Support Forum

Hi, I'm trying to configure an IPSEC VPN dial-up with saml and fido2 (yubikey) using the External Browser as User-agent for SAML Login option - it's not working. It works for SSLVPN, but not for IPSEC. The client version is 7.2.12. Could it be that it's not working? It works without problems using credentials via Microsoft Authenticator with the External Browser as User-agent for SAML Login option disabled, but when I enable it and use the FIDO2 key method, the browser displays a message that I've logged in, but the tunnel doesn't establish. The tunnel is configured based on ike2 with the networkid parameter. Has anyone else encountered this problem?Regards 

Hi Guys,I need to migrate from 600E (HA A/P) to 200G (HA A/P). I created a FortiConverter service today and mapped only the up interfaces but did not select the HA interface (only ports 1-7). The other ports are down on the 600E.I already configured the new 200G pair as HA A/P. I want to know what will happen when I restore the FortiConverter config file? If I don't choose to copy the HA settings there, will it destroy the current HA on the 200G??Please advise!Thanks,

Hi, does anyone experience problems with the FCT webfilter and Chrome/Edge v144 (in Beta until jan/2026)?Either with FCT version 7.2.8 and 7.4.4, web traffic gets blocked....  Note: the issue seems to be EMS 7.4.4 related

Dear Concern, I have purches VON/ZTNA on premise deployment and it is working fine standalone. But I want to need HA configure, at the moment required another license or existing one is enough. How to configure HA any suggestion.We have purchased FortiClient VPN/ZTNA (on-premises) deployment, and it is currently working fine in standalone mode.Now we are planning to configure High Availability (HA) and would like clarification on the following: 1. Licensing:Is an additional license required for HA, orCan the existing license be used for both primary and secondary nodes? 2. HA Configuration:What is the recommended HA architecture for on-prem VPN/ZTNA?Any best-practice guidelines or official documentation for configuring HA? Any suggestions or real-world experience would be highly appreciated.Thank you in advance. ForticlientEMS os version: 7.4.4 #FortiClient #FortiEms @support 

Which firmware version of 7.4.x is not going to support SSL VPN?

I'm trying to create a Local-In policy on a member interface of the SD-WAN (virtual-wan-link), but when selecting the source interface, i get the error on the right side. I don't have the option to select port1 from the list as its one of two member of the virtual-wan-link group.  Tried this in both GUI and CLI. Running 7.6.5. Any ideas on how to apply this policy to a member interface of an SD-WAN group?WAN group. 

Hi all,I manage a network with FortiGate firewalls running firmware versions 7.0.15 and 7.4.4. I have attempted several methods to block access to YouTube Shorts:Used youtube.com/shorts, youtube.com/shorts*, youtube.com/shorts*. *.youtube.com/shorts*, and *youtube.com/shorts* with wildcards in both Content and URL Filters.Attempted to block *.shorts* in the DNS filter.Despite these efforts, I can still not effectively block YouTube Shorts content. What is the recommended and most effective approach to achieving this using both URL and Content Filters, ensuring that only YouTube Shorts content is blocked without impacting other aspects of YouTube usage? Any detailed guidance or specific configuration examples would be greatly appreciated. Thank you in advance for your assistance!

Does anyone know what is the server specs for Forti collector ????? i cannot find any document that says its requires OS ... CPU...Memory any thing ??

We are trying to get detailed information for where our users are going.  Say we have a user that goes to their facebook page and then to the company facebook page and then back to their own.  The detailed "User Detailed Browsing Log" only says they went to facebook.com.  Is there a way to see more details that might show if they are doing company business or personal?

Hello, we are trying to get SCEP certificate enrollment working between FortiAuthenticator and Google MDM (mobile device management).We will push out a Google MDM wifi profile to all mobile devices requesting a SCEP certificate from FortiAuthenticator. It is not working for us and there is very little (if any) documentation on this.Has anyone got FAC SCEP working with an MDM of any kind ?Thank you kindly.

hi,i got a brand new FGT and it got a default OS 7.4.8M.i need to downgrade to 7.2.10M to be consistent in our environment.per checking the upgrade path tool, it is a direct path.since this is a brand new chassis with no config yet, can i safely downgrade directly from 7.4.8M > 7.2.10M?  

Hello, I’m looking to confirm if there’s a way (and I believe there probably is) to limit the number of authentication attempts for regular FortiMail (in server mode) users (local users), not administrators. Essentially, I want to apply something like a temporary lockout: for example if a user fails authentication 5 times, their login should be blocked for about a minute (or any configurable time) before they can try again.Does FortiMail support this for end-users? If yes, where can I configure it? Kind regards,

Hi , I am having issues with this error.Day one i am able to connect with it.However after my laptop updated its system ,suddenly i am unable to connect at all and the same error pops up.I have tried different Wi-fi , still the same error.I have also checked with my company support , they said my credentials all matched on their end.So i do not know what is wrong , i have tried some of the  solution posted in this forum still not able to resolve it. 

