Support Forum

My email already exists in FortiCare, but signing in shows “UNAUTHORIZED — Your account cannot be found”, error A02E03-151. Creating a customer account fails because the user already exists. Please check my account and its association with Customer Service & Support.

i have one Entra ID single subscription and single tenant but in this entra ID contains 3 of companies. In Entra i have 3 groups indicated their company such as group Corp-1, Corp-2 and Corp-3. In the fortigate can we make a firewall rule based on Entra ID group and not using IP address as the source?

I am automatically updating FortiClient for Windows from version 7.4.5 to 7.4.6. On about 50% of the test computers, the installation process stops at: “Stop services.” I also tried doing it manually by running the installer file, but in that case it also gets stuck at “Stop services.” How can I work around this issue?I have updated versions 7.0.x and 7.2.x many times before and never had this problem. Now I’m updating to version 7.4.x for the first time. Has anyone had a similar issue?   

SUMMARYOn FortiClient for Linux, an IPsec IKEv2 + SAML tunnel imported from an exported XML configuration always fails at IKE_AUTH, even though SAML authentication completes successfully and the encrypted PSK field, password, and profile are all correct. Root-cause analysis shows the client never decrypts the field-level encrypted preshared key (EncX... format) before handing it to iked - it passes the raw encrypted blob through as if it were the plaintext key. ENVIRONMENTFortiClient (Linux), tested and reproduced identically on:- 7.4.3.5411- 7.4.4.1796 (includes the fix for Bug ID 1035496, connection problems with SAML, multifactor authentication, and Linux CLI options)- 7.4.8.1904OS: Debian 13 (Trixie), amd64 - same .deb package family as the supported Ubuntu builds.Connection type: IPsec IKEv2, Preshared Key + SAML/SSO (sso_enabled=1, ike_saml_port=9443), imported via Configure VPN > XML > Import XML Configuration from a profile exported on a Windows FortiClient install. STEPS

Hello Fortinet Community,I am trying to activate my FortiGate VM evaluation license.My FortiGate VM serial number is:FGVMEVXGQIBZMQA4The license status is showing as Invalid.When I try to download the evaluation license, I get:"Error downloading license: Invalid serial number."I previously contacted Fortinet Support regarding this issue and was directed to the Fortinet Community Forum for assistance.Please help me troubleshoot and activate my FortiGate VM evaluation license.I have screenshots of the error and can provide them if required.Thank you.

Good morning, I have a question regarding FortiClient VPN Only and the expiration of the FortiGuard Anycast CA certificate, which is scheduled for October 10. When I contacted Fortinet support, I was told that version 7.4.3 (the only version available for download from the official website: https://www.fortinet.com/support/product-downloads ) will be affected by this certificate change. Where can I download the updated version? 

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Windows printer component splwow64.exe is being flagged.Here are the exact details of the alert: Process/Object: C:\Windows\splwow64.exe Virus Name: FSA/RISK_HIGH//2000002004 Status: Files could not be quarantined To rule out an actual file-based infection, we verified the system file on the affected endpoints: The Microsoft signature is intact (Get-AuthenticodeSignature returns the status Valid). A local SFC scan (sfc /verifyfile=C:\Windows\splwow64.exe) reports no integrity violations. The file on disk is undamaged. The SHA256 hash of the file is BC7412A5EF6D1B32F7032E1008A324006B19C5A5CE4D27BC8D26DFD6BD7EDB0E. Checking this hash on VirusTotal currently shows 0/71 detections. Since the file itself is cryptographically clean and unmodified on the disk level, we strongly suspect this is a false positive caused by a recent p

Hi Team,I have completed NSE1 and NSE2, currently completing NSE3.I need to achieve FCF and FCA certificates but unable to find it anywhere.Can you please advise where/how to find FCF and FCA enrolment, exam, and certificates? 

