Support Forum

I plan to implement FortiToken as a Multi-Factor Authentication (MFA) solution to be used on company laptops.However, the current situation is quite unique. The available laptops are limited in number and are shared by multiple users who take turns using them at project sites or during business trips. As a result, these laptops are not dedicated to a specific user.If FortiToken were to be assigned to all users, the implementation would be less effective, since not every user is always working on-site or traveling for business.Therefore, it is necessary to choose a type of FortiToken that can be used flexibly and shared among users, ensuring security needs are met without limiting user mobility. Which type of FortiToken would you recommend that can be used flexibly and shared among users in this scenario?Thank you.

Is it possible to deploy a standalone FortiNDR as a VM in a Hyper-V environment? In the Fortinet documentation, I only found support mentioned for KVM and VMware

Hi everybody,when i try to connect with forticlient vpn i receive a "Connection was terminated unexpectedly."this happens only in my personal hotspot (iphone; telekom). when i try it with a hotspot of my colleague (also iphone; telekom) it works. it also works within our companies wifi.we are not connected to any VPN with our iPhones. apple private relay is also disabledcould any other iPhone setting cause that problem?

Hi everyone,I can't change the password from FortiPAM.In the "Windows Domain Account" or "Windows Domain Account (Samba)" template,instead of the "target" field,  only the "Domain-Controller" field appears.The problem is that if I enter the domain controller's IP address in the field, I can no longer access my destination domain server.So, in the domain controller field, I'm forced to enter the server's IP address because I no longer have the host field.So, I can access the final server, but I can't change the password.RegardsLuca

Hello everyone,we're currently experiencing issues with some users trying to connect to our IPsec VPN. The FortiClient times out during connection, even though the configuration and password are correct.After investigation, I found that the root cause seems to be related to users who are members of a large number of LDAP groups. For those users, the FortiGate fails to process the authentication request and throws the following error: diagnose debug application ike -1 diagnose debug application authd 60 diagnose debug application samld -1 diagnose debug application fnbamd -1 diagnose debug application eap_proxy -1 diagnose debug console timestamp enable diagnose debug enable2025-09-19 11:57:45 1758275865.817240: 2025-09-19 11:57:45 EAP-TTLS/PAP: Correct user password 2025-09-19 11:57:45 1758275865.817297: 2025-09-19 11:57:45 EAP-TTLS: PHASE2_START -> SUCCESS 2025-09-19 11:57:45 1758275865.817396: 2025-09-19 11:57:45 EAP-TTLS: Derived key - hexdump(len=64): 2025-09-19 11:57:45 17

Hi, I have multiple VPN connection installed in my machine. Some are windows native VPN connections and some Forticlient VPN connections. Forticlient version is 7.4.3.1790. Operating system is Window 11 with latest updates. When i connect Forticlient IPsec VPN disconnect it and try to connect Windows native L2TP/IPsec VPN, it does not work, but returns error:The L2TP connection attempt failed because the security layer encountered a processing error during the initial negotiations with the remote computer.I found out, that windows VPN starts working again, if I stop "IKE and AuthIP IPsec Keying Modules" forcibly with command:$ net stop "IKEEXT"So is there some kind of "unclean disconnect" bug in Forticlient? Or could this be fixed with proper settings etc?  

HelloI'm trying to login in the normal way of EMAIL USER and I get an error message that the SAML request has expired. My two-step verification is currently configured via email. But even when I tried to change to an authentication app, I get the same message. when im trying to login via incognito mode im getting the same issue. The error massage is redirect me to the support portal and from there i do can loggin to my account. What a strange issue is that ??  Does someone ever faced an issue like that ?please help !!  

Hello Community,I’m working on configuring Captive Portal on my FortiGate firewall with FSSO integration, and I’d appreciate some guidance.Objective:Domain users should be authenticated automatically via FSSO (or group-based policies) when they are on the corporate network.Non-domain users (not logged into the domain) should be redirected to the Captive Portal.On the Captive Portal page, these non-domain users should still be able to log in using their Active Directory credentials (username/password) to access the internet.Is there a recommended approach or workaround to achieve this setup?Thanks in advance!

If i have 2 SLA performance to monitoring packet loss and latency to google and microsoft and both SLA used in single sdwan rule.Then the when sdwan will switch to the next member? if only one sla is not met, example high packet loss to the google but rest of 3 sla targets is good will the traffic switched?Or sdwan will switch if all 4 targets is not met?

