Support Forum

In https://docs.fortinet.com/document/forticlient/7.2.1/macos-release-notes/223986/special-notices it is mentioned that Ikev2 is not supported on forticlient but in https://docs.fortinet.com/document/forticlient/7.2.0/new-features/374894/support-for-ikev2-for-forticlient-macos-7-2-3 it does mention support, (and it doesn't mention that it is not available anymore)But when I use Forticlient version 7.2.4 or 7.4.0 it still has the Ikev2 option greyed out for IPSec VPN.Does anyone know if it is still not avaiable or If there is something that I need to change?

hello,are there any best practices to make FortiClient (vpn ssl) more reliable to weak connectivity (like 4G on trains)?I'd like to increase the timeout before it disconnect from the fortigate when there are connectivity issues.PS why DTLS (which may help) is not enable by default on the FortiClient SSL VPN?

hello togetherI have the following problemover IPSEC VPN the file transfer to a share is very slow.We are talking about 1mbits to about 25mbits.The file size is between 500mb and 5000mb.The local breakout are no problems only via IPSEC I have the problemFrom the outside locations (100F each) it goes to the HQ (FortiVM02).Each remote site is connected with 1000 mbit synchronously.All Forti have 7.2.3 in use.IPSECAre connected withIKEv2AES 256 and SHA 521 in both phases and DH 21 also in both phases. 

Hello everyone ,  Our client wants to acquire Fortigate in his infrastructure . He has one Datacenter where he wants to acquire 2 Fortigate Firewalls , and one center as campus where he wants to acquire 2 fortigate Firewalls as well . FG-200G can meet the requirements presented in the RFP (throughput , max tunnels VPN IPSec , interfaces etc ...) but I don't know if this model is adapted in such environments as Datacenters . Can anyone help me with some ideas if it would be the best choice and if this model can be adapted to Datacenter enviornments ?  Regards  

Hello! Can you explain why a deny happend on this log? The address is release in the rule, but it was blocked anyway, just a single time. date=2025-08-28 time=10:08:20 id=7543622580939259925 itime=2025-08-28 10:08:21 euid=3 epid=6003 dsteuid=3 dstepid=101 logflag=3 logver=704082795 sfsid=0 type=traffic subtype=forward level=notice action=deny policyid=52 sessionid=147382898 srcip=172.30.171.217 dstip=138.59.163.69 srcport=42401 dstport=443 trandisp=noop duration=44 proto=6 sentbyte=180 rcvdbyte=0 sentpkt=3 rcvdpkt=0 logid=0000000013 service=HTTPS app=HTTPS appcat=unscanned srcintfrole=lan dstintfrole=wan srcserver=0 policytype=policy eventtime=1756386501043559039 crscore=30 craction=131072 crlevel=high srcuuid=498de162-e8a6-51ef-6775-922ed917fc34 dstuuid=5d5a000e-f37d-51ef-1ff6-866a1aaf3cde poluuid=f050e110-e89d-51ef-5c4c-a43178bb4c78 srcmac=56:84:20:f4:60:02 mastersrcmac=56:84:20:f4:60:02 srccountry=Reserved dstcountry=Brazil srcintf=lan dstintf=wan2 policyname=Boleto_digita

Hi folks,I'm replacing a Palo Alto PA-3220 with a Fortigate 3001F. Our Palo is at our research site and it has some things behind it and some things in front of it. It does routing for a few RFC1918's that are behind it, but all the rest of the routing is done on the outside. Arbitrary hosts are behind the Palo in arbitrary subnets and vlans, and other hosts in the same subnets and vlans are not behind it. The Palo seems to handle this just fine using layer 2-only vlan interfaces and I can assign multiple of those to the same zone even though they're on different physical interfaces and then just assign policies based on address and zone and it doesn't care that the subnet is spread across two interfaces - it's not doing the routing anyway... the Fortigate seems to really want subnets to exist on one side of the unit or the other, and I can't have floating VLAN interfaces that aren't attached to any physical interface like you can on most other network devices I've worked with, unless

I need to check What is my Lacework IP address For any integration  with other services. Can you suggest ?

