Support Forum

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?

Hello All, I am testing free Forticlient VPN only in Ubuntu-24 and Fedora 41, unfortunately it doesn't works after 1 month trial period expired. It's showing "Forticlient- Zero Trust Fabric Agent" only. However, free forticlient working fine with the Windows and MacOS even after 1 month free trial.Note: I am using latest version of free forticlient vpn only.https://www.fortinet.com/support/product-downloads#vpn- For the Linux I tested Strongswan VPN (CLI) and that works fine, but not with GUI "Network manager"  

Hello, I'm using Fortigate 201E firmware version 6.4.4.I have a traffic received from the port3 which needs to be translate to the broadcast address of port3. It means that the traffic needs to go from the same interface (ingress = outgress). So, I did the following configuration: In the port3 I have disable the anti-spoofing and enable the broadcast forward. edit "port3" set vdom "root" set ip 192.168.1.126 255.255.255.128 set allowaccess ping set broadcast-forward enable set vlanforward enable set type physical set src-check disable set alias "SERVICE" set security-mode captive-portal set security-exempt-list "port3-exempt-list" set role lan set snmp-index 11Then, I have create the VIP like this edit "DNAT_SERVICE" set uuid 14e3dde2-8a4d-51f0-58aa-109e4a3fac68 set extip 192.168.1.126 set mappedip "192.168.1.127" set extintf "port3"

Rule that use SNMP for a method seem to be very inconsistent. Have devices all configured from a clone image but some will not meet the rule but others will. I there a way to see why?  

Hey, Looking incorporate are existing Duo 2FA setup into our FortiGate VPN, I've followed through the guide but falling at the last hurdle. I've gotten as far as adding the Duo Proxy host as a radius server in Forti and if I do "Test Credentials" here it all works as expected, I get a prompt on my phone and a success message when I accept it. I've then tried to apply this to the VPN by creating a new user group linked to the radius server and changing the group in the SSL VPN Settings > Authentication / Portal Mapping section to be the new group. Unfortunately when I then try to connect to the VPN it never prompts for verification, just fails to authenticate. I have also ran the following at the CLI to increase the timeout but it didn't help. config system globalset remoteauthtimeout 60end I'm sure I've missed something super simple, but can't see what at the moment.

Hey Team, So My setup is as follows, the issue is that i can only get to my unifi device over the internet on the unifi UI website and i cant access it locallyInternet > Fortinet WANTwo networks on two interfaces 172.16.1.0 and 192.168.1.0Fortinets UI is 172.16.1.99172.16.1.0 is a virtual switch to my IT gear and network192.168.1.0 is for my family and runs a unifi gateway which then runs their network via DHCPThe Unifi gets a DHCP Address and detects the internet on 192.168.1.112The Unifi then runs its own internal network 192.168.0.1 which is also the Unifi's UI IPIt then translates via NAT to the fortinet on 192.168.1.112 for internet accessIt is an odd setup and yes i know a unifi gateway wasnt meant for this purpose but it works for me and makes my familys access point easy to control and networkSo the issue is, 172.16.1.0 cannot talk to the unifi's little internal network 192.168.0.1 to access the UI over the LAN, i can only access it over the internet as its added as a g

I'm facing a critical issue with our FortiGate 30E devices significant number of dropped packets across all LAN ports, while the WAN port continues to operate normally without any loss

Hello   I'm having trouble configuring an IPsec VPN. I configure one IPSec VPN and everything works fine. Clients connect and everything works fine. When I add another VPN, the previous one stops working. Below is the configuration of the first working VPN:                  I'm adding a second VPN    After adding a second VPN, "VPN_Gamma," the first one stopped working. Only after disabling the vpn_VPN_Gamma_remote policy did the first VPN start working again. What could be causing this?