Hi, I have to configure new FortiAPs changing from a configuration with different Ubiquities. Right now they have like 2 SSIDs and they are in different Vlans. Problem is that the FW is in the warehouse and they pass connection from a Cisco Switch to another Switch via VLan. I told the provider who manages the switch that I need ACCESS ports with VLan whatever he wants to connect the FG60F directly to port X on the Cisco Switch and also to connect my new FortiSwitch in port X on the other Switch. From there I have direct connections from the PoE FortiSwitch to the 5 FortiAPs. Now I am not sure what to tell them, do I need the specific VLan also on my new Interface Port 4 in the FG60 which I name FortiAP Zone? I understand that bothe Wifis will have automatically their VLan and network, etc. So it should work having the access connection on both switches, right?Something else I have to consider? Thanks! 

 Dears,We have recently added a new FortiManager (version 7.4.7) to our environment and are working on integrating a FortiGate cluster (version 7.4.8). However, each time we try to add the FGT cluster, we encounter the following error related to an FSSO group:  Command fail. Return code -131: datasrc invalid. object: user adgrp. detail: FSSO_Agent. Solution: data not exist  Could you kindly assist us in resolving this issue?Best regards,

Hello Guys, is it possible that FortiClient can cause problems with drivers? Since we have Forticlient in a company we are facing problems with drivers, mainly audio/video drivers. People report that they are not visible via camera or microphone was not found even day ago it was everything OK.

For some reason, my Fortigate 40F (v7.0.13 build0566) is losing the date and time settings when it loses power (maybe the battery is dead) and when the power comes back on, the Fortigate displays the message "Fortigate time is out of sync". I have already set the Fortigate to use the NTP server 200.160.0.8 but it does not work. When running the command "diagnose sniffer packet any 'host 200.160.0.8' 4" I can see the UDP requests being generated from my public IP, but no response is received.  In "Fortiview sessions" no sessions are displayed.If I define this NTP server on a LAN host it works perfectly.It seems that the problem only occurs when the traffic is generated by the Fortigate itself towards the IP 200.160.0.8. Could this be a bug in this firmware version?

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.After a few manual tests, we'll migrate the remaining endpoints to the Linux EMS server by changing the EMS DNS record.How can I generate an overview of the EMS servers with endpoint connections/registrations?

I wonder if there are ways to enable an authentication check for services other than HTTP, FTP or SSH.Right now, ZTNA mostly checks the device identity with the ability to check the user trough ZTNA Tags or authentication Rules.When I use other services like UDP etc, a login into my Windows machine is enough to enable access, as most compliance-based tags stay valid for long times.Is there a way to force check user identity?Like having a mandatory daily Entra Login through the EMS or something similar.With VPN, you nearly always have to log in to prove your identity, even better when using MFA.ZTNA feels like a "step back" on that front, or am I not seeing something clearly?Maybe I misunderstood the goal that ZTNA has, but in my opinion it markets itself as an architecture that is a valid alternative to VPN. But while I have a login for VPN every time I want to establish a tunnel, I miss this check for ZTNA.This makes it hard for me to see it as a valid alternative and recommend this s

Hi, Anyone out there using FortiOS v7.4.4,build2662 on the FortiGate-60F? How is your RAM usage? I've installed v7.4.4,build2662 a couple of weeks ago, and the device was entering conserve mode every few days or so. Usual RAM utilization was around 75%, right after boot, so no wonder it was pushing it into conserve mode. I've since downgraded to 7.2 (now usual RAM usage i 60-65%) but with this version we're having other issues which I would love to resolve (long connection times, need to refresh a web page a few times to open it etc...). Here is the info I got during the last conserve mode:firewall01  get system statusVersion: FortiGate-60F v7.4.4,build2662,240514 (GA.F)First GA patch build date: 230509Security Level: 2Firmware Signature: certifiedVirus-DB: 92.05717(2024-07-10 07:26)Extended DB: 92.05717(2024-07-10 07:25)AV AI/ML Model: 2.17065(2024-07-10 07:45)IPS-DB: 28.00824(2024-07-10 00:15)IPS-ETDB: 0.00000(2001-01-01 00:00)APP-DB: 28.00823(2024-07-08

when connect to FortiClient by laptop we lost the internet connection during VPN connecting (IPsec VPN), but when we use a mobile we don't lose the internet. How can we keep the internet connected using the laptop?note that the default route exist, the ping to 8.8.8.8 stopped even the default route exist

Hello, since we cant use SSL VPN with the G model we are trying to move to remote IPSec.We are testing first with the IT department. Last week, everything was fine, no problems connecting to IPSec.But yesterday one of our technician was not able to connect. The problem was the Token, while connecting he was asked to put the token and he got denied. He tried like 2 times and than switched to SSL VPN where the Token was working the first time connecting. That makes us really uncomfortable thinking about switching all users to IPSec which we have to do some time soon.I checked the Log files and I dont get an idea about the failure. First it seems OK:Action negotiateStatus successResult XAUTH authentication successfulAn than the last Log is: Action delete_phase1_saThe thing is that there is no failure with FortiToken since it works fine with SSL VPN so I dont know where to look for a possible failure.Thanks!

