Support Forum

In Administration - Deployment - Collector, there are two available options: “Update Collectors” and “Request Collector Installer.”For Collector (Agent) deployment, the correct option to use is “Request Collector Installer.”       Through the Update Collectors section, you can update the agent version for the relevant operating system by selecting either a single collector group or multiple collector groups.   When deploying a Collector, after selecting the operating system, you can choose either the current version (n) or the previous version (n-1).For server systems, using the n-1 version is generally the safer option.Parameter descriptionsAggregator Address = Refers to the main server in the data collection and transmission layer that centrally processes telemetry collected from endpoints and forwards it to the FortiEDR management console.Organization = Represents the tenant identity and indicates w

Good morning, team,I have been experiencing a recurring issue within my infrastructure for some time.I have already opened a case with TAC; however, no definitive solution has been provided so far.Currently, I manage an environment consisting of approximately seven FortiAnalyzers, each with an associated FortiAnalyzer Collector.Until September 2025, there were no issues within this topology. However, at a certain point, the environment began to exhibit unexpected behavior.FortiGates started losing log visibility across multiple features, including Traffic Forward, FortiView, and any other functionality that relies on logs sourced from the FortiAnalyzer.The issue initially affected several FortiGates connected to FortiAnalyzer 01. After several hours of troubleshooting, we identified that restarting the FortiAnalyzer Collector linked to FortiAnalyzer 01 would temporarily restore functionality, allowing logs to be displayed again on the FortiGates. However, this proved to be only a tempo

FortiManager 7.4.9 Free Trial managing FortiGate 100F on 7.4.9 Config status: Synchronized On FortiManager I've created a new IP reservation under IP Assignment Rules, device global DB status changes to modified, yet when I use the install wizard I'm unable to push the reservation to the FortiGate 100F. The install preview is empty and it doesn't recognize the reservation. Either new one or deleting an old reservation.I have tried to modify a firewall policy along with the reservation but it only recognizes changed policy not the reservation. 

I created a LETS ENCRYPT Cert on my FortiAuthenticator and Fortigate that has the SSID for Guests, always had an issue with GODADDY on Apple devices, so we moved to LE. creating the cert via ACME was ll good, cert is valid , matches the FQDN etc, but now annoyingly the problem is worse, Apple and Android dont trust the cert! when they connect to the GUEST SSID, the phones browser says "Security Warning SSL_UNTRUSTED""This certificate isn't from a trusted authority" but the common name "myfortiauthenticator.mydomain.net" is signed by Lets Encrypt: Issued by:Common name:R13Organisation:Lets Encrypt and the cert is 100% valid.  Fortinet support Lets Encrypt and ACME, and is a perfect solution, but whats the point if Apple and Android dont trust it? or am I missing something?   

Hi, Can somebody please shed any light on this for me. I have configured Application Control to 'Block' the 'Proxy' category and I have 'Deep SSL Inspection' enabled on my firewall policy. When the firewall policy is set to 'Flow-mode' the NordVPN client on the PC is blocked, however when the exact same policy is set to 'Proxy-mode' NordVPN can connect successfully. I can see logged Security Events for Wireguard being blocked when in 'Proxy-mode' but eventually the NordVPN client passes through the UTM and connects. Can somebody please explain why this is the case? I thought 'Proxy-mode' was a more thorough inspection and would expect to see the opposite behaviour. Interestingly just to add to this, I see a lot more granularity in the Applications listed in the Security Event logs when using 'Flow-based' opposed to 'Proxy-based' inspection.  Regards, Jonathan. 

Hello Fortinet CommunityWe're facing a connection problem with an Fortigate60, on which no connection to any rusdesk Relay is possible. On the Firewall of the Target there is no traffic at all from the source, which means somehow the connection is still blocked.       Does anyone know what could cause this? 

The issue:Clients connected to a vlan with Block intra-VLAN enabled can't reach the FortiGate for around 2 minutes and 30 seconds after failover. Clients connected to a vlan with no Block intra-VLAN enabled do not have this issue.All switches are managed by the Fortigate.Topology:2 X Fortigate 601F in HA A/P2 X Core switches FortiSwitch 1024E in MCLAG2 X FSR-216F-POE connected in a ring to the MCLAG switches. So, the first switch connects to the first 1024E switch and the second connects to the second 1024E switch with a link between the two FSR-216F-POE switches. (We can't change this because of the physical fibers)I have tested with two clients connected to the same switch. Client A connected to port 1 on a vlan with intra-vlan blocking enabled, and Client B connected to port 2 on a vlan with intra-vlan blocking disabled.Client A was having issues after the failover and could not reach the Fortigate for around 2 minutes and 30 seconds. Client B does not have any problems. It looses o

