Support Forum

Using the FortiClient VPN to connect with SAML authentication, logins worked before we created a Conditional Access policy that enables "Require device to be marked as compliant" and "Require Microsoft Entra hybrid joined device". When we connect Microsoft blocks the login because it doesn't recognize the device with the following info. You can't get there from hereThis application contains sensitive information and can only be accessed from:domain joined devices. Access from personal devices is not allowed.The current browser is not supported, please use Microsoft Edge, Internet Explorer, Chrome or Firefox 91+ to access this application.If you're not planning to do this right now, you might still be able to browse to other domain sites. Otherwise, sign out to protect your account.Sign out and sign in with a different accountMore detailsError Code: 53001Request Id: RequestUUIDCorrelation Id: CorrelationUUIDTimestamp: 2024-09-14T20:46:27.958ZApp name: My VPN Enterprise AppName

We are using 200F firewalls in an HA pair on 7.4.8.  We use CSNAT.  We have SIP ALG disabled.  We need to NAT SIP traffic from one port on the firewall to another port on the firewall. Local Phone Server (Mitel) <=> ATT IP Flex Router. We need to make sure when the local phone server communicates with the ATT IP Flex Router, all traffic comes from a specific IP. We have setup the necessary NAT rules. For some reason, SIP traffic is not NATing.  All other traffic NATs fine- just not SIP traffic. For example, if I ping the ATT IP Flex Router from our local phone server, NAT works. When I initiate a SIP connection from our local phone server to the ATT IP Flex Router, traffic is not NATed- the ATT IP Flex router sees the local IP of our phone server, not the NATed IP. Is there a setting that enables SIP NAT?  Any other configuration tweaks needed? Thanks.

Hey there, We have a website whose domain is the same as our internal Windows domain name. We have external and internal DNS in place along with a trusted GoDaddy certificate on the website and the specific webpage I'm referencing. This web page runs an inframe that links back to Salesforce. On the Fortigate side, I have the website, webpage (it's a subdomain) both with wildcard allow rules on the Web Filter. I also have Salesforce allowed on the Application Control. However, the webpage is in a weird state to where it's mostly blocked with "connection reset" errors when you use any of the browsers. When I check the logs in the Fortigate, it shows me UTM Blocked because of SSL. However, the SSL is perfectly fine with a latest and greatest 1.3 certificate. To make matters worse, sometimes the webpage actually isn't blocked on Firefox and when I check those Fortigate logs, it shows as UTM Passing with SSL 1.3 through Microsoft Edge even though its Firefox. So, I'm not sure

Hi,I have a problem.I'm trying to deploy a Fortigate HA Active/Passive SDN connector cluster.If I go to marketplace, Choose the Fortigate Azure application and with the plan "Active-passive HA with fabric connector failover", I can't choose the desired VM type that is in the sizing guide.The sizing guide says that I should choose the D2s_V5 VM. But it isn't in the list.If I instead choose to deploy a single firewall from the marketplace, the D2s_V5 VM is there to choose.Any suggestions? Am I missing something?

Hi, I have this situation:an on-premise network that connects to the internet via the local Fortigate through the local ISP. I have a single VM that I need to force to use the tunnel from the on-premise Fortigate to a Fortigate in the cloud and connect to the internet using the VPN. I have tried all possible configurations, but via PBR, the VM continues to use the local ISP and does not use the VPN. I can't figure it out.odg is the signle ip of the vm 

I have a Fortigate on AWS and want to put it on FortiManager.What is the best way to do this without having to use the public IP?

Hi, We have currently migrating Cisco Firewalls to FortiGate. The client purchase FortiConverter Service license, and correct me if I am wrong, we will be registering the FortiGate devices to the FortiCloud including the FortiConverter Licenses attached to that devices? Then will need to open a ticket and upload the config files? What if we have more than 10 config files from more than 10 firewalls. It is possible to consolidate it?