After upgrading FortiGate 101F to firmware 7.4.9, SSL VPN authentication via Azure AD SAML (Microsoft MFA) stops at 40%.

Hello,I have an existing network with a Dell server (192.168.62.251) running Active Directory, DHCP, and DNS, and a ZTE router (192.168.62.1).I want to configure a new Fortinet 60F (192.168.1.99), but I would like to keep my current network configuration.

Hello.   I'm trying to set up an 81F (FortiOS 7.6.4) as router on a stick. It would be a staight forward action, however I'd like to have other interfaces set as access mode on one of the VLANs that are supposed to go through the trunk. For example, internal5 would be the trunk (VLANs 10 and 20 tagged), and internal2 and internal4 should also allow untagged access to VLAN 20.   I've stumbled on this article https://community.fortinet.com/t5/FortiGate/Technical-Tip-Comparing-Hardware-switches-Software-switches-and/ta-p/210092 and it kind of addresses the issue, if I set a virtual switch per each of the trunk's VLANs, while leaving one interface dedicated for trunk (instead of declaring dot1q entries).   Is there a proper way of accomplishing this?    Thanks in advance for any insights, and all the best. 

 Hi all! I am working with a FortiGate firewall that has an internet connection with a static IP.Our goal is to route the default gateway through an IPsec tunnel that breaks out via the headquarters. When configuring SD-WAN, a default route (0.0.0.0/0.0.0.0) is created toward the SD-WAN zone.Inside this SD-WAN setup, the IPsec tunnel is included with a performance SLA, so that the route is automatically disabled if the tunnel becomes unavailable. In this case, traffic should then fail over to the physical WAN interface.However, for the IPsec VPN, an inbound and outbound policy is required without NAT.These policies are placed at the top of the policy list: from IPsec to SD-WAN, and from SD-WAN to IPsec.The complication arises when the physical WAN interface is also placed inside the SD-WAN zone.In that scenario, NAT is required; otherwise, internet traffic via the local ISP will not work. One possible solution is to configure the physical WAN interface outside

After deploying FORTIEMS 7.4.4, the Webserver certificate was replaced via the GUI, under EMS Settings → Webserver Certificate, changing from FCTEMSXXXXXXXXXX.cert to fcems-server.cert.After this change, access to the console was immediately lost. Even after restarting FORTIEMS, access could not be restored. Would it be possible to: Restore the console to its default settings; orRevert/change the certificate again through the EMS CLI?

I have an upcoming job where I’ll be installing and configuring a FortiGate to serve as the edge router at a facility currently running an all-Cisco internal network (from a previous contractor). The long-term plan is to replace all Cisco devices with Fortinet gear, but to avoid downtime, the Cisco network will continue operating through the FortiGate for now.Currently, a Meraki MX400 is acting as the edge router. Since we’re unsure of its configuration and I haven’t worked with one before, we don’t want to remove it yet. Instead, the MX400 will connect to the FortiGate, which will then connect to the ISP. We’ll begin building the new network off the FortiGate while keeping the existing Cisco network running through the MX400.The MX400 already performs NAT, so I want to avoid double NAT on the FortiGate. Would the correct approach be to create a firewall policy on the FortiGate for the interface handling Cisco traffic and simply disable NAT? 

I plugged my new 50G in before going away for a week. Everything seemed fine in the 24 hours prior to me leaving. When I got back, it seems there are issues, and I notice about 12 hours ago, I was upgraded to 7.4.9 from 7.4.8. It's like there is an MTU mismatch, but I have my WAN set to DHCP and it's auto selected 1500, so I think that looks fine.Are there any other issues that might cause packet loss or intermittent internet issues, esp on wireless devices (connected to the Fortigate by TPLINK AP's).Sorry, it's a bit vague, this is definitely new behaviour since either the switch to the 50G from my 60F (brand new install) or since the deployment of 7.4.9 by Fortinet.