Dear Team,If I have a FortiWeb deployment where the connection between the client and FortiWeb is encrypted using HTTPS, and the connection between FortiWeb and the backend server also needs to be encrypted, what configuration is required on FortiWeb to enable end-to-end HTTPS encryption between FortiWeb and the backend server?

hello,we have recent internet access issues following our shift from IP-based access control to LDAP authentication on the FortiGate firewall.Previously, users accessed the internet based on their IP addresses. As part of our security enhancements, we are transitioning to identity-based trust using LDAP authentication. Currently, users are unable to browse because the firewall policies for LDAP,  FSSO agent on fortinet is green and up.the policy not hitting any traffic,some sessions are failing to trigger authentication correctly.  

Can somebody help me to fix this issue?

I have multiple devices with varying levels of active support, and the inability to unlock the geoIP database is quite inconvenient. There is no method for manual updates, and using external filtering can consume significant memory resources when attempting to restrict access from a large geographical region.I understand the rationale behind conditioning support and updates to the greatest extent possible. Even "evil" major manufacturers like HP, Dell, and Lenovo provide publicly accessible BIOS and firmware updates for older hardware in response to critical security vulnerabilities, while placing non-critical updates behind a paywall. Their objective is to prevent the proliferation of insecure devices under their brand.

Hello, I am unable to import the CA certificate onto FortiGate 7.6.7. I generated a certificate using AD CS and am trying to import it into the FortiGate, but I receive an error stating that the certificate format is incorrect. Note that this CA was used to sign the FortiClient EMS SSL certificate. This is for a ZTNA lab setup where I want to integrate FortiClient EMS 7.4.8 with FortiGate. I am using evaluation licenses.

Hii,  I am thinking to Write NSE 4 in the upcoming week. So now my doubt is to attend NSE4 exam is it mandatory to complete NSE1, NSE2 and NSE3 Certifications ?? Actually i have Completed my NSE1, NSE2 and NSE3 certifications on 12/Aug/2019. And i heard that NSE1, NSE2 and NSE3 certifications is valid till 2 years. In that case my NSE1,NSE2 and NSE3 certifications got expired. So now is it mandatory to recertify all NSE1, NSE2 and NSE3 certifications and then should attend NSE4 or i can attend the NSE4 exam directly.Kindly please someone update on this .

Hi Fellas,I'm deploying FortiClient EMS 8.0 using Microsoft Intune (Win32 app) and have run into an issue.Environment FortiClient EMS 8.0.x Microsoft Intune (Win32 app) Deployment package generated from EMS with MSI Installer Files enabled EMS generated: forticlient.msi forticlient.mst PackagingBoth files were placed in the same source folder and packaged into a single .intunewin using IntuneWinAppUtil.exe.The install command in Intune is:msiexec.exe /i "forticlient.msi" TRANSFORMS="forticlient.mst" /qn /norestart /L*v "%ProgramData%\Microsoft\IntuneManagementExtension\Logs\FortiClientInstall.log"IssueThe installation completes successfully, but when FortiClient launches, it still displays the "Enter Invitation Code or IP Address" screen.Even when I manually enter the Invitation Code or the EMS IP address, the client does not register with EMS.Additionally, the folder:C:\Windows\FortiEMSInstaller_logsis not created, so there are no EMS installer logs to review.Expected B

Hi everyone, I'm Sarah, just joined this community. We've been running a site-to-site VPN on FortiGate and occasionally notice intermittent drops, especially during peak traffic hours. Has anyone tuned specific settings (dead peer detection, keepalive intervals) to make tunnels more stable? Would appreciate any troubleshooting tips before opening a support ticket.

I am experiencing an issue when connecting to the IPsec Dial-Up VPN from a Linux virtual machine using strongSwan.Once the VPN connection is established successfully, the Linux VM loses its Internet connectivity. However, the same IPsec Dial-Up VPN connection works correctly on Windows machines, where Internet access remains available after the VPN is connected. 