All, We are a self managed small but growing design practice utilizing a FortiGate 60E in our file server.  Our office is expanding to the floor above our current space.  We currently have the following hardware in our rack: - Apple Mac Pro (Mostly a mac environment)- FortiGate 60E- Cisco SG200-50P Switch- Comcast Router- 4G Cellular Failover Router- Sonnett Tech Echo (NAS)- Security Camera Headunit Everything else is just monitor, keyboard, battery backup etc.  We are expanding to the second floor and will be moving both the Mac Pro and the NAS upstairs.  We purchased another Cisco SG200-50P for upstairs switching.  Currently, the Comcast Router (WAN1) and 4G Router (WAN2) are connected to the FortiGate which then routes to the Cisco Switch.  We are currently utilizing about 32 ports which is a mixture of data only endpoints and some VOIP endpoints.  We additionally have a UniFi software controller and a couple of WAPs serving int

Hi , Recently we are observing Cloud Activity log ingestion failure detected every hour. The alert information shows only about resource of lacework subscription event created in lacework gcp project. Subscription is active.  Is there any way to debug this scenario? 

Hi there.I am having some issues installing FortiClient 7.4.3 on MacOS 15.6 (24G84)Macbook Pro M4 Pro Using the terminal, I found that the installer fails at around 97%. installer: Package name is FortiClient installer: Installing at base path / installer:PHASE:Preparing for installation… installer:PHASE:Preparing the disk… installer:PHASE:Preparing FortiClient… installer:PHASE:Waiting for other installations to complete… installer:PHASE:Configuring the installation… installer:STATUS: installer:%17.931671 installer:PHASE:Writing files… installer:%39.280230 installer:PHASE:Writing files… installer:%64.101310 installer:PHASE:Running package scripts… installer:%64.661962 installer:PHASE:Running package scripts… installer:%65.221900 installer:PHASE:Running package scripts… installer:%65.786566 installer:PHASE:Running package scripts… installer:%66.347237 installer:PHASE:Running package scripts… installer:%66.911340 installer:PHASE:Running package scripts… installer:%86.516746 ins

I have firewalls in HQ and Branch. The goal is to send all traffic, internet and LAN from branch to HQ, so Branch will use the HQ internet. And HQ will have access to Branch LAN. The branch has dynamic IP from the ISP and the ISP router handles PPPOE. So the firewall is connected behind the router, since the router handles VOIP lines as well. For now I'll leave it that way until I can test and confirm if IPsec is a suitable option for this project. The tunnel is up and everything is working but my Branch internet download speed through the tunnel is 40Mbs which is acceptable since the HQ upload bandwidth is 50Mbs, but the Branch upload is only 8Mbs. This seems too low. Direct internet at the branch without tunnel is 100 down/50 up. I have the tunnel set up as below. Please help me check if this optimal, or if anything is done incorrectly. I have two Phase2 selectors. This is on HQPhase1Transport: UDPNAT traversal: EnableDPD: On DemandDPD retry count: 3DPD retry inte

Hi,I want to monitor a public IP from my FortiGate, and if the IP becomes unreachable, I want to automatically receive an email alert.Is this possible using FortiGate Automation? If yes, how can I set it up?FortiOS Version: 7.2.10

I am implementing certificate-based authentication for Windows logon using FortiToken 310 and FortiAuthenticator.Configuration steps completed:Integrated FortiAuthenticator with Active Directory.Created a Root CA on FortiAuthenticator.Generated a user certificate, signed it with the FAC CA, and imported it into the FortiToken 310 via FortiToken Manager.Configured the token PIN.Imported the FAC Root CA into the Windows Trusted Root Certification Authorities store on the test PC.Enabled smart card logon policy on the Windows test machine.Test results:The Windows login screen recognizes the FortiToken smart card.The PIN is accepted successfully.However, authentication fails with the error:"The credentials could not be verified." FortiAuthenticator  FortiToken 310  #Windows logon @Anonymous@support

