Support Forum

Hi,i want to replace my Windows 2019 RAS/VPN Server and the AlwaysOn VPN Setup.In this Setup, i define the VPN Tunnels in Intune. One Tunnel is a Device tunnel, the notebook can connect to a few servers only.This is used for remote administration and for a user logon, if the user new to the notebook. A Second Tunnel is for a User tunnel, after the notebook has established a Device tunnel and the user logon´s on, the user get´s his User tunnel. => After all, the machine has two VPN tunnels. Now, i create this VPN/IKev2 tunnels in FortiGate 120G (7.4.9) with help of these articles https://community.fortinet.com/t5/FortiGate/Technical-Tip-Windows-IKEv2-native-VPN-with-machine-certificate/ta-p/278825https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/726232/windows-ikev2-native-vpn-with-user-certificate The notebook will connect after reboot with a Device tunnel.As soon the user logons on, Windows 11 gets the user tunnel up. An

I have MAC OS I get permission denied error through the forticlient console. The crdentials are correct and so the VPN settings such DG, port,etc...I tried connect through web too by enter the getway connected succesfully to the portal but "launchforti"button doesnt response

Hi, We are observing that traffic is being routed to the internet unexpectedly. To restore connectivity, we need to manually clear sessions each time, which is not normal behavior. What would be the root cause of why the traffic is being forwarded to the internet instead of the intended path. Suggest a permanent fix to avoid the need for manual session clearing. Expected Route: Port3Source: 10.1.17.0/24 & 10.1.24.0/23Destination: 10.201.0.0/16  Here is the sniffer. diagnose sniffer packet any "host 10.201.11.149" 4 0 1interfaces=[any]filters=[host 10.201.11.149]0.094933 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9780.151538 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9790.197107 port3 in 10.202.11.149.5065 -> 10.1.26.78.5060: udp 9800.200285 port3 in 10.202.11.149.5065 -> 10.1.24.78.5060: udp 9780.320295 port3 in 10.202.11.149.5065 -> 10.1.24.78.5060: udp 9760.381149 port3 in 10.201.11.149.5065 -> 10.1.24.78.5060: udp

I have to migrate configuration from two Fortigate 100F units in HA (active/passive), currently in production, to two new Fortigate 120G already purchased. In the configuration of the 100F units there are:15 IPSEC lan2lan vpn tunnelmany users (local) IPSEC dialup vpn (non-SSL) By loading the configuration file of the 100F into the 120G (after pre-configuring them), the shared secrets of the LAN2LAN VPNs, the passwords of dialup VPN users will be preserved or will they have to be reinserted again? Thanks for support.

In the sdwan what mean of 'failures before inactive' and 'restore link after'?Example if i set failure is 5, this mean sdwan will decided the link down if there are 5 consecutive sla target excedeed the threshold, or if there are 5 sla target above the threshold (non consecutive ) in the last 100 poll for packet loss? Also if the check interval set to 1000 ms and the protocol using ping this mean every second the fortigate will send only one icmp request to the server?

Currenlty i have alert to send sdwan health to the email by using this parameter     and i got this message date=2025-10-13 time=20:18:25 devid="FG1234567890" devname="FGT1" eventtime=1760361505429374908 tz="+0700" logid="0113022923" type="event" subtype="sdwan" level="notice" vd="Internet" logdesc="SDWAN status" eventtype="Health Check" healthcheck="teams.microsoft.com" slatargetid=1 member="11" msg="Member status changed. Member out-of-sla."  But that information is not enough, there is no information about which which SLA target was exceeds the threshold and what the the value of that time. Anyone know how to add that information?

Problem:I am experiencing an issue with my VPN connection using FortiClient. The connection successfully establishes, but it disconnects after 25-30 seconds.Symptoms:- After clicking "Connect," the VPN connection is established successfully.- Data traffic begins with approximately 35KB sent, but received traffic remains at 0KB.- After 25-30 seconds, the connection drops with the message "SSL VPN Connection is down."FortiClient Version:- FortiClient VPN Only 7.4.0.1658Logs:- sslvpndaemon_1_error.log: [2024-08-04 11:01:10.7069198 UTC+03:00] [12232:12956] [sslvpndaemon 540 error] CListener::_ReceiveMessage() Could not read from pipe(0x0000000000000544) client. Error=109 [2024-08-04 11:01:13.5362518 UTC+03:00] [12232:20528] [sslvpndaemon 569 error] CListener::_ReceiveMessage() ERROR_BROKEN_PIPE [2024-08-04 11:01:13.5363023 UTC+03:00] [12232:20528] [sslvpndaemon 590 error] CListener::_ReceiveMessage() ERROR_BROKEN_PIPE [2024-08-04 11:01:14.4208549 UTC+03:00] [12232:13988] [sslvpndaemon