Customer has a 60E - i have config backup from 60E - don’t have access to 60E registered account ( ????@datec.com.fj ); have a new 70G ( registered by me to ????@nivismotors.com.fj who is the owner/customer ) - why is it so difficult to get support to assist to convert my 60E config, and import “new” config into 70G via forticonverter.  I sent time today with both customer & technical support via chat, and neither is able to assist to resolution.  Going forward why should i advise customers to stay with FG 

Hi all,Due to SSL VPN no longer being supported in newer FortiOS versions, we’re migrating our FortiClient remote-access VPNs from SSL VPN to IPsec Dial-Up.Our SSL VPN setup is used by our team, partners, etc., and authentication is done via Azure SSO. I created an IPsec Dial-Up tunnel using local FortiGate authentication and it works fine. However, when I switch to SSO authentication, it fails. (go to the online login page but fails in the end).  Before I lose too much hair on this migration 😅, I’m trying to understand whether IPsec Dial-Up can really reproduce our current SSL VPN setup.Main questions:Azure SSO: Is SSO supported for IPsec Dial-Up in the same/similar way as SSL VPN? Different IP pools per group: Can each user group get its own client IP range? No RADIUS: The “Assign IP from User Group” option seems to require RADIUS. Is there another way without deploying a RADIUS server? Split tunneling: With SSL VPN, access is mainly controlled by firewall policies. With IPsec, it l

I’m currently preparing for NSE 4 on FortiOS 7.6, and one thing I’ve noticed is that going through the study material and actually being able to troubleshoot a FortiGate scenario are two very different things.So I wanted to hear from people who have recently prepared for or passed the exam.What helped you the most?Hands-on FortiGate labs Fortinet Training Institute material Fortinet documentation and KB articles Practice questions CLI troubleshooting Real-world troubleshooting scenariosPersonally, I’ve found that combining the official material with hands-on practice makes it much easier to understand where the gaps are.For those who have already taken NSE 4, how did you balance theory and hands-on practice, and what would you recommend spending more or less time on?

Does anyone know if the new exam is using Enteroruse Firewall Admin questions?NSE library has enterprise firewall admin and sdwan modules but nothing that lines up with name Network security architect or is it a whole new exam with both modules combined? 

Hello, I am preparing for my exam scheduled for July, but I am having trouble understanding this question. Could you please tell me the correct answer and explain why When FortiGate performs SSL/SSH full inspection, you can decide how it should react when it detects an invalidcertificate.Which three actions are valid actions that FortiGate can perform when it detects an invalid certificate? (Choosethree.)A.AllowB.Trust & AllowC.Allow & WarningD.BlockE.Block & Warning    

I am currently installing FortiClient on an Ubuntu 24.04.4 LTS VM. However, when I open FortiClient, the IPsec VPN option is not available/disappears from the VPN section. Could you please confirm whether the installed FortiClient version/package supports IPsec VPN on Ubuntu 24.04.4 LTS and advise if any specific package, version, or configuration is required? I can also share the installed FortiClient version and system details if required.currently using version  FortiClient VPN 7.4.3.5411

I am trying to test the Web Filter Profile Override blocked categories feature. When I set the option to “IP” it works fine. When I set to either User,User Group or Ask it ddoes not work.Scenario 1:I set the Option to User Group, I select the User Group, the Web Filter that will bypass the category block, then I configure the Firewall policy source with the suer group and “all”.When I surf to a blocked category it allows it rather than getting the block page. When I remove the user group from the Firewall policy then I get the block page but It says “Only User based Overrides are allowed…..”Scenario 2:When I set the Web Filter Override to “Ask”, then configure the firewall policy with the user group, I do not get the block pageIf I remove the User Group from the Firewall Policy then I get the block page but I am not presented with User Group Options. I have followed the KB but cant get this to work.https://docs.fortinet.com/document/fortigate/7.6.7/administration-guide/408599/web-profi

After an auto deployment I have many endpoints that only say under Installer- Endpoint Notified but they never updated to the latest version. How do I fix this? It happens every time there is an update to the Forticlient and we do an auto deployment of the update.  Thanks,Donna