Hi all, I'm trying to setup a Windows Native IKEv2 VPN on a Windows 11 laptop to our FortiGate due to issues with the free FortiClient. I'm using a pre-shared key and NOT certificates at the moment and also using a Windows radius server. I've triple checked all the settings are the same on both sides but keep getting the same error above on the Windows machines but googling all seems to point to a certificate error but I'm not using certificates I'm using a pre-shared key but would this still affect me i.e. is it a certificate I need to put on the laptop to allow it to use Radius or something or should it work without any certificate intervention at all if I'm just using a Pre Shared key ?Hope that makes sense.Thanks

I'm new to fortinet hardware and am currently having fun and games with a fortigate 401F running v7.4.8We have two internet connections, a static connection with a /29 subnet of public IP's and a broadband connection. Most traffic is routed out of the broadband and we plan to pin only a few systems to the static connection.For our static WAN,.89 is the gateway.90 is the firewall.91-.94 we will use for servicesThe .90 is set as the address on the WAN and the 91-94 are added as secondary addresses.I'm trying to set up a DMZ with one system in it at the moment. The DMZ network is running on a separate switch plugged directly into the firewall with the gateway on the firewall.I've set policy routes for the internal traffic followed by a policy route for the external traffic plus an outbound rule using an ip pool with the address I want the server pinned on (.93)If I run a "what's my IP" from the server it reports the .93 address and if I run curl commands or an apt update, it can pull info

We are currently facing an issue in our ADVPN setup. Whenever the hub firewall goes down, the following problems occur:BGP sessions drop and all routes are withdrawn.Spoke-to-spoke shortcut tunnels remain in the UP state, however spoke-to-spoke communication does not work.Our expectation from ADVPN was that spoke-to-spoke tunnels should continue to operate even if the hub is unavailable. However, in our case everything depends on the hub.Could you please confirm if this is a design limitation or if there is a configuration/workaround to maintain BGP routes and spoke-to-spoke communication independently of the hub? Kindly guide us with the best practice solution.

Hi everyone,I’m working on a FortiGate(FortiGate F100-7.6) deployment where VLANs are currently configured under a hardware switch interface. Each switch in the network is connected to the FortiGate via individual trunk links. Now, I want to migrate to a more scalable setup using aggregate (LAG) interfaces between the FortiGate and the switches. Here’s the challenge:I want to continue using the same VLANs (e.g., VLAN 10, 20, 30) across the network.These VLANs are already configured and working on the FortiGate’s hardware switch interface.I now need to connect the switches using new aggregate interfaces, but I’m not sure how to handle the VLAN configuration on the FortiGate side.My question is:Can I use the same VLANs (with the same IDs) on both the existing hardware switch and the new aggregate interfaces.what's the best way to deal with this. i will have 3 switches in aggreg with the fortigate. I know the switch side configuration, only confused about the vlan config on the

Can we get the real bandwidth for each traffic shaper using SNMP? What oid can be used?

Helloour ip was banned for portscanning activity. So i need to know how can i stop this service from our lan and how can i set a log to see the pc that have this problemI have se log to "memory" and Event logging "ALL" , Local Traffic Log "ALL" but i don't see anythingThanks

Hi,I'm trying to configure two FG 201G HA with dual home FS424 switches  (mesh connectivity). I added each core switch port to FW1 and FW2 to the fortilink interface. I was reading some fortinet documentation saying that each firewall connections to SW1 and SW2 has to be on separate LCAP group. But I do not see any option to configure LACP group when we added those ports to "fortilink" interface. See below my topology. Below link shows such design option (see only the core portion), but does not have any configuration details how to configure two LCAP groups on firewall side.If anyone has configured/implemented above scenario, please advise me with what exact configuration we need to configure for the ports connecting from Core1 and Core2 to FW1 and FW2 to make this work smoothly.  Thank you in advance..

We`d like to have a traffic shaping policy enabled, but have it only activate after a set client has exceeded a certain amount of bytes sent/received (say 3 Gigs) , within (for example), 24 hours.However, I can only seem to find options to enable the traffic shaping for bandwidth, not bytes.Is this possible?Thanks

We already use Microsft Entra for VPN autentication. Now i just want to know it's possible to enable 2FA for SSL VPN? Actually the entra user have 2FA enabled.