Hi,Is it possible to change the IP pool that FortiSASE assigns to me when starting the SSL VPN?now I have the class 10.212.128.0ThanksRegards

Hello Community Contributor, I am facing that FortiPAM disk size issue. I configured VM Size to 8GB for System, 200GB for Log and 600 GB for Video Record.  But if i run exe disk list, it is not like my configuration. It is less than VM Actual size. How can I resolve this? FortiPAM size Thank you in advance.  Best Regards, Henry

I have Fortigate 2201E and want to setup active-active multi-home setup with 2 x ISP for web/app hosting on servers in the datacenter I have 10G from each ISP and will like a truly redundant HA setup that is active-active, not primary-failoverI use cloudflare as firewall/proxy/DNS in front of the fortigate for reference and wanted to check what the best route for this setup is I know most people go for primary/failover like mentioned in this guide https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SD-WAN-with-Primary-ISP-and/ta-p/268524 by @lcamilo but what i want is active-active setupIs this a common setup especially when not putting a router in front of fortigate and instead want to connect directly to the ISPs from the fortigate.  What i have heard so far is use SD-WAN feature and get ipv4/ipv6 blocks from each ISP. I will be getting /24 ipv4 and /48 ipv6 from each ISP. And then connect each ISP to an interface and set

Hello everyone,We are managing around 500-600 FortiClient endpoints and need to upgrade clients quickly whenever vulnerabilities are announced.Current setup:FortiClient EMS (on-prem)Due to security concerns, our Infosec team keeps EMS completely closed to the internetBecause of this, we are forced to perform FortiClient upgrades using ManageEngine Endpoint CentralFrom the infrastructure side, there is no clear technical explanation why EMS must remain closed, but we have to follow this decision.Issues with ManageEngine upgrades:Deployments often fail or stop midwayInstaller crashes during upgradeUpgrade completes but:FortiClient opens with a blank or white screenApplication does not startUsers are asked for an admin passwordVPN stops workingEndpoints are EMS-connected and we perform in-place upgrades, yet problems persist.Questions:How do large enterprise environments usually handle FortiClient upgrades?Is it common to keep EMS securely internet-facing for telemetry and upgrades?Are th

I am trying to install the "VPN-only" Client, but after install, the title of the FortiClient shows "FortiClient - Zero Trust Fabric Agent". I uninstalled FortiClient from Control Panel, no errors during uninstall. I downloaded "VPN-only" installer and installed, but still same result.  Previously it used to show only "FortiClient" as below

I am facing issue in FortiPAM email approval workflow. We don't have any mail server in our organization. We use Microsoft Mail Exchange Server for mail service. Let's say, there are user1(approver), user2(requester) and user3. If user2(requester) request a secret, a mail sent to approver inbox. If approver click "approve button", it created new mail. but it doesn't any approve at requester end. We also cannot use email test connection to gmail account for 2FA purpose.  

Hi,We bought an Microsoft Surface Pro 9 which has an ARM processer.The point of buying this was to hook it up with the Fortinet VPN, so we could go anywhere and still be connected.Problem is i can't install it on the Surface Pro 9, due to having an ARM processer.I was wondering if there was any early access or beta for Forticlient VPN for ARM processers that we could try?Or is there any other solution?I tried the Microsoft store app, but that doesn't seem to work with SAML.The VPN connection is SAML with Azure.

Our company currently planning to buy Fortigate 901G. My question is does FTG-901G support to 10000 remote LDAP user within user definition configuration? If there is a lower default limit, is it possible to expand this capacity through configuration?

Hi all,I'm changing some things on my network. Currently (in summary) I have a DMZ with two Fortigate and one switch. The servers and the firewalls connect to the switch.Each server has 2 static routes1º)Default route --> IP address of the external fortigate.2º)Route to reach internal private addresses -->Internal fortigate. I'm thinking about configure the servers with just one default route for the switch that connects them. This switch, sends traffic to external or internal firewall and Doesn't route any traffic between DMZ network and other networks. Server-->Switch-->Firewall Internal / Firewall External. If I use a firewall as default gateway for servers, some times the traffic will have more hops than I want. ExampleTraffic from server DMZ, to server Datacenter:                  -ServerDMZ-->switch(layer 2)-->firewall external-->Switch another time-->Firewall internal. What do you think abou

I am working on setting up a hub and spoke with an Fortigate for Azure deployed in the hub. I have been on the struggle bus for the last day trying to get it working. I have the vnets created on both the hub and spokes. The hub/Fortigate I am able to access and administer it via the GUI/CLI. I have created the vnet peerings between the vnets as well as the default routes to the Fortigate internal interface from the spokes. I feel like I may be missing a step as I cannot get the spokes to talk to the hub and vice versa. I have created the NAT and Firewall policies and I cannot get RDP to work to my VM for testing. I also am unable to ping anything from the Fortigate/HUB to the spokes. Any ideas or should I reach out to support?

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.Environment Details:FortiGate model: 901G (2 units)HA mode: Not decided yet (Active-Passive or Active-Active)Switching environment: Cisco switch stack / clustered switchesLink aggregation: LACP (802.3ad)Objective:High availability at the firewall levelRedundant and aggregated uplinks to the Cisco switch stackStable and supported HA + LACP designAvoid split-brain, MAC flapping, or failover issuesQuestions:What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?How should the Cisco side be configured (single port-channel across stack members, tr

Hi,I have configured a ZTNA setup using FortiGate and FortiClient EMS integrated with Azure AD SAML for one domain (e.g., user@abc.com) (server A) I have now added a second FortiGate to the same FortiClient/EMS environment, but it requires authentication against a different Azure AD SAML tenant (e.g., userb@xyz.com) (server B) Is there a solution to achieve automatic authentication (SSO) for the second account (xyz.com) so that users do not have to manually re-authenticate when connecting to resources protected by the second FortiGate?On my check, when the FC connect to server B it automatic use the account from the current login via browser ( which current login with domain abc.com) --> so it get the error authentication code 21.Regards,