Support Forum

Hi EMS adminsI wonder if anyone noticed if FortiClient could detect the latest critical vulnerabilities that affect driver and firmware of Dell laptops with Broadcom BCM5820X series chips, I mean all of these vulnerabilities:CVE-2025-24311, CVE-2025-25215, CVE-2025-24922, CVE-2025-25050, and CVE-2025-24919.More information here:https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053If your FortiClient has detected them (or not), then your feedback would be appreciated.

Hi all,I was wondering if this is just a local thing, or that starting from this year, you all need to pay for Lab licenses with one year validity? Starting this year it seems to be impossible to get those licenses via a partner SE? We’ve been using them for 5 years and could basically ask for everything that’s a virtual appliance. You cannot get any support on these appliances, but that’s not really an issue. It’s gaining experience before heading into production that counted the most. What are your experiences?

Hello All,I’m working on a case and would like your input on the best approach to resolve it.The current setup is as follows:FortiSASE is configured as a spoke to a FortiGate “Hub” via SPA hub-and-spoke.Two branch FortiGates are connected to the Hub through IPsec VPN tunnels.My goal is to allow FortiClient users connected to the FortiSASE to access resources located behind both branch FortiGates.Do you have any recommendations or best practices on how to implement this? 

HiI'm working on a new design and I need to know if this is possible or not.Currently, we have 2 server rooms in separate buildings. In each location we have a core switch with a L3 routed connection between them. We have stretched vlans between the rooms, using VRRP on the core switches. This allows us to vmotion VM from roomA to roomB, without changing IP details. Each of the server vlans are using the VRRP ID from the switches as their gateway. We also have a Fortgate HA cluster in A-P mode. The active member is in roomA with the passive member in roomB. What I want to do is move the server vlans behind the firewall. Is this just a simple case of moving the VRRP configuration to the Fortigate cluster? How would this work, if there are servers on the same subnet/vlan in each room but there is a passive fortigate cluster member in the room? Or should the cluster be changed from A-P to A-A mode? I'm just trying to work out how the traffic would flow. ThanksRoy

Hello, First time here.Im seeing ZTNA being part of FortiOS 7.0 and beyond is free, I take this free version is quite basic and have its limitations. I would like to know what are the features in this free ZTNA version, like, what ports and protocols are supported, bandwidth limits? I do understand that a full ZTNA implementation would require the EMS license, right? Thanks

I've inherited a FortiGate 60F running 7.6.1. This is my first exposure to Fortigate as previously its's been Cisco Firepower and Palo Alto. It currently has an IPSEC VPN allowing users access to one of the internal interfaces. Auth is currently carried out via LDAP.  Is it possible to allow access to a different internal interface as the same time using a different credentials? If so how?

Hi, Our network consists of 26 access points, a combination of FAP431G, FAP433F and FAP431F, it is pretty much perfect since it was installed 6 months ago, accept for one odd issue. Every now and then one of the APs will decide it no longer like Apple devices at which point none of the ones we have (A brand new iPad and several generations of MacBook) simply won't connect, it's just happened again now with the tablet reporting an incorrect password. When this is happening if the devices are taken in range of another AP they work just fine and android / Windows devices continue to work just fine on the AP that is not working for the Macs. We have a number of SSID's, one using Radius authentication and the rest standard password auth and it effects both. A restart of the effected AP resolves the problem. Any ideas on what might be the cause of this are welcome. Thanks

Hello, I have a strange issue on FortiNAC-F. The switch is Aruba 6100 AOS-CX. The credentials are correct and the RADIUS configuration has been set up for example on two ports. It's working properly but the problem is that for ports that are not connected, it assigns the default VLAN 116 and its updating the config as "vlan access 116". However for ports that have performed "port-access-security" with MAC authentication or dot1x auth, it doesn't assign the "vlan access x" value. It stays as "vlan access 1" but the authentication has been successfully performed, meaning there isn't an issue here. However, unlike the default VLAN, it does not update the VLAN access ID on the port as 'vlan access x'. Then although the host connected to the port is listed in the MAC table, I cannot see it on FortiNAC. As you can see in the first screenshot the port is indeed active. When I disable and re-enable the port, for a while (even though 'vlan access 1' is still shown on the switch), I can see the

In the Fortinac self-guest register, user registration is done, facing issues like "Failed to detect a change in your network settings." So I fixed this issue by enabling RADIUS-COA on Fortigate. Fixed on Android, but this issue is still on the computer window machine. How to fix this issue. 

hello everyone. I have public domain (like https://www.x.ae) and I have local server (192.168.1.10)How can I create link between public domain and local server (I have FortiGate 40f)best regards 

I have a question:We have Fortigate on AWS, and the WAN IP is delivering the AWS public IP:  However, a LAN IP is configured on the Fortigate interface:  To set up an IPSEC VPN, I obviously have to point to “WAN IP” 54, but how will this communication work if the WAN interface has a LAN IP? Do I need to enable the secondary IP as 54..?

