ike V=root:0:ISP2_MGMT: going to be deleted2025-12-03 13:36:51.519365 ike V=root:0: comes 65.12.12.75:500->48.12.12.74:500,ifindex=6,vrf=0,len=341....2025-12-03 13:36:51.519408 ike V=root:0: IKEv2 exchange=SA_INIT id=fc1507345c5cadc2/0000000000000000 len=3412025-12-03 13:36:51.519416 ike 0: in FC1507345C5CADC200000000000000002120220800000000000001552200003800000034010100050300000C01000014800E01000300000802000005030000080400000E030000080400001300000008040000152800008C00150000010F39F1C50804667975B4ED9FCA8E2EAC4809C3330

since we upgrade our fortigate from 7.6.4 To 7.6.5 we have problem to access the vpn from android clientdh-group configured is 14 and aes128 sha1 we have the free version of forticlient

HI EMS adminsI have an EMS installation (VM deployment) initially was at 7.4.3.When I updated it to EMS 7.4.4 I was able to create FortiClient 7.4.4 package installer.Then when I updated it from EMS 7.4.4 to EMS 7.4.5 it doesn't propose to create FortiClient 7.4.5 package installer. It still propose only 7.4.4 and lower.For info all required traffic to internet is allowed and we can't find any denied traffic in firewall logs.Also I waited more than 24h after the update operation but still the same.Any hint?

Hi all, I just have a very simple port portward config for my wan:8888 to my Lan Web server:80 There is nothing special on that webserver, what just a page to say "Hi". Even is no HTML coding. My Firewall policy for this server like below: config firewall policyedit 13set name "Incoming-NAS-Web"set srcintf "virtual-wan-link"set dstintf "Lan"set action acceptset srcaddr "all"set dstaddr "VIP-NAS-T8888"set schedule "always"set service "ALL"set utm-status enableset inspection-mode proxyset ssl-ssh-profile "CA"set logtraffic allset webcache enablenextend The port forward is: config firewall vipedit "VIP-NAS-T8888"set mappedip "172.30.0.2"set extintf "wan1"set portforward enableset extport 8888set mappedport 80nextend Why my webcache keep 0 hit in this case?