Support Forum

Hello. I am standing up a FortiClient #EMS ppliance for the first time, and I have somewhat limited experience with Ubuntu. Our platform is Hyper-V.  The vhdx was properly installed and booted.  I was able to login with user 'ems' and successfully changed the password. So far so good. However, it seems to me that after login, I am now in the 'bash shell', and the instructions for configuring an IP, seem to be based on being in the terminal. None of the commands available in bash seem to allow me to do this. And the instructions here don't work, as they are for terminal.  I tried "execute ls /etc/netplan" but it told me "folder /etc/netplan is not accessible" Can you please help me configure IP? I imagine once that's done, we can ssh into the terminal or maybe even a webpage? Deploying EMS as a VM image | FortiClient 7.4.4 | Fortinet Document LibraryConfiguring the VM IP address by modifying Netplan configuration filesTo configure the VM IP addres

Several IPsec "tunnel-down" per day :FGT ===VPN IPsec tunnel=== ISP box (SFR operator) ==fiber access==> Internet (also many DPD_failure or ESP_error) : reduced by modifying tunnel parameters :NAT-T = forced, DPD = OnIdle, retry=6, intv=45s- no way to customize MTU at tunnel level (FGT GUI)Anyway there are still many "tunnel-down" per day (re-established automatically after:tunnel up). Many LAN users get network outages (Teams, Outlook etc...) - ISP box in NAT traversal mode (ESP encapsulated in UDP 4500)- Many sites are impacted. build = v7.2.11 firmware Support ticket is opened at SFR operator side (SFR box or backbone ?)Could it be a known firmware or configuration issue/bug at Fortinat side ? Thanks

Hi everyone,I recently took the FCP FortiGate Administrator 7.4 certification exam (formerly NSE4) on February 20, 2025. I passed the exam, and I can see my score report in Pearson VUE, confirming the result. However, I haven't received my certificate or badge yet.I've tried to open a ticket on the FortiTraining help desk, but I haven't been able to do so. Since I couldn't find another way to request support, I’m posting here to ask for guidance on how to resolve this issue.Has anyone else faced a similar delay? Is there another way to contact the Fortinet team regarding this?Any help would be greatly appreciated!Thanks!

Hi all,Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?Thanks in advance RegardsFrédéric 

Hi, I have tried using the reset button during operation and also after one power cycle but the reset button is not resetting my Fortigate-100F with FortiOS 7.4.7. I have left the button pressed for more than 30 seconds but it does not make any changes. Is there a specific step I must carry out to reset my device? I have checked on the OS and admin-reset-button command is set to enable so the button should work. Please I would really appreciate your support.

I have a TRUNK-LAG configured for Aggregate mode. This interface contains VLANs 40–48. I want to add VLAN 49 as tagged on the TRUNK-LAG and untagged on SWVL-49. How can I do this?   

I am trying to install a Google Chrome extension, but my web filter is blocking the download, even after allowing the category: URL: https://chromewebstore.google.com/Extension: Microsoft Single Sign On Category: Freeware and Software DownloadsRisk Level: TrustworthyGroup: Bandwidth ConsumingThe website loads normally, but when I click to download the extension, I get an error message.I removed the web filter and it worked. I believe it is in another category, but I don't know which one. 

Hi, we changed to a FGT90G cluster and we have to change from SSL VPN to IPSec. We are running 7.4.7 and I think it will be the last image with SSL activated. We only used SSL VPN since it seemed easier to configure with different Groups, etc. Now trying to do the same with IPSec we have several problems. Our IPsec configuration:>In the IPSec Client Address range we used another range than SSL VPN (X.X.X.50-100 and IPSec X.X.X.150-X.X.X.200.>We enable Enable IPv4 Split Tunnel and define in Accessible Networks ALL since we want to have access to the LAN and also the MPLS networks>In XAUTH  User Group we have INHERIT FROM POLICY to use the same user groups we had before with SSL VPN Now our problems:> With the Forticlient 7.2 we cant connect, the client shows connecting but nothing happens. Also in the FG I dont see any information about the IPSec access. With older versions, I tried a 6.4 the connection works. > Since SPLIT Tunnel i

Hi AllCan anyone at Fortigate please let us know when they will release an install package for OpenSuse and SLEDAlso, I have tried everything I can think of to get Forticlient to work on OpenSuse Leap 15, but no luck. I have to connect to Company VPN using IPSec but now have to run a windows PC to provide Access to their network because for Some reason Fortigate thinks RedHat and Ubuntu is good enough, Fortigate is an international product, they need to provide for all the mainstreams, including KDE as well. Response on this will be greatly appreciated.

Hi Everyone I added fortianalyzer to fortimanager but fortimanager removes fortianalyzer immediately after successful addition. What should I do to fix this?fortimanager (VM on hyper-V) v7.6.3 build3492 fortianalyzer (box) v7.4.5 build2553 (Mature)   

Hi everyone, yesterday FortiClient Malware Protection decided to flag a vmdk (vmware drive file) as malicious with threat "JS/Phish.A9BF!tr".  Is this clearly a false positive? Or is FortiClient able to analyze virtual drive files in detail?

