Support Forum

Hello All,I have a Fortigate 60F connected to a Ubiquiti switch, using Ubiquiti Access Points. On the Ubiquiti, I have configured my main network (works without issue), as well as 2 VLANs. I am attempting to connect to one of those VLANs and it seems I can connect to the wireless part of it, but I can't get a DHCP address from either the Fortigate or from my Windows DHCP server when using the "Relay" mode on the Fortigate to assign the address.There's no option on the Ubiquiti Cloud Controller to define a DHCP Server, so I am assuming that it just lets the client connect to another device that's on the same VLAN to request the DHCP response. However, that does not seem to be happening.Until I can afford to go all Fortinet (hopefully in a few months) with a Fortigate, Fortiswitches, and FortiAPs, this is the configuration I have.Has anyone else run into this? The network I am trying to connect on is a VLAN (guest network, testing so when people come over they are not on my main home dom

My fortigate located in HQ with internet speed 500Mbps.My mikrotik router located in the branch with internet speed 150Mbps.I already success build vpn site2site from fortigate to mikrotik, but the throughput is very low. The data transfer speed around 30-40Mbps.How we can troubleshoot where is the bootleneck? 

I have my four vlans 10,20,30,40 tagged in interface internal5 then i do access my device fortigate 60f via web GUI but now i can not access the web gui again. i want solution to resolve this issue vlan10 10.10.1.1/24vlan20 10.10.2.1/24vlan30 10.10.3.1/24

Hello everyone,I am currently facing the issue, that the first login with "admin" and blank password is not working on the first login to the FortiManager via the HyperV console. I tried both current images for version 7.6.3 and 7.4.7, but same issue on booth of them. It just asks for the password and is then asking for the user again (no error for wrong credentials). Has anyone had any similar issues or knows what else I could try ? Console port loginWe wanted to try FortiManager to see if it fits for our purpose, but we can not open a support ticket for this issue, because we can not access a serial number and haven't bought a license yet.

Trying to install 2 IP phones that work with the 3cx Cloud system the Connection will happen with SBC runnning on a pc on the network with static ip The two phones appear on my network 3cx (Cloud version) receives info from the phones but when it asks for a reboot of the phone 3cx failes to pass the info of the account  I am new to the firewall and dont know what logs to check to see what is blocked... I run the same SBC connection for 2 other phones outside fortinet enviroment and worked properly 

FortiProxy  We have a customer that wants to use FortiProxy but has a requirement that seems to be unsupported:1.) He must forward to an upstream HTTP proxy for regulatory reasons.2.) He needs SSL deep inspection on FortiProxy to apply UTM profiles and content inspection rules.3.) Network topology does not support transparent mode, FortiProxy should use explicit mode.4.) User-Authentifacation against on premise AD (NTML or Kerberos). FortiProxy does support any of these but fails to support the combination of 1 and 2.Is there any way to have FortiProxy forward web traffic to an upstream HTTP Proxy with full SSL inspection and UTM features?Is such a feature even on the Roadmap? It would be a bummer to lose that opportunity.

Hi!Whilst matching system ha's "pingserver-secondary-force-reset" field, Fortinet neglected to elucidate what this command does. One could imagine that it resets "pingsvr_flip_timeout/expire" countdown shown by "diagnose sys ha dump-by group" but my testing showed not. Anyone knows?Thanks!

hi, can someone pls advise whether we should block tor traffics (tor onion) on internet router as best practice for an enterprise? thanks in advance! 

Hello teams, for two days my network has been off due to a temporary internet outage. After the return, the fortigate was no longer accessible via the mistletoe, I had to go connect to the console to check the reason. To my surprise, the time had gone from UTC -5 to -8. After changing the internet connection came back gradually. But on the other hand, most of my fortiswitches are offline. After investigation I noticed that there was a time difference between the offline fortiswitch and the fortigate. 20 seconds on average. Remember that my fortiswitch are configured in standalone to be managed by my fortigate. Please I really need your help.

In fortiauthenticator the option "Sign SAML requests with a local certificate" signs our AuthnRequest request as expected, however it does not sign the LogoutRequest, is this expected behaviour? is there anyway to make this work?  from the standard:It is RECOMMENDED that the HTTP exchanges in this step be made over either SSL 3.0 [SSL3] or TLS 1.0 [RFC2246] to maintain confidentiality and message integrity. The message MUST be signed if the HTTP POST or Redirect binding is used. The HTTP Artifact binding, if used, also provides for an alternate means of authenticating the request issuer when the artifact is dereferenced.  

Hello, The system blocks the adres http://digitaltwin-datadev-ds1.com/Here is no any suspicious, how to exclude this site from all the filters?

HI Everybody,I need your support with the following issue:I mistakenly built all my firewall policies based on interfaces instead of using zones. Is there a way to assign all interfaces to zones without deleting and recreating the existing policies, considering they are already managing live traffic on the site?Thanks in advance 

I can't get past the License Page... Can anyone help

Anyone can help on below details. Which fortinet os version is best and compatible to do test lab for url filtering in trial license.

Hi everyone,  Can anyone let me know that Which fortinet os version is best and compatible for lab in eve-ng, gns3 and vmware based. Thanks in advance. 

We need the OID from the MIB in FortiOS 7.2 for the SNMP trap that indicates when a FortiGate requires a system file check—the same message that appears upon login if the system was not shut down properly.We’ve identified that if we push updates from FortiManager and a device requires a system file check, it can result in the configuration being wiped. Having the correct OID would allow us to proactively monitor for this condition and avoid these issues in the future.