Hello, I have upgraded my FAC Agent version from 5.2 to 6.2 on my RDS Host.A few days later I have lost the capability to do a remote connection (aka RDP) on this server. I have completely uninstalled the FAC Agent on this server but the RDP access is still unavailable.I have the FAC Agent v.5.2 installed on another RDS Host server and everything is working nice. Nothing in the release notes, any ideas ?  Thanks,

 Hi all, How FMG deals with SNMP events that are supported by FMG but aren't supported by the managed device Ex: a system template with SNMP settings includes some SNMP events enabled. One of them is a Fan failure event. On the other side, a managed device, FG x, doesn't support the fan failure event in its SNMP settings. What happened when we tried to push this template?

I have a fortigate 60F in HA, I see the tokens, but when I want to assign them to users a message appears informing that the device is not registered, but if it is, the OS is 7.2.11 1740, The error appears when I want to send the email to the user

Greetings! I've been trying to set up a lab using FMG and FGT trial licence VMs on Hyper-V. I'm able to run both VMs alright individually, problem is when I try to register the FGT on the FMG.It appears that none of my FGT VMs are able to get their serial number under the CN or SAN fields on the Fortinet_Factory certificate and that makes FMG refuse connections to those VMs. I've tried redeploying the VM but that makes it "unlicensable" and its SN shows "FGVM00UNLICENSED". In this state, it refuses any attempts I make of licensing it, be it via login to FortiCloud or via license file upload. I'm running FMG VM version 7.4.7. I would try a lower version to avoid that issue but all the VM images available for download on FortiCloud currently have the same restriction regarding the fgfm-peercert-withoutsn command.  I'm running Hyper-V because I've had no luck downloading VMWare Workstation Pro from the Broadcom portal.Any help would be appreciated.

Hello everyone,I have a network that was configured a few years ago with a FortiGate (FG) using a "hardware switch" on ports 1, 2, and 3. The setup is as follows:"internal1" interface:Contains three VLANs:VLAN 1: Used as the core VLAN (I know this is not ideal, but I am not authorized to change it).VLAN 100: Network exclusively for wireless clients.VLAN 1005: Network for phones.Network topology:FG -- Cisco Switch-- FortiSwitch 108 (FSW)The FSW is connected to the FortiGate through "internal1."I configured the FG to recognize and manage the FSW via FortiLink, even though it is not directly connected.FortiLink configuration:I created VLANs 100 and 1005 within FortiLink, assigning them IP addresses and DHCP servers different from those in "internal1."Issue:The VLANs configured on the FSW via FortiLink have no connectivity and do not receive IP addresses via DHCP.I have already configured the ports on the intermediate switches (Cisco and HPE) to allow all VLANs, but the issue persists.Any

Dear Team,This email seeks assistance with a recurring issue experienced by field users attempting to access our internal asterisk-based VoIP web application, located at https://aaa.bbcone.com, through a FortiClient IPsec VPN tunnel.While the application functions flawlessly when users connect via FortiClient SSL VPN, Now we are planning to shift all users to IPSec VPN. A subset of users connecting through IPsec VPN are encountering browsing difficulties. These users are able to successfully ping and telnet the application's domain/IP address, confirming network connectivity at a basic level. However, their web browsers are unable to establish a connection to the web application itself. Initial troubleshooting included manually adding an entry to the hosts file on the affected Windows 11 workstations, which resolved the issue for some users. However, a significant number of Windows 11 users continue to experience the problem, indicating a deeper underlying issue.Based on rese