 Hi everyone, I've been struggling to get an IPv6 address from my ISP (KPN in The Netherlands). Despite following several tutorials on how to set this up, I haven't been able to receive an IPv6 address over the PPPoE tunnel interface. However, I can successfully obtain an IPv4 address on the same interface. Here are the tutorials I used as guides:KPN Community Forum - FortiGate 60F SetupNetwork Dynamics - IPv6 SetupMy SetupRouter: FortiGate 60F (7.2.10)Switch: FortiSwitch 108F-FPOE (connected via FortiLink)Access Points: Two FortiAP 231FWAN Interfaces:WAN1 (connected to KPN ISP)WAN2 (connected to a second ISP)Both WAN1 and WAN2 are configured as members of an SD-WAN zone.Current ConfigurationFor simplicity, I’ve removed WAN1 from the SD-WAN zone for testing. This ensures SD-WAN settings don’t interfere with IPv6 troubleshooting. Physical Interface (WAN1):  config system interface edit "wan1" set vdom "root" set type physical set

I have a zone on the FortiGate named "VPN Zone", which includes both SSL-VPN and IPsec.We are now testing a ZTNA appliance that is connected via the X1 interface -> VLAN 101.I added the VLAN 101 interface to the existing "VPN Zone" and included its subnet in the existing rules.As a result, LAN clients can communicate with devices inside VLAN 101. However, devices inside VLAN 101 are being blocked by the FortiGate from accessing LAN.FortiAnalyzer reports that the traffic is blocked by policy ID 0, showing the source interface as "VLAN 101". This makes sense, since there are no explicit policies referencing that interface, only the zone.and idea why the existing permit rules for the zone do not trigger for VLAN 101 outgoing? but incomming is fine?FG200F v7.4.8

Hello,I have two VLANs connected via FortiGate 40F:VLAN 40: phones, PBX, and PCsVLAN 10: serversThe network is working fine in general. However, after replacing two old phones with new Grand stream models GRP2602P, I started facing the following issue:Scenario 1: When I call an old phone from a new phone, only I can hear the audio, but the other side cannot hear me.Scenario 2: When the old phone calls the new phone, both sides can hear each other without any problem.Scenario 3: When I call between the two new phones, everything works fine (two-way audio).Scenario 3: when I Make call for outside calls everything fineSo the issue only happens when calling from a new phone to an old phone.Could you please advise what might be causing this problem and how to solve it?some people say this problem from FortiGateThank you.

I have a FortiAP-221E that appears to still be bound to FortiCloud. and I don't have access to the FortiCloud account.When I press and hold the reset button, the device only reboots instead of performing a factory reset.I connected to the console CLI and I can run commands such as cfg -x—but the device only reboots.My goal is to remove this FortiAP from FortiCloud and manage it locally from my FortiGate controller.

Hi, I'm experimenting a new weird issue with an IPSEC dialup VPN created on a FortiGate 100F with FortiOS 7.6.4. The thing is that I can reach a connection with the FortiClient v7.4.3.1790, and my connection is able to send Bytes but it's not receiving any Bytes. I've been trying several configuration using the IKEv1 and IKEv2, and unfortunately, using IKEv2 is not connecting and using IKEv1 I was able to have a connection but only is sending Bytes and not receiving. Any idea or solution will be are welcome... One more thing, I already reviewed the article ID 352403 posted by Stephen_G, about a similar situation but, my configuration of the FortiClient is the same to the configuration suggested in that article, and it's not working... Please see the snapshots below... Thank you in advance for all your help...

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8).  I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine  certificates.  We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side? I've been spinning my wheels on this for awhile now.  Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2?  When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit. Thanks! 

Dear All, I would like to check on the options available to restrict devices connecting through the Mobile Hotspot feature in Windows OS at the gateway level. In an AD environment, this can be controlled using Group Policy. However, in a non-AD environment, apart from relying on an endpoint protection tool, what other options can we use to manage this? FortiGate FortiNAC FortiClient FortiSwitch 

HelloWhen updating FortiGate to version 7.4.8, I noticed that the performance history of a Performance SLA was reduced to just one minute. Previously (in version 7.0.13), the SLA performance graph showed a 10-minute history. Is it possible to increase this time to 10 minutes in FortiGate 7.4.8? If not, what are my alternatives? 

Hello Team, I created a new module, saved it, then clicked the Publish All Modules button. After waiting a while, it reopened and didn't show any errors on the screen. However, I couldn't find the module anywhere. My account has admin privileges. When I checked the account's audit logs, I saw the “Publish Failed” error. {“error”: “Command `doctrine:schema:update --em=default --force` finished with code: 20”,“status”: “Failure”,“message”: []} How can I fix this?Best regards.