Hi, We are investigating a strange failover issue with managed FortiSwitches by a HA pair of Fortigates 601F.  We are having strange issues with traffic loss if we failover to the passive Fortigate. The issues are only on vlan's were we have intra vlan blocking enabled. If we disable this feature everything is working fine.  The problem is that we have traffic loss from the clients to the gateway/fortigate for 2 minutes and 30 seconds after failover. Support found out that the mac adress for that Fortigate vlan is learned on the wrong trunks.  We have switches in a ring connected to a pair of 1024E MCLAG core switches.  I'm analyzing this issue and in the core switches logging I see the following messages during the failover/issue: 10: 2026-01-08 10:14:49 log_id=0103030700 tz=+0100 type=event subtype=system pri=information vd=root action="daemon-startup" user="init" ui="None" daemon="l2dbg" pid="2589" msg="Daemon l2dbg started"11: 2026-

I have a load of Proxy rules, and have placed them in a specific order, So that all the "UNAUTH" Rules are at the top and then the AUTH rules, Problem I have,  I need an UNAUTH rule to catch the rest of the traffic using a webfilter, to block things, but if I place this rule at the end of the UNAUTH rules, the people who need to AUTH to certain sites will now hit this rule first, which i dont want, its for Apple IPHONE users, that cant AUTH but need to be allowed out. The Auth Rules are important to allow certain groups to certain sites, but as they will be below this UNAUTH catch all policy, they will hit that? I cant figure out how to arrange the rules! any advice appreciated.

Hardware: FortiGate 101F paired with FortiAP.Account: I have created a local user on the firewall.Goal: I want an Android tablet to connect to the Wi-Fi using TLS authentication.How do I generate the necessary client certificate for the Android tablet to authenticate and connect to the Wi-Fi? I've already asked Gemini and ChatGPT, but neither provided the correct procedure. Both of them just gave me AI hallucinations.

Hello,I am currently using FortiClient EMS version 7.2.4, while our field users are running version 7.2.5. Occasionally, some users encounter the 'Endpoint blocked by EMS' error.There are no issues regarding the device license status. I can resolve the issue temporarily by manually unblocking the user from the console, but this is not a permanent solution as the problem recurs. What could be the underlying causes of this issue?

Hi Community,Can anyone share me the configuration guide to configure Hub and spoke dialup VPN with BGP with Fortimanager.I wanted to configure this on Fortimanager.Issue is my Spokes are not getting a IP from Hub during Negotiation.I found the guide to do this via Firewall but not able to find any documentation to do this via fortimanager.

Hi, When trying to renew the server certificate (or create a new one) using the automated option.  I get this error: "EMS Invalid certificate and private key: argument 'data' Cannot convert "<class 'str'>" instance to a buffer. Did you mean to pass a bytestring instead?"  EMS 7.4.5 build2111 (Mature) Any ideas on what could be causing this? thanks

hi there,I need help please.I use FG60F with firmware 7.2.x I've created firewall policy with webfilter and ssh inspection. suddenly, some computers can't access certain https website, but the other PC still can access the web without issue. if the -problem computers- use direct internet (not via fortinet), they can access the website. where is the issue? anyone has same experience? thank you

I'm trying to allow CoPilot in office.outlook.com sessions, but block copilot.microsoft.com in general browser sessions, as well as all other LLMs My web filter has Artificial Intelligence Technology blocked in the Fortiguard category based filter, and a URL filter: *.google.com/*udm=50**.google.com/*udm=14*m365.cloud.microsoftbing.com/chatcopilot.microsoft.com*.bing.comcopilot.microsoft I also have an application control profile on the proxy policy, with the  GenAI category blocked. The only way I can get it working is to have the AI blocking web filter in both the the firewall and proxy policies. Having the web filter in just the proxy policy works for most LLMs via browser, except CoPilot. It works, but I'd like to know why, as this goes against the admin guide on transparent proxies. https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/15908/transparent-proxy I don't like not understanding my firewall's config :( &nbsp

Hi Folks, This new thread is created to clarify if it possible to use the functionality Fortiguard DDNS to implement a domain name once that name is configured, that be use in a remote access VPN. As example:I configure and activate the DDNS domain XYZcompany.fortiddns.com in the fortiguard ddns. (Image Attached)Later, I want to use that DNS XYZCompany in our FortiClient. (Image Attached)   Thanks for your answer. Best Regards,Joel   

Fortigate firewall FG90G HA what are the must keep requirements to be kept ready before HA config including Licenses do I require single or two licenses 

As part of investigation by checking sample of 100 Fortigate sites from 800+ sites. The data showed that 48 Fortigate sites out of 100 sites having memory conserve mode based on crashlogs. It appears that it took a second when entering and then existing memory conserve mode. Some nodes showed multiple conserve mode instances.  Example:29: 2026-03-09 17:47:57 green="1572 MB" msg="Kernel enters memory conserve mode"63: 2026-03-09 17:47:58 service=kernel conserve=exit total="1918 MB" used="1541 MB" red="1687 MB"   The customer has 800+ Fortigate sites. I'd like to be sure that no impact to the customer given their large deployment. I was told that the configuration below will help to resolve the conserve mode.  Two questions are:Can someone help to explain what the configuration below does and how it will help? Is it the best solution to resolve or eliminate conserve mode? Are there any impacts and drawbacks?#----------------------------------------