Hello,Is FortiClient suitable for installation on hypervisors? What devices is FortiClient designed for? Thank you

Hi Friends,I need some help and I hope you all will assist me.I have a problem with a FortiGate firewall. I’m using FSSO (Fortinet Single Sign-On) in agentless mode to communicate with the Active Directory (AD) server for user authentication.The AD server is located at the data center (DC), and the users are located at branch offices.Note:LDAP connection status is upIPsec tunnel is upSD-WAN is also properly establishedBut the problem is:Users are not being authenticated properly. Sometimes they get authenticated, but within seconds or minutes, they become unauthenticated again.I have already checked the AD connection from the branch firewall, and communication is working (SYN-ACK is happening), but still, there’s a problem with authentication.To resolve this temporarily, I have to restart the user’s system repeatedly.Due to company policies, I cannot use agent-based authentication.Please help me with a solution.  

Hello,I'm trying to do a local lab by using Authentik as an IDP to establish sso login on Fortigate admin web interface.I'm using Fortigate VM (FGT_VM64-v7.6.0) I'm following this official Authentik tutorial: https://docs.goauthentik.io/integrations/services/fortigate-admin/ I downloaded two Authentik Self-signed certificate including certificate file and private key file (.pem extension). When I upload/import these files then it said "Incorrect certificate file key size for CA/LOCAL/REMOTE cert.". Can anyone explain and help me fix this issue? Thank you.  

Hello everyone,I’m having an issue with my IPSEC VPN. Basically, when I try to connect, the FortiClient doesn’t even show the loading percentage, and after a while the connection fails, saying the destination is unreachable.Here’s how my network is set up so you can better understand the situation:My ISP has provided me with a pool of IPs ranging from 193.x.x.2 to 193.x.x.5, with 193.x.x.1 as the gateway.However, my public IP (the one used for internet access and bound to my PPPoE) is 82.x.x.9. So I suspect I might be behind a NAT imposed by my ISP (I tried contacting their support, but I couldn’t get a clear answer on this).On my Fortinet FG100F, I have a “transparent” WAN2 interface configured with IP 0.0.0.0 and subnet 0.0.0.0. Then I created a WAN-type VLAN with PPPoE using the credentials provided by my ISP (the PPPoE is configured on the VLAN because my ISP requires a specific VLAN for WAN authentication).I then added the PPPoE VLAN into the SD-WAN, set up a DDNS on that VLAN, an

Hi,I am considering using destination NAT on the secondary IP address of the internet-facing port to build a DMZ network.Although I were able to configure destination NAT for the secondary IP address, but it is not working.My hypothesis is that the product's specifications might prevent a secondary IP address from being used for destination NAT.I appreciate any advice from someone with knowledge on this.Thanks,Kenji

I have been discussing if a Fortigate HA in A/P can work with BGP/EBGP from a single ISP.  So I wanted to see what exactly is possible.  The ISP was going to be providing the routing on their side with my firewalls accepting the connection.  I have put a logically diagram of what I am looking to build.  

When fetching logs from this device, the maximum speed of the fetch seems to be approximately 25 mb/s (observed through interface bandwidth delta at time of starting the fetch on the firewall this traffic passes through) while every device in the network should be capable of at least 1 gb/s and the network is not saturated. We would like to increase the speed as a multi-TB fetch will take weeks at this pace.I was able to gain some improvement by increasing the "config system log-fetch server-settings" parameters of max connections and max sessions, but both are at their maximum of 10. Neither the server or client FAZ are reaching high CPU/memory/disk usage during the fetch.I had took a look a the uptime but not able post the images on this forum I'm getting errors 1st image is Load average 0.73  0.66 .0652nd imageLoad average 3.19 2.90 2.84 I have attached the exec top results for both the server and client FAZ involved in the Fetch. Neither seem particularly alarmi

Hi, Just want to know if FortiManager can access FortiSwitch CLI or edit the port of the FSW? If not, is it included on the future improvements/NFR of Fortinet? Thanks.