I have been looking through the Fortimanager API documentation and there is a section mentioning running CLI commands against managed devices: https://how-to-fortimanager-api.readthedocs.io/en/latest/007_device_management/007_device_management.html#how-to-run-cli-commands-against-a-managed-device However, there is a warning message saying it is not yet supported and 'Caught in #1155085, #1072897 and #1133627.' I have tried it myself and get the same result as the example, so it definitely isn't working at the moment. I'm wondering if there is anywhere we can see where the progress of this is at- I have tried searching those aforementioned numbers which I assume are case tickets, but haven't found anything. It would be useful to have a timeframe on when this functionality might be made available.

Hi everyone! I have problem with content filtering which block PDF files with act.js  and obj.js  detected by Content Filter, filetype application/javascript filename obj.js Is any suggestions to prevent this? How to resolve problem with minimal security impact? 

H Everyone,One of our office users is experiencing an SSL VPN disconnection issue. After a successful login, the VPN disconnects automatically within 30 seconds.The FortiGate device is functioning as the VPN server and is running FortiOS version 7.2.11. The user is using FortiClient version 7.2.8 on a Windows 11 PC.Interestingly, the same user has another SSL VPN connection configured on the same laptop, and that connection is working fine.At this point, I also suspect the issue might be related to the user’s laptop.We are actively looking for a solution, so if you have encountered a similar issue before, your insights would be appreciated.Regards,Azarudeen

Dear Concern, Users are trying to access a website, but the website is not opening. Instead, a 'Website cannot be opened' page is displayed. I am unable to determine whether this issue is being caused by my FortiGate firewall blocking the site or if it is an issue on the ISP's end. Kindly guide me on how to troubleshoot whether the firewall is blocking the website or if the problem lies with the ISP. Please also provide troubleshooting steps and CLI commands to help resolve this issue. Additionally, I have allowed the website in the web filter under security using the FQDN type, but I am unsure whether the web filter policy is functioning correctly or how to verify it. Please explain this as well. Website: https://english.nmpa.gov.cn/     Please help me to troubleshoot the issue. I just want find that the issue is at my firewall end or ISP end.

Error message:/saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>__samld_sp_login_resp [826]: Failed to process response message. ret=-111(Failed to verify signature.)samld_send_common_reply [91]: Code: 1, id: 539, pid: 5739, len: 64, data_len 48samld_send_common_reply [99]: Attr: 22, 12,samld_send_common_reply [99]: Attr: 23, 36, Failed to verify signature.samld_send_common_reply [119]: Sent resp: 64, pid=5739, job_id=539.[5739:root:0]epoll saml recv resp error.[5740:root:216]Timeout for connection 0x7f7ebad000. My SAML IDP uses Casdoor, which is an open source identity authentication system. I made sure my certificate is the public key certificate imported from the Casdoor system.

Hi, Ive configured ipsec ikev2 for remote access vpn users (with radius group auth). The FortiClient VPN Only keeps prompting for token, even though MFA is not configured on FGT. The only workaround I've found so far is to reinstalling the FortiClient, which resolves the issue. Has anyone experienced a similar problem or found a permanent solution for this behavior?FGT 7.2.12 and 7.4.9FC 7.4.3.1761 and 7.4.3.1790

 Hello everyone,I ran into a tricky issue upgrading FortiClient EMS from 7.4.0 → 7.4.4. The installation failed with the following PostgreSQL / Sqitch error:  ERROR: insert or update on table "software" violates foreign key constraint "fk_software_software_icons" DETAIL: Key (icon_id, vdom_id)=(5800, 1) is not present in table "software_icons".  Even though the upgrade script tried to rollback, it left the DB in an inconsistent state. The installer log showed it reverted to version 7400 and aborted.Here’s how I resolved it::white_heavy_check_mark: Steps I tookConnect to the correct EMS databaseThe problem tables were in fcm_default, not fcm. sudo -u postgres psql fcm_default Check schema of software and software_iconsI confirmed software had icon_id and no vdom_id, and software_icons had id.Clear orphaned icon_id referencesI ran: UPDATE software SET icon_id = NULL WHERE icon_id IS NOT NULL AND icon_id NOT IN (SELECT id FROM software_icons); Verify no inval

We currently have a cisco FTD1140 as the main firewall but are now planning to add a Fortigate 100F in front, between the ISP and Cisco. Not exactly sure how to configure the IP's of the Fortigate 100F to allow traffic to passthrough. The Fortigate will serve as a filter in order to reduce the load on the Cisco. Any ideas on how to configure the Fortigate. Eventually we will setup the fortigate as SD-WAN. Here's a picture of what I believe it will look like. 