Hello,I currently have SSL VPN active and I want to switch to IPsec VPN (IKEv2 Remote Access).Environment:FortiGate model: FG-101FFortiOS version: 7.4.11VPN type: IKEv2 IPsec Remote AccessAuthentication: FortiAuthenticator 6.5.6 build 1391 (GA) with OTPDirectory: LDAP users and groups from Active DirectoryClient: FortiClient 7.4.3 Hotfix 1 (7.4.3.8758)I am configuring an IKEv2 IPsec remote access VPN that authenticates users via FortiAuthenticator using LDAP credentials and OTP.The VPN connection is not successfully established from FortiClient.Phase 1 (SA_INIT) completes successfully, but the connection fails during user authentication (EAP phase).FortiClient shows the following error:Wrong EAP credentialsHas anyone encountered this issue when using IKEv2 with EAP authentication and FortiAuthenticator OTP?Any suggestions or troubleshooting steps would be appreciated.Thank you.

Hi guys,I have a question about FCSS after july 15 2026.I was planning on FCSS Secure Networking.I passed NSE 7 - Enterprise Firewall Administrator 7.6 and was planning on NSE 6 - Network Security Support Engineer 7.6.After July 15 both of these exams being canceled.I couldn't figure out what will happen according to their new mappinghttps://www.fortinet.com/nse-training-updateWill it count for something ?  am I gonna receive NSE 6 ? or I will need to do NSE 4 to get NSE 7?      

Just a simple inquiry. We have a setup for Active-Passive (HA) in our remote site. Since fortiguard services are shared from Master, does it really necessary to avail full license to both primary and secondary firewall?

Hello, I'd like to move the WAN connection from WAN2 to WAN1 on some FortiGates managed by a FortiManager, just so the physical installation is the same on all gates. While I am aware that this will bring an outage, and that's OK as long as it is planned, I want to make sure that when the cable is connect to WAN1, internet traffic goes out as it should.So, ideally, I would prepare the following configuration on FortiManager:deconfigure IP of WAN2 (which is actually used as internet connection)reconfigure IP of WAN1 with the old IP of WAN2modify the gateway in SD-WAN BUT, logically, if you do step 1 above, connectivity of the FortiGate is lost, so, my question:Will the above configurations be fully loaded on the FortiGate, before getting fully applied, or will the each step be done one by one by the FortiManager, connectivity lost after step 1 and my install fail, requiring an on-site intervention of a FortiGate administrator? If it would be the first situation (conf

Hi,I am writing to request a review and whitelisting of my domain. Previously, my website had some security issues; however, I have completely rebuilt the website from scratch (+ better host, + new PHP version + FTP fix) and ensured that all malware and vulnerabilities have been fully removed.All necessary precautions have been taken to ensure that the website is now clean, secure, and compliant with best practices.URL: https://lesbateauxagathois.comI kindly request you to review my domain again and whitelist it at your earliest convenience.Please let me know if any further information or verification is required from my side.Thank you for your time and support.

I am having issues with my IPSEC VPN not working. What I have boiled it down to is, it looks like when I try to send a ping from my computer to the firewall (B) using the internal interface IP on the the other side of the VPN. The firewall (A) I am behind does not forward the packet to the wan interface.here is the flow trace filtered to the internal address of firewall (B). from the CLI of firewall (A)The VPN appears to randomly stop working. Sometimes after a while it works. id=20085 trace_id=25 func=print_pkt_detail line=5617 msg="vd-root:0 received a packet(proto=1, 10.0.0.83:1->10.2.0.254:2048) from internal. type=8, code=0, id=1, seq=18205."id=20085 trace_id=25 func=init_ip_session_common line=5787 msg="allocate a new session-1d680973"id=20085 trace_id=25 func=vf_ip_route_input_common line=2595 msg="find a route: flag=04000000 gw-10.2.0.254 via StG"id=20085 trace_id=25 func=fw_forward_handler line=777 msg="Allowed by Policy-37:"id=20085 trace_id=25 func=ipsecdev_hard_star

I am working on relaxing our SSL VPN with IPSEC. currently running 7.2.12 on the FG (azure vm) and using the free FTC 7.4.3.IPSEC is configured with split tunneling, accessible networks is using an address group and all members are subnets. Connection on all FTC apps was imported from a config file.ISSUE: some devices are getting a 0.0.0.0 route pointing to the ipsec tunnel. other devices are getting the correct routes when connecting.any ideas what would cause some devices to not get the correct routes?