Hi everyone,I’m running into an issue with FortiClient VPN Only 7.4.3 (VPN with SSO/EMS support) on macOS 15 Sequoia (15.6). What’s happening:The VPN requires SSO via web browser (SAML) + 2FA.On macOS 15 Sequoia, FortiClient never triggers the required Automation (AppleEvents) TCC permission.I have reset TCC (tccutil reset AppleEvents com.fortinet.FortiClient), reinstalled the app, and checked Automation, Accessibility, and Full Disk Access settings — nothing changes.Without the Automation permission, the embedded SSO browser cannot complete login, and the VPN connection fails.Environment:Personal Mac (non-supervised, no MDM)FortiClient 7.4.3 (VPN + SSO)Tested: full uninstall/reinstall, TCC reset, permissions check — still no Automation promptQuestions for the community:Has anyone managed to get SSO working with FortiClient on macOS 15 Sequoia without MDM/supervision?Is there an older version (e.g., 7.2.x) that still works on macOS 15 for SSO?Any info on when macOS 15 Sequoia will

i am using 2 FG61F (7.4.8 Mature) with IPSEC IKEv1 Tunnel to same HUB which is not under my care. Config is basically default with no more additional config. First FG (let say FG-A) , no issue , all is working properlybut FG-B had issue with Packet Loss , it happens at random time & no pattern. Tunnel is up , no error log. i already enable ike debug to monitor but no output in process. i wonder if anyone had issue similar to mine , i have tried everything but still no luck , the only way to make tunnel stable is to zero the traffic by cut lan connection. Thanks before.

Hi, I have been using the FortiClient iPhone app for some years, and as long as I enable the save password feature on my Fortigates the SSL-VPN Client will be allowed to store the password on the device. However after either iPhone IOS upgrade I observe this feature no longer works for my connections, and I need to input password manually every time. Of course I can try to completely remove the FortiClient on my iPhone, but I was just interested in checking if someone else is experiencing the same issue here in the forum. The app settings have always survived IOS upgrades, and also the save-password feature always have been working. Now the app always requires password, the save function never works..

Hello Folks, windows environment seem to be somehow complex to me when dealing with ZTNA, especially when knowing that some transactions need line-of-side connections between clients and the DC, many ports being used on both TCP and UDP. In my scenario, I have configured a ZTNA server to the LDAP, included all ports required. UDP seem to work, cause I have tried to resolve names from the client side. However, when it comes to the user login (with a new username that is not cached on the client machine or after resetting a domain user`s password), things not working. I have seen this kb about the need for a KDC proxy for accessing shared folders. Do I need a KDC also to allow users to login to their machines when they are at home (especially after a password change?) ZTNA access proxy with KDC to access shared drives | FortiGate / FortiOS 7.4.1 | Fortinet Document Library Secondly, for the sake of troubleshooting, sometimes I needed to analyze packets from

hi,i need to convert the ASA static NAT on a subnet to FortiGate.the FGT GUI doesn't allow me to add/configure a LAN subnet.just wondering how to implement this?do i configure individual LAN/mapped IP in a VIP, add to a VIP group to the same external/public IP?can i also configure the same external/public IP for both DNAT and SNAT? does FGT allow this? ASA:object network obj_LAN_SUBNET subnet 172.16.1.0 255.255.255.0 nat (inside,outside) static 89.1.1.1 FGT:config firewall vipedit "lan-vip-1"set extip 89.1.1.1set mappedip 172.16.1.1set extintf "any"endedit "lan-vip-2"set extip 89.1.1.1set mappedip 172.16.1.2set extintf "any"endconfig firewall vipgrpedit "lan-vip-group"set interface "any"set member "lan-vip-1" "lan-vip-2"edit DNAT 1set srcintf "port 1" <<< WANset dstintf "port 2" <<< LANset srcaddr "all"set dstaddr "lan-vip-group"set service "all"set schedule "always"set logtraffic enableset status enableset action acceptset nat disableend

Hello,I need to design a report on VPN Remote IP countries. There is no srccountry or similar field in the VPN event logs, so I wonder if the Geo IP Location info is available in SQL as a table that can be queried in a dataset.Alternatively, I wonder if the Dataset design interface would allow me to create this table, operation that would require the interface to accept a quite large amount of text in the CREATE TABLE command. Also I wonder if in 7.4 ar more recent releases the possibility to create permanent tables (not temporary!) has been restored.Thanks