Hi, we migrated the firewall from checkpoint to fortinet last week. Now the users complained the browser Edge and Chrome were  automatically changed to other country language. It seems related to fortigate firewall config. Can you someone please advise the possible cause? thanks. 

Hi, Bit of a newbie, please be kind :) In our office, we use IPSec VPN for users to tunnel into our office network, to enable users to WFH. We have a few users who have reported that their FortiClient VPN clients (Windows 10 clients) credentials have started disappearing randomly. What I have narrowed down so far -1. Client attempts a connection, but cancels the attempt before the OTP is keyed in (or before the connection is completed)2. Client either shuts down or restarts their computer while the VPN connection was "ON".3. Client system's Windows update happens and it restarts the laptop or desktop even though the VPN was disconnected, the VPN client loses the user credentials.4. In a few random instances, it just disappears for no reason what-so-ever. We have upgraded all the clients to use FortiClient v7.0.2.0090 for connecting into the office, to reduce any cross-version compatibility issues.FortiClient installation path (C:\Program Files\FortiClient) and Forti

Hi,  I’m trying to use FortiAnalyzer (FAZ) to monitor IPsec tunnel down events in a large-scale SD-WAN.Event Handlers are in place and SMTP email alerts are configured, but I’m seeing:IPsec down events don’t always generate alerts.FAZ is at HQ. When the branch-to-HQ IPsec tunnel drops, FAZ doesn’t trigger the down alert. I usually get a “down + up” alert only after the tunnel comes back up, which isn’t useful.If this isn’t a valid use case for FAZ, what’s the recommended way to achieve timely alerts? Can FAZ generate a “device disconnected” or “device down” event when a FortiGate loses connectivity to FAZ? That would be more meaningful once the tunnels drop.

hi,i'm converting cisco ASA NAT and ACL config to FGT.can someone confirm if items below are correct?note i also used forticonverter, but it's not 100% accurate so doing this manually by hand. 1. if ACL has "ip" does it mean i allow "ALL_TCP" and "ALL_UDP" on the allowed services? access-list acl_outside extended permit ip any host 172.16.8.4 2. for static identity NAT, do i use the vip config "arp-reply disable" and "set type load-balance"?refer to link/recommendation.these are used to "un-NAT" or exclude NAT for  the public IP on the ASA. these are for downstream customer device/CPE configured with pubic IP/WAN. https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-creation-with-same-external-IP-and-mapped-IP/ta-p/190588 nat (inside,outside) source static 200.1.1.1 200.1.1.1 edit "nat_vip"set extip 200.1.1.1set mappedip 200.1.1.1set extintf "any"set arp-reply disableset type load-balance 3.for DNAT FW policy, do i use "LAN" for source i

Hello everybodyIn order to anticipate futur end of life of VPNSSL function, i try to make working VPN acces by IPSEC. Actually : 1 fortigate 100f1 wan fiber2 SSO connexions, for 2 different  Microsoft tenants2 VPN SSL REALMS2 SSL PORTAL in tunnel modeIn SSL Settings, i use SSL portal mapping  In forticlient 2 configurations, one per realms, both pointing to the same wan ip/port, juste realms is different. I would like to make the same configuration but with IPSEC.  nowday i make working IPSEC with SAML, but only for 1 tenant.following this guide : https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients#IKEv2 I don't know how to do this, as my wan link is configured to listen and transfer to a single SSO configuration (saml server).config system global set auth-ike-saml-port <integer> endconfig system interface edit

Hello everyone,I have a FortiWiFi device where I’ve configured 3 SSIDs as follows:veone air: DHCP pool 192.168.10.10 – 192.168.10.254, operating in tunnel modeveone tech: DHCP pool 192.168.20.10 – 192.168.20.254, operating in tunnel modeveone voip: DHCP pool 192.168.30.10 – 192.168.30.254, operating in tunnel modeI’m able to connect to these SSIDs from my computer and complete my tasks without any problems.Today, I received a PBX server that needs to be connected to the FortiWiFi on the internal4 port. The server requires a static IP address 192.168.30.3/24, which belongs to the same subnet as the veone voip SSID’s DHCP pool. This setup should allow me to ping the PBX server from devices connected to the veone voip SSID.However, even though the PBX server is physically connected to the FortiGate’s internal4 port and assigned the static IP address manually, I am unable to ping it from the SSID network.Could someone please advise on how to configure the FortiWiFi or what changes I need t