When VPN connection using FortiClient 7.4.1.1736 is performed in an environment via a proxyThe status is stuck at 10% and I get the message "Unable to establish a VPN connection, the VPN server may not be accessible." andThe VPN connection fails.In 7.4.0, the connection is successful, but is it a bug?By the way, the macOS version succeeds with 7.4.1.

I am using ForitClient VPN version 7.4.3.1790 on Windows 10 to connect a FortiGate VPN via my company proxy server. However, I found the connection traffic have not go through the proxy server, and the ForitClient try to access the FortiGate VPN directly.  This caused the connection failed.  But when I try to use ForitClient VPN version 7.4.0.1658 to connect the FortiGate VPN via same company proxy in same network.  The connection is success and the connection traffic had go through the proxy server. I suspect the ForitClient VPN version 7.4.3.1790 have bug and cause this issue.  Anyone can help to fix it? 

Hello,I am experiencing a strange issue with FortiClient VPN 7.4 and FortiGate 7.6I've configured an IPSec Dialup server on specific public IP using certificates + xauth + no split tunnel (using aggressive mode).Connection is fine and works as expected, but when I click on Disconnect (on client side), I got the disconnection on client but on fortigate connection is still shown as ACTIVE until dpd kill it. I checked on  client side using wireshark but cannot see any packet going out when clicking on disconnect.Is this the right behavious or I missed something?Thanks

Good morning, I've replaced the FortiGate 60F with a 120G. I can get everything working as it was, including the VPN with FortiClient, but the portal doesn't work. I get the following error: ForbiddenYou don't have permission to access /remote/login on this server.Additionally, a 400 Bad Request error was encountered while trying to use an ErrorDocument to handle the request. Could you please guide me on how to resolve this error?I attach screenshots of the VPN configuration, VPN portal, and a firewall policy.Best Regards!vpn settingsvpn settingsvpn settingsvpn portalvpn portalfirewall policyfirewall policy

Yesterday, out of the blue, our FortiGate 500E stopped accepting any client IPsec phase 1 proposals from our FortiClients.  I quadruple checked the settings on FortiClient, FortiClient EMS, and the FortiGate and nothing has changed.  No versions have changed either.  I verified that that proposals being sent by FortiClient and received by the FortiGate using diag debug, and multiple proposals match what is configured, but none of them are being accepted.I opened a case with FortiNet support and am awaiting a reply.  In the meantime, I'm curious if anyone else in the community has faced this and how you solved it.FortiGate: 7.4.8FortiClient: 7.2.9FortiClient EMS: 7.2.10 2025-08-06 16:29:40.813149 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: negotiation failure2025-08-06 16:29:40.813171 ike V=root:Negotiate ISAKMP SA Error:2025-08-06 16:29:40.813184 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: no SA proposal chosen VPN config on FortiGa

Hi, i have 7.0.8 saved from temp directory that work with all the ipsec vpn. the lastests version of the client doesen't works , tried on windows 10 and 11, many vpn tunnels... but nothing! i don' know how to resolve, i can't download old versions... so can someone suggest me another company that can provide a working vpn software?

Sorry all, long post... Any help would be appreciated Just before I start, I have already reached out to Fortinet support regarding the below, unfortunately I was provided with a few generic documentation links and directed to contact a partner/distributor for assistance. The partner/distributor we engage is well not the best and hasn't really been able to help, and so I'm hoping the community can provide some insights or point me toward more specific resources. We are currently running FortiOS 7.4.8 and need to implement both SSL VPN and IPsec VPN services simultaneously. Our environment consists of multiple locations where we currently use Fortigate firewalls for SSL client VPN. We have a few ASA's around where we are using them for Client VPN also, but we are planning a migration all sites to Fortinet and use IPsec VPN. At our first migration site, we have a specific configuration challenge. Currently, all inbound TCP 443 traffic is port forwarded to an ASA firew

Hello,   I have an account with a FortiGate 200F, which was running the 7.2.10 build 1706 (Mature) version. In this version, it had a VPN that, in phase 1, contained the following settings.   Encryption  DES3DESAES128AES128GCMAES192AES256AES256GCMCHACHA20POLY1305 PRF   PRFSHA1PRFSHA256PRFSHA384PRFSHA512   Since the other end is a pfSense Community Edition 2.7.2, and this firewall does not normally allow the AES256 and SHA512 methods to be used, the connection was stable and working with that configuration.   When I upgrade my Fortinet Firewall to version 7.4.8 build2795 (Mature), the VPN drops and does not even raise phase 1. The error it gives me is an inbound connection failure, but when validating the logs of the two firewalls it indicates that "error no acceptable ENCRYPTION_ALGORITHM found" (this appears in Pfsense) and the algorithms were modified in one of the VPNs that presented the error but none of them work, as well as the PSK was changed

I have some questions regarding EMS. I want my Remote Access IPsec VPN users to have auto-connect and always-on capabilities.Are there any functional differences between EMS On-Premise and EMS Cloud licenses? Are there any limitations with one that do not exist on the other?Does the EMS On-Premise license come with its own installation package? Is it possible to deploy the EMS On-Premise installer on a cloud platform of my choice (e.g., Azure) without any issues?Aside from the Endpoint license packages, I understand there are also User-Based licenses.How do they differ from Endpoint licenses?When using a User-Based license, how does EMS Know that the user is using license, how does it identify the user, Is it tied to the AD username?5. Can a User-Based license for a single user be used on multiple devices? Let’s say I have an office with 4 laptops, all using the same AD user to connect via VPN, and all are connected simultaneously. Would a single User-Based license cover this scenario?