Hi, I have a new Notebook, Windows 11 Pro and Snapdragon CPU. I cant install Forticlient. I tried different version, 6.4.7, 6.4.10, 7 and the latest one. I run as administrator and after installing the drivers it shows rolling back and it can not be installed. I tried the Remove Tool and the Laptop started again, but installing I dont have more luck. Any more suggestions? Thanks

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

Hi all,I'm experimenting on v7.2.11 with ADVPN, SD-WAN and BGP on loopback interfaces. My problem is that I can't understand or find information on how the underlay interfaces routing should be configured. Two or four IPSec tunnels are members of the overlay SD-WAN zone (both branch and HQ use two Internet uplinks). The tunnels are configured on different physical interfaces and should be active all the time, so encrypted packets should go out through the respective interfaces to the specified addresses. A default route through one interface, of course, won't do. Should there be two/four routes to 0.0.0.0/0 through all interfaces with the same distance? Or should there be another SD-WAN zone containing the underlay interfaces? But in the latter case, won't SD-WAN steer all encrypted packets through one "best" physical interface?While I'm at this routing question, I would also like to ask another, simpler one: when configuring a site-to-site VPN without split tunnel, I have to set a def

Hello guys! Got a bit confused with FG's auth process for remote ssl-vpn users. For now we have a simple LDAP/AD (w/o agent) based authentication for remote users and ACL based on AD group names, everything just works and works fine. Now I got the case that I have to implement MFA via an MS NPS(plus azure MFA) as a radius server (please don't ask why). I don't understand how to implement this transparently. Do I have to add all existing groups by name in the same way how I do this with LDAP into each ACL(that's could be long, but ok)? And how the FG knows in which group a user in ? What if the user is in several groups? So can anyone elaborate these moments ? I read this article , but it's still unclear https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-User-Groups-to-match-multiple-Remote/ta-p/358789 AFAIK the FG gets the group name AVP from the radius server (MS-NPS) , but is it all groups for each client or like a first group per client ? Do we have to change sett

Hi!  We have a pair of Fortigate VM64 in HA on VMware (provider is OVH).We are migrating clients from PaloAlto to this Fortigate. We have around 30 VDOM (and we need to add more), with VDL link to the root.We have EMAC VLANS for the interface (WAN, Private and DMZ). It is working, but when the sessions increase around 30K and higher, everything become very slow.The ping between private and dmz inside any vdom increase around 100-150ms with lost packets. The CPU is used max 20%, and the memory around 60%. We have a ticket with Fortinet, but for them , with a packet capture, there were able to show that the fortigate don't add any latency in the packets. We move back one of the client to PaloAlto and they are now happy!The PaloAlto use the same VMware farm. To be able to make the EMAC VLAN and VDL work, we needed to enable the promicious mode on the port group on VMware. Maybe this is the problem. The links are 10GBs, and the traffic on the trunk t

I've been tasked with implementing a FortiVoice 50E6 On-Premise appliance on our HQ. I've had Voice experience with Grandstream... but this feels like a totally different thing. I'd like to know if there's any type of documentation that can help me install an analog trunk.I'd deeply appreciate the help.

Hey guys, I got a weird one here. I know the FortiExtender is the device to make this happen but a need has come up to try and see if this works on a Dual 3G4G 70G. Idea is that the FortiGate WWAN interface would terminate the connection to the private cellular APN and then pass the assigned IP through to a device behind it. I also found this doc but I don't think it is quite what I am looking to do.https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/862747/direct-ip-support-for-lte-4g

If the FGT in the Azure V-hub isn't directly connected to the local network, the local network won't be able to access it and won't be managed by our local FortiManager.Azure V-hub doesn't pass its routes to indirect connections. What are your thoughts on this issue?

Dear All,We recently completed a migration from F5 to FortiADC, and the applications are functioning well through FortiADC. However, we observed an issue specifically with the SAP mobile application:The application works properly on both computer and mobile browsers.But it does not work on the mobile application.If we revert back to F5, the mobile app works fine. The only noticeable difference is that we configured a URL redirection policy on this virtual server in FortiADC. Other than that, all configurations are identical to the working setup. Has anyone experienced similar issues or can provide insights on this behavior? Your valuable inputs will be much appreciated.Thanks, SivaG

Hello expert. i Humbly request some guidance. I have a fortigate 80F and tried connected  to manage the  fortiswitch 524D via fortilink but the following error  "offline" (see screen shots) I have included a two screen shots for clarity.    Regards

Hi all, I'm an experienced network guy with 28 years of experience, but it's all Cisco. I'm new to Fortinet. Here's my question: I'm working on a design for a customer with multiple satellite offices that connect back to two datacenters (primary and DR). They are all interconnected with two layer-2 ELAN WAN meshes.  I want to centralize all of my routing onto the Fortigate firewalls at each location. But because the WAN links are from two separate vendors each Fortigate is going to have two physical handoffs, one to each vendor's network. My plan is to create a WAN zone on each Fortigate and then put both physical interfaces in that same zone. (I don't need any filtering/firewalling between those interfaces.) I'm trying to find out if I am going to run into any asymmetric routing issues. The WAN circuits will be load balanced so I can't promise that packets  from a particular session that go out on one vendor's circuit won't return on the other vendor's circuit

Sorry if this is not the correct place to post this:Hi,I'm new to FortiNet and started at a small company that uses it. It fell into my role as I'm the most technical person on the team, and my predecessor had long left before i started, so no handover.I'm struggling to know where to start. Any recommendations? Good YouTube series etc?I've been experimenting with adding new devices/servers to test existing firewall and port rules, but i can't get anything to communicate off its local subnet so i didn't get very far.Thanks

 Dear Team, I would like to seek your support regarding SSL certificate deployment. I have added the firewall SSL certificate into the AD server via Group Policy, but it seems not to be working as expected. Currently, the only way users are able to access the internet is if I install the certificate manually on each workstation. Since we have 3 branches with AD hosted in the DC, and more than 500 users, it is not feasible to install the certificate manually on every system. I need to ensure this certificate is deployed successfully via Group Policy so that all users automatically receive it. Could you please assist me in resolving this issue? Thanks in advance for your support. Best regards,

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?