Hi, I've configured a ZTNA Server + Rule + Destination for RDP Session to a certain server.Therefore I configured a PROXY Port  which is then TCP Forwarding to Port 3389. Anyhow no RDP connection can be established.Any ideas? KR Chris

Just noticed that my setting of: # config system settings # set gui-object-colors enableDoesn't seem to enable per-interface changeable colors in 5.6.5 (FortiGate 300D and 100D). I can still set colors for the FortiSwitch VLAN interfaces. Anybody know if the functionality can be enabled somewhere else, or if this feature was dropped or is broken?

Hi all,I’m looking to remotely change the FortiAuthenticator server address used by the FortiAuthenticator Windows Agent on client machines. Is there a way to do this via Group Policy Object (GPO) or registry editing?

Hello everybody, I recently posted a similar question about Forticlient EMS deep inspection. I'm posting a new one adding some (I hope) useful informations.A client is working from home and is using Forticlient.On the Forticlient EMS, web filtering is enabled with deep inspection. In this kind of scenario, Fortigate is not involved in any way.Some sites are giving problems.For example, a particular site, onesignal.com, when deep inspection is enabled, is blocking the client: Nothing but a generic error about my IP address. If deep inspection is disabled, everything works fine, so I think deep inspection is causing the issue.I also believe that the problem is not Forticlient itself, but how different authenticator providers are reacting (above is an example, but sometimes cloudflare gives the same problem, signaling my IP as suspect).I tried to exclude the site from web filtering, but I think that deep inspection comes before filtering, so the issue remains.On the EMS, to re-encryp

For the past few weeks—ever since we updated to the latest Forti firmware version 7.4.9—we’ve been experiencing ongoing loading issues with some websites hosted on Azure and also with Dynamics 365. It’s as if they time out when trying to load. It’s not a firewall rule issue, since it happens even without SSL inspection and with no restrictions applied. If I test the connection to these sites directly through my ISP’s router, they work perfectly, but not when going through my Forti device. Is this a known issue? It only seems to happen with Microsoft services.

Hello,I generated an SSL certificate with OpenSSL, self-signed, and then signed it with our internal CA to use for the HTTPS management interface on my FortiSwitch.I uploaded the certificate and private key through the web interface. The system shows “Upload successful,” but the certificate does not appear in the certificate list and is not applied to the HTTPS interface.Could someone please advise how to resolve this issue or the correct way to upload a self-signed certificate on FortiSwitch?Thank you.

We’re trying to mitigate users who employ auto‑clicker or automation tools that repeatedly send HTTP POST requests every 100 milliseconds. Our goal is to restrict each user to a maximum of 1 request per 300 milliseconds, and to return HTTP 429 (Too Many Requests) if that limit is exceeded.We’re looking for the best way to implement this restriction within a Fortinet environment—specifically using FortiWeb or FortiGate if possible.Can FortiWeb’s Rate Limiting or Bot Mitigation features be configured to apply per‑client‑IP or session with a millisecond‑level interval?If not, what’s the most effective configuration to approximate a 300 ms threshold (e.g., through request‑per‑second rules, anomaly detection profiles, or custom WAF policies)?Are there any best practices or sample configurations to handle legitimate bursts without blocking valid users?Any guidance or example policies for achieving this kind of fine‑grained rate control would be greatly appreciated.

Hi,I have a FortiGate 40F v6.4.15 build2095 (GA)If I upgrade the firmware to upper versions, will it keep all my custom settings ?Kind Regards,Joaquim

Hi, Can someone please guide whether we will be able to add remote user into the domain who is connected to HO network using Foritsase SPA.  Regards,Ganesh

Hello using Fortigate 100D I have added it in category overide and also web filtering it works and let me on sometimes but on other times or a diffrent person they get this An application is preventing Microsoft Edge from safely connecting to this site"Fortinet" didn't install properly on your computer or network. Contact your organization to fix the issue.NET::ERR_CERT_AUTHORITY_INVALID     I've tried using a hotspot to go outside the firwall and get certificate and uploading to fortigate but it give me an error suggesting i already have it?