Support Forum

Good day,I am new to FortiGate and having some trouble to setup the SSL portal. First I used FW 6.2.7 setting up the SSL portal with  http://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/584456/configuring-saml-sso-login-for-ssl-vpn-web-mode-with-azure-ad-acting-as-saml-idp. This works perfect but I had some trouble to open external URLs from the SSL portal.I opened a ticket and support confirmed there is bug in FW 6.2.7 and I can go to FW 6.4.5. Ok so I updated to FW 6.4.5. But now SSL Portal is not working anymore. I get a <ERR_EMPTY_RESPONSE> from my browser. I tried to debug the login with <diagnose debug application sslvpn -1> and saw this error: 262:root:6]rmt_web_auth_info_parser_common:460 no session id in auth info [262:root:6]rmt_web_get_access_cache:797 invalid cache, ret=4103But I don't what it means and how I should proceed. Has anyone had a error like this before and can give me some advice. Many thanks,MaDe 

Hi, I would like to know the steps to configure ZTNA with 3party vendor for MFA. Is that supported? Or is it mandatory to be with FortiAuthenticator only? Pls any guidness

Hi everyone,We’ve set up a captive portal for employees to connect their personal devices to our Wi-Fi using Microsoft 365 SAML SSO authentication.When connecting from an iPhone, the captive portal opens correctly and redirects to the Microsoft login page. After signing in, users receive the MFA prompt to enter their code. However, when they switch to the Microsoft Authenticator app on the same phone to validate the MFA and then return to the Wi-Fi login screen, the captive portal closes automatically.It seems that if you swipe up or switch to another app, the captive portal session ends, forcing users to start the process again. This creates an endless loop. Users authenticate successfully, but the portal resets before completing the connection.Has anyone encountered this issue or found a workaround to keep the captive portal session active duringMFA on iPhones? Thanks in advance!

I have Let's Encrypt on my Ubuntu Web Server.   It generates a certificate with the firewall certificate: DNS Name: firewall.scsiraidguru.com DNS Name: learningwp.scsiraidguru.com DNS Name: mc.scsiraidguru.com DNS Name: patrickmckenneylandscaping.com DNS Name: scsiraidguru.com DNS Name: www.patrickmckenneylandscaping.com DNS Name: www.scsiraidguru.com  every 60-90 days.  I setup SCP account and rsa-ID on the Web Server and Fortinet 61F.   I setup a test backup file.   It can get a backup from the FortiOS and copy it back to the Web Server.   I want to automate the certificate import from the Web Server to FortiOS.   I setup a copy.sh file that will compare the new certificate to the copy in my home cert directory.  When it changes, it copies the new pem files into my home cert directory.  It then creates a pfx file in the home cert directory.   I want to get the FortiOS to import the new certifica

I installed Windows 11 Enterprise on my computer (AMD Ryzen 7 7730U). I downloaded the latest version of the Forticlient-only VPN application and am running it as an administrator. My firewall is off. There shouldn't be anything blocking the application, so I'm sharing the error message with you. By the way, I can't open any files in the downloaded folder. I can only see text documents and logs. Could you please help?  [2025-10-18 09:20:27.4672990 UTC+03:00] [1520:7188] [sslvpndaemon 541 debug] CListener::Initialize() A pipe client connected.[2025-10-18 09:20:27.4770572 UTC+03:00] [1520:7188] [sslvpndaemon 501 debug] beforeConnectNamedPipe[2025-10-18 09:20:27.4772196 UTC+03:00] [1520:1792] [sslvpndaemon 740 debug] Thread CListener::SReceiveMessage() created. pipe handle: 0x0000000000000610[2025-10-18 09:20:27.4772406 UTC+03:00] [1520:1792] [sslvpndaemon 587 info] CListener::_ReceiveMessage() PID of pipe client: 16700[2025-10-18 09:20:28.5952594 UTC+03:00] [1520:1792] [sslvpnd

im not able to use

Hi everyone,I am searching for a way to use MFA with TOTP without paying for FortiToken.  Our internal users get authenticated via SAML and MFA from Microsoft Cloud. But we do have some external accounts which can't be linked to SAML but need VPN.  Is there any other way to set up MFA with a TOTP App without using FortiToken?

Hey all.  Between my Fortigate 800C and FortiAnalyzer my logs are being smashed by DHCP Ack. I'm using the interface on the FW  as a DHCP server for a large free public wifi network.  I didn't want to relay and bog down any corporate DHCP, but I also really don't care about logging the DHCP ack.  Maybe an alert if the scope is full - but thats it.  How do I turn this off?    