Hello!  I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering).  One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:config firewall policy edit 117 set name "DNS Filter - Testing" set uuid b4130862-7872-51f0-6074-01eb3ef19f90 set srcintf .... set dstintf "virtual-wan-link" set action accept set srcaddr "laptop wifi" set dstaddr "all" set schedule "always" set service "DNS" set utm-status enable set inspection-mode proxy set dnsfilter-profile "DNS-Filter" set logtraffic all set nat enable next endWhen I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page.  Yet, when I do these

I'm trying to setup Forticlient VPN on an iPad Air 11.Currently I am using IPSEC VPN and Fortitoken for MFA.I have this working on Windows Laptops. the user opens the forticlient. enters the username and password; then clicks Connect.  it connects and asks for the fortitoken. User enters the token and then they are connected. Now i'm trying this on the iPad.  I installed the ForticlientVPN App.  Now I am trying to setup the connection profile.  I gave it a name, and I entered the Firewall IP Address, a port. and a User.After setting up the connection, I go back to the "VPN" screen. I click "VPN and the status is "Connecting"  but then it times out; goes back to "disconnected". I also used "Save Password" but it never asks for the password. There are some differences that i'm not sure where to setup.  For example the Firewall and Windows has a passphrase; iPad did not have a spot to enter this.  I don't know if i'm logging in correctly becaus

HelloI couldn't find both of those data sheets on the website.They only have a generic datasheet that doesn't have those specific datasheets of 231G and 234G.FortiAP 

I setup the SAML against our Azure according to the instructions provided in Configure FortiClient EMS SAML with Azure... - Fortinet Community I have been getting the error IdP Response Error:SAMLResponse must contain an InResponseTo element.After a number of days with support on the latest version the SP is not replying with the InResponseTo element. While struggling to set this up with no clear instructions available and being pushed to set this up with a Fortinet SE I am being told to sign a SAML certificate, however using the CA reloading the certificate in fails.  Below is the last reply from support regarding this issue and my next steps I am stuck on. Has anyone successfully configured the latest version 7.4.3.1926 "It seems based on the EMS version that you have and our analysis, it seems that support to allow for "Sign SAML AuthnRequest" has been removed from later versions of EMS.Previously, this feature could be accessed through a chec

Dear Community,We would like to request assistance with configuring traffic forwarding from our Fortinet Next-Generation Firewall.Currently, we have approximately 40 policy-based client VPNs terminated in GCP. Our objective is to utilize the FortiGate firewall as a transit gateway, terminating all client VPNs and forwarding their traffic to Azure, as illustrated in the attached network diagram.In the diagram:    :white_heavy_check_mark: Green checkmarks represent established/working connections.    :cross_mark: Red crosses denote connections that are currently not established.We are seeking guidance on setting up the appropriate routing or forwarding mechanisms from FortiGate to Azure to complete this integration.Please let us know if you require any further details to proceed.We appreciate your support in identifying the best approach for this configuration.Regards,Aneesh Gupta

Good evening Fortiweb admins, I have noticed an issue with the "URL Encryption" feature on FortiWeb. When I enable my URL Encryption policy, the URLs are successfully encrypted.However, this distorts the design of the protected website:The site’s appearance is no longer the same.Some elements are missing.Colors change.In some cases, only the HTML code is displayed without the CSS, Bootstrap, and other resources.Does anyone have any idea about the root cause of this problem? 

Hello Team, I need some help, please. I have an architecture where two FortiWeb ports are used. Both ports need to operate in one-arm mode and receive traffic from the Internet, as we have two firewalls connected to the two WAF interfaces performing DNAT. Since it is only possible to configure a single default route, how can I make the FortiWeb accept Internet traffic on both ports simultaneously? Note: I have already created a policy route, but it didn’t work. Is there a way to make this work?

Wireless Authentication using SAML Credentials and Azure as IdPHelloI have a problem when once logged in with the Azure user I am redirected to the Fortinet captive portal -> https://portal.mydomain.com:1003/saml/login, I get the following error in the browser:Your connection is not private NET:ERR_AUTHORITY_INVALIDI have a wildcard certificate installed in the forti *.mydomain.comUnder "User & Authentication" -> Authentication Settings I have FQDN checked and under "Certificate" I have the wildcard certificate.In protocol settings I have checked all protocolsAuthentication Scheme, Captivce portal and HTTP redirect are unchecked (I don't know if they have to be checked).Under User&Authentication -> Single Sig-ON ->Single Sing-On configuration, I have the option certificate -> MyCertificate Wildcard checked.In this Forti version I could not apply the following configuration because of the IOS version:config wireless-controller vapedit "SAML-WiFi"set auth-cert "My_