I have working EVPN setup to Proxmox SDN, how to announce a default route as an EVPN Type-5 route?Also how to list evpn advertised-routes to certain peer? As i understand this is for unicats address family only:get router info bgp neighbors 10.0.4.1 advertised-routes My current configurationconfig system evpn edit 10001 set rd "65000:200001" set import-rt "65000:200001" set export-rt "65000:200001" set ip-local-learning enable set arp-suppression enable next edit 10002 set rd "65000:200002" set import-rt "65000:200002" set export-rt "65000:200002" set ip-local-learning enable set arp-suppression enable next end config system vxlan edit "vxlan200001" set interface "port2" set vni 200001 set evpn-id 10001 set learn-from-traffic enable next edit "vxlan200002" set interface "port2" set vni 200002 set evpn-id 10002 set learn-from-traffic enable next config system switch-interface edit "sw-vxlan200001" set vdom "root" set member "vxlan200001" next edit "sw-vxlan200002" set vdom "root"

Hi, seeking for your insight regarding on VTP testing between 2 Cisco Switch connected to 2 FortiSwitches. I already enable flood-vtp on both fortiswitches and cisco switches configured as server and client mode.  After a change in the server cisco switch, FortiSwitch hang up and cisco switch port hang up also. Possibly due to VTP traffic flooded to the port. 

Hello, I am with multi VDOM : external, root, internalMy management Vdom is the root, it is good or not ? thanks

Hi everyone,I’m currently running a FortiGate VM NGFW and considering a move to a physical FortiGate appliance for performance and reliability reasons. I’d like to know if there’s any supported method to migrate or transfer my existing VM license to a physical device.From what I understand, Fortinet licenses are tied to the device type (VM vs. hardware), but I’m hoping someone here has experience with this kind of transition. Is there any workaround, trade-in program, or support path that allows reusing the VM license on a physical unit?Any insights, official guidance, or personal experience would be greatly appreciated. Thanks in advance!

I have conditional access policies requiring compliant devices when connecting to Fortigate SAML SSL VPN.I'm trying to connect my Intune registered and compliant iPhone to Fortigate SSL VPN via the free IOS client. I get a message stating the device isn't compliant and needs to register.Does anyone have a working setup with Azure compliance or is this not supported in the free (IOS) version? On Windows it works like a charm. Can't find anything in the documents. Note i'm talking about Azure Compliance, not the Fortinet host check.

Hello Sir, I am currently testing FortiClient EMS for our client.They would like FortiClient to pre-populate the username and password for the IPSec tunnel,without requiring any action from the end user. Unfortunately, I have not been able to find any option in FortiClient EMS for this,and I am not aware of any FortiClient command that would achieve it. Is there a way to achieve this? Thank you for your support.

Dear Sir,I am encountering an issue while configuring SAML integration between FortiAuthenticator and FortiGate IPsec VPN, and I would like to request your assistance.Current requirements:FortiAuthenticator as IdPFortiGate as SPConfiguration steps taken so far:1.Enabled SAML-related service ports on FortiAuthenticator2.Configured SAML IdP General settings on FortiAuthenticator and exported the certificate3.Configured Service Providers on FortiAuthenticator4.Configured Single Sign-On on FortiGate5.Created a User Group6.Established an IPsec Tunnel7.Test result: IPsec connection shows failureI would greatly appreciate it if you could review the configuration steps above to check for any omissions or errors, and provide recommended troubleshooting methods to help complete the SAML and IPsec VPN integration.Thank you very much for your support!

We are looking to migrate to an IKEv2 Dialup VPN with Duo Proxy for MFA and integrating with NPS.  Does anyone have a working config they can provide for this configuration?  I can't seem to find anything online.

I am attempting to setup an ipsec Ikev2 VPN using the Windows Native Client. The attempt to connect fails immediately with the "IKE authentication credentials are unacceptable" error. I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKE-authentication-credentials-are-unacceptable/ta-p/382297. However, I am using our publicly signed Wildcard certificate, so  should not need to upload the CA certificate to the client as stated in the article. I have also found this article which is a similar but not exact configuration: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IKEv2-IPsec-VPN-MS-CHAPv2-with-Windows-Phone-8-1/ta-p/195470#:~:text=As%20for%20Internet%20connection%2C%20change,the%20rest%20of%20the%20settings. This video is also similar but not exact: https://www.youtube.com/watch?v=a0W-NyI6m10Lastly this is an official guide from FortiGate that's also similar: https://docs.fortinet.com/document/