Hello,I would like to configure an SSL VPN connection on my iPhone on iOS, the problem occurred when adding the certificate, I cannot select it, I do not see such an option, please help.  filename -> no added yet

Hello I want to use DuckDNS as DDNS on Fortigate. How do I do it? Initially the line to use is (example, obviously fake): https://www.duckdns.org/update?domains=mydomainname&token=h123030a-a62b-e6d8-pTZ0-2FT2453foqwe&ip= There is no user name or password or anything else How do I set this up in Fortigate? Thanks 

Hello, I've been experiencing issues with SNMP for a few days now. The branch offices have Fortigate firewalls and Fortiswitches. The logs constantly show that the switches are losing and regaining the connection. When I check, everything seems fine. My second issue is that when a user connects their computer to any port, the port lights up green, but the computer doesn't appear. After doing a few pools, the issue resolves itself.   

Hello Team, I have two FortiGate 2600F FGCP clusters (active/standby) with FGSP enabled between them for a specific VDOM. I would like to verify whether FGSP sessions are synchronized and see which ones are. The following CLI commands appear to report FGCP session information only:diagnose sys session syncdiagnose sys session list  How can I retrieve session information for FGSP specifically? Thanks in advance for the supportBest Regards 

Dear Team, We are facing the issue with retrieve the configuration from fortigate firewall to fortimanager. 1. Run the script from fortimanager to direct managed firewall. (Once the script run whatever the configuration ran in the firewall should reflect in fortimanager, but here manual retrieve is required to reflect, Auto retrieval not working.2. The script contains, Create vlan, assign the vlan to zone, create dhcp using vlan...etc. 3. When we check the configuration after the script in fortimanager, its showing as invalid. After manual retrieval only the configuration is visible. Is there any command available in fortimanager to view via CLI why auto retrieve not working. There is a command in fortigate diagnose debug cli8 ---> diagnose debug enable.Like this any command available please share with us. Note: Fortimanager and fortigate fir  Thanks, Sivanathan T

I would like to request a guide for configuring the Persistent Agent and Passive Agent. I’ve already tried following the official Fortinet guide, but it doesn’t seem to work, and I’m not sure why.In my experiment, I was unable to deploy the agent through Active Directory, so I tried manually installing it on the AD user PCs instead. When the users are connected via a wired network, FortiNAC can detect the agent on the endpoints, but when they connect wirelessly, the agent is not detected.Could you please help me with this issue by providing the appropriate configuration guide or documentation?

HiI have two questions. 1. Is there a way to set admin-lockout-duration to 100000 and let another administrator unlock it when the account is locked? 2. Is the criteria by which the account is locked not the account name but IP based? Thank you

Hello All, I am configurating a basic home lab using GNS3 for my FortiNet SD-WAN practices as below : FMG > v7.0.11 > Permananet trial license > allocated 4vcpu + 4096MB memory3 no of FGT as HQ, remote DC & Branch > each 7.0.5 with 15 days trial license. > allocated 1vcpu+1024MB memory to each FGT.  My Base system is running with intel i5-6500, 4vCPU & 12GB of memory. I have successfully configured the topology & registered all the three FGTs in my FortiManager. at the begining I can see the status for all the devices under "Manager devices" shows "in sync". However, whenever i try to push any policy, the installation gets failed with error "install and save finished status=FAILED". I tried multiple times referring different references available on Fortinet KB as well as internet; but ended up at the same error. Even i have done factory reset & configured all the devices yet no success with same error.  Appreciate any he

Dear Experts, I want to know the theoretical overhead of  bandwidth when IPsec aggregation is used at SD-WAN.For example, pure WAN1: 5Mbps, pure WAN2: 3Mbps and pure WAN3: 2Mbps.Total is 10Mbps. All WANs is IPsec-aggregated as SD-WAN.   PC1 -- FG1(IPsec Aggregated SD-WAN) -- (network) -- FG2(IPsec Aggregated SD-WAN) -- PC2 We tried a little. 8-8.5Mbps between PC1 and PC2. I do not judge if it is reasonable. Any comments are appreciated.  

Hi,I have a customer who currently uses two WAN connections: a primary one (Swisscom) and a secondary one (Horizon).Some services are also exposed only on the primary WAN.They asked if it’s possible to combine the two connections so that, in case the primary wan becomes saturated, part of the new traffic is automatically redirected to the secondary wan.Additionally, they would like to expose services simultaneously on both WANs.From what I understand, the only way to address the first issue is to configure an SD-WAN, adding both WANs to the Virtual Link Zone, including this zone in all policies and static routes, and then creating an SLA monitor.As for the second point, how could that be handled?Would it be feasible to create a virtual VIP address?Thanks,Cheers

Dears  I need Memory size for this Products : FGT-60F FGT-50GFGT-70G 

BodyHi everyone,GoalI want my FortiGate 60F to continuously ping a specific host, for example 172.16.23.254. If it stops replying, I need FortiGate to trigger a webhook that will notify a Telegram group. The Telegram webhook side is already working, so I only need help with the FortiGate trigger.EnvironmentModel: FortiGate 60FFortiOS: 7.4.8Target to monitor: 172.16.23.254The target is on LAN, reachable via interface: internal4What I have workingA webhook action that successfully sends a message to my Telegram bot when manually tested.What I am trying to achieve on FortiGateSet up a reliable ICMP probe to 172.16.23.254Generate a log event when the host is considered down, and again when it recoversUse an Automation Stitch to catch that event and call the webhookQuestionsWhat is the best practice approach for my case?Desired outcomeWhen 172.16.23.254 fails ICMP for N consecutive probes, FortiGate sends a webhook to Telegram with a short message that includes the host, status, and time.Wh

FortiClient VPN on Windows ARM64 – app crashes when opening “Configure VPN” (JavaScript error in Electron process)Message:Hello,I’m encountering a crash issue with FortiClient VPN-only 7.4.3 (ARM64) on Windows 11 ARM64. The application installs and launches properly, but crashes immediately after clicking on “Configure VPN”.Installation note:The official installer (FortiClientVPNInstaller_arm64.exe) is an online stub (~5 MB) which does not accept standard command-line switches such as /log, /extract, or /quiet.To proceed, I monitored the temporary folder during installation and manually extracted the .msi file from the AppData path.After that, I either ran the MSI directly using msiexec /i or allowed the original EXE to complete. The installation finished successfully.The application now launches correctly in VPN-only mode.Current issue:When I click on "Configure VPN", the application immediately crashes.There is no visible error message in the GUI.No relevant logs appear in Event View

Hello All, Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates. But in test via openssl s_client -connect mysite:443 -servername mysite -showcerts I'll see error "Verify return code: 21 (unable to verify the first certificate)"What's wrong, what I missed?

I can't believe that I have to buy an entire product (Fortiauthentior) that duplicates 95% of what I already have just so I can do user authentication on a Forti firewall for machine that are not Hybrid enrolled. Absolute joke forcing customers to buy more product.

I have deployed FortiManager-VM in an air-gapped environment and enabled communication with FortiGuard via a proxy server.Recently, I purchased and registered an add-on license to increase the maximum number of devices that can be managed by FortiManager-VM. The additional device license is successfully registered and visible in the Fortinet Support portal, but the actual FortiManager appliance does not reflect the increased device capacity—the newly added device licenses are not syncing.The original base license for 10 devices continues to work and receives updates from FortiGuard, but only the original 10 devices are recognized. The appliances do not recognize the add-on licenses for additional device management.In this proxy-enabled, isolated environment, do I need to manually upload the license (.lic) file to FortiManager to activate the added device capacity? Is there a recommended procedure for applying an add-on license to increase the number of manageable devices when automatic

Hey everyone,I really need a bit of guidance. I’m working on the FortiOS 7.6 Administrator Self‑Paced course right now because I’m planning to take the NSE 4 FortiGate Administrator exam and get my FCP – Secure Networking certification.But I just saw a notice that says this 7.6 course and its exam will be retired on December 31 2025, and there’s a new FortiOS 7.8 Administrator course coming out on October 15 2025.Now I’m confused — should I finish the 7.6 course and take the exam before it retires, or stop and wait for the 7.8 version instead?If I pass the 7.6 exam, will it still count toward the FCP – Secure Networking certification after the new version comes out?My plan is::keycap_1: Finish NSE 4 (FortiGate Administrator).:keycap_2: Then do one NSE 5 (likely FortiManager Admin) so I can complete the full FCP – Secure Networking.Can someone please confirm the best path to follow?Thanks in advance for helping me sort out the