Support Forum

Hello All, As i have done Geo-Fencing for CHINA on SSL-VPN. But in case any of my colleague goes to china & needs to access vpn he wont be able to get any. is there any way in fortigate to implement an exception where the geo-fencing for China remains in place globally, but SSL-VPN access is allowed for a specific VPN user group (for example, a temporary travel group) when connecting from China? pls guide. Regards

Hello everyone, I’ve been reading a few articles about FortiNAC configuration and got a bit confused. Some sources mention that it’s not recommended to configure RADIUS, L2 MAC traps, and syslogs together, and that the preferred option is just L2 MAC traps. But in another article, I read that configuring syslog is recommended.  https://community.fortinet.com/t5/FortiNAC/Technical-Tip-An-example-of-a-simple-network-deployment-of/ta-p/266446 BR,

Hello everyone, So I know when a guest (rogue) first connects to a switch port, they are isolated and need to register/auth with the captive portal based of the group membership/enforcement group configured on that port. I get this part. My question is for corporate devices, do they need to authenticate via the captive portal each time they connect ? BR,

Hey all, I've got a location with fortigate/ipsec site to site VPN; i.e. branch to HQ.  There is a user on wifi at branch, where wifi only has internet access.  Internet access from wifi leaves the local fortigate via the same interface the site to site vpn traffic uses, and that user would like to VPN to HQ. Is there some combination of IPSec settings that will allow the site to site VPN and "dialup" users to connect to the same target Fortigate from the same source WAN IP?  I've attempted aggressive mode IKEv1 with a variety of combinations of peertype any vs one, unspecified, and then either phase 1 local id set or not set, etc. but have not arrived at a combo that allows both to exist in harmony.

We are currently evaluating the integration capability of FortiNAC with the existing network devices in our environment, including FortiGate, devices from Cisco, and Extreme Networks. According to the reference documentation, we understand that FortiNAC supports FortiGate starting from FortiOS version 6.0+ and later. Therefore, we would like to clarify whether FortiNAC can still integrate with or manage FortiGate devices running older FortiOS versions (for example 5.x) in case the firmware cannot be upgraded. If supported, what level of integration or functionality would be available? Additionally, for network devices from Cisco and Extreme Networks, we would like to clarify whether there are any minimum firmware version requirements for integration with FortiNAC. Specifically, do these devices require a firmware upgrade to be supported, or can the integration be achieved using standard protocols such as SNMP, SSH, or RADIUS without upgrading the existing firmware? 

Hi,I want to understand what's the steps for configure a secret with domain credentials (a secret in my personal folder) and use it in other windows/ssh secrets and targets(shared in the public folder with others).Obviously every user needs to have its domain credentials. The users in fortipam must be local users. I'im trying to do this with smart associations but with some difficulties. Thanks in advance

I have a Fortigate Instance deployed on AWS with 4 ENIs.. instance type c5.xlarge Recently we reduced the license from 4vCPU to 2vCPU and now i am looking to change the instance type accordingly. But as i am using 4ENIs the only viable option i see with 2vCPU is r7i.large .. will it support the fortigate vm or are there any other checks i need to look into ? or a compatibility matrix Thanks

Hey everyone, hoping someone has run into this before because it's driving me crazy. Setup: Remote site FortiGate with two WAN links (wan1 and wan2), each with a separate IPsec tunnel (VPN1 and VPN2) connecting back to a data center. The data center side has a single WAN interface. Tunnels are configured as dialup on the hub/data center side because the remote site has dynamic IPs on both WANs.VPN1 on wan1 is the primary. VPN2 on wan2 is the backup. Static routes are configured with different distances so VPN1 is always preferred. The problem: When the tunnels first come up (after a reboot, or after clearing SAs), everything works perfectly. Traffic flows symmetrically through VPN1 as expected. This can last a week or even longer with no issues. Then at some random point, traffic becomes asymmetric. I'll notice the traffic counters on VPN2 start incrementing heavily on one direction — usually incoming data. Outbound traffic from the remote site is still going out VPN1 co

Hello Guys, I downloaded FortiGate Hyper-V version. after installing and activated port1 it. I try to login using Browser Interface it become blink and the URL went to: https://FortiGate IP /prompt/fortigate-setup?viewOnly=1anyone know how to solve this issue.Thanks in advance Mina Greas

So, I've got BIND9 running on Debian Trixie (which absolutely does DDNS updates because I can do them using the same key from other places on the network using `nsupdate`) and I've been trying to get a Fortigate (a 101F running 7.6.6)  that's handling DHCP for the local network to push DDNS updates over to the thing, and it appears to fail with a NotAuth- message every time.  This suggests rather strongly that there's something utterly undocumented with the way Fortigate handles the keys.Steps performed: 1. BIND9 server set up and tested (obvs) but the configuration snippet is effectively this:| key "test.key" { algorithm hmac-sha256; secret "P4Q4yPOnJXv/pithZ9wK/blCAFTo81oOSg5PtVzsOP8="; }; zone "test.company.tld" { type master; file "/var/lib/bind/test.company.tld.zone"; allow-update { key "test.key"; }; }; 2. Over in the console of the Fortigate:config system dhcp server edit 5 # because that's the one for the interface

Hello everyone,I am currently configuring administrator authentication on a FortiWeb appliance using RADIUS against FortiAuthenticator with FortiToken MFA, and I am experiencing a login loop after the OTP step.EnvironmentFortiWeb: admin authentication via RADIUSFortiAuthenticator: used as RADIUS serverAuthentication source: LDAP / Active DirectoryMFA: FortiToken MobileFortiWeb admin group configured with RADIUS serverLogin flowUser enters username and password on the FortiWeb login page.Authentication proceeds and FortiWeb prompts for Token Code (OTP).OTP is entered.Instead of logging in, FortiWeb redirects back to the login page.Relevant log from FortiAuthenticatorAuthentication Failed Bad TokenDescription: Authentication failed, bad token codeMessage:Remote LDAP administrator authentication with FortiToken failed: invalid tokenThings already verifiedUser exists in AD and can authenticate normally.FortiToken is assigned to the user and active.RADIUS client configured correctly on Fort

Hello all,I'm currently working with a FortiExtender (FEX-Extender) and noticed that by default it creates a static route:0.0.0.0/0 with distance 1 and priority 1.This route is affecting my traffic because it becomes the preferred default route. When I try to change the distance to 11 (or modify the priority) and push the configuration via FortiManager, I lose connectivity to the FortiGate and I'm unable to continue working remotely.I also noticed that on the FEX interface the option "Retrieve default gateway from server" is enabled.Should this option be disabled in this scenario?Thanks in advance.

My two favourite pubs are both owned by the Greene King chain. There is no cellular signal at either of them so I like to use their free wi-fi. Everything works as expected on a public wi-fi except when I browse one particular site I get a warning that someone may be trying to intercept my communications. Only that one site (so far as I know). The site's legitimate certificate from Let's Encrypt is replaced by a fake one which claims to be issued by Fortinet. I would like to know what is going on; am I being snooped on?

Dears , Can i config mclag between two different models like FS-424E and FS-448E ? Thanks 

Hi Everyone,How can I configure HA on FortiClient EMS 7.4 devices? The device I will run as Passive will be in the FKM (Disaster Recovery Center), so they will not be on the same network. Is this possible? How does the licensing work? I couldn't find a document for the 7.4 version on the Fortinet side; there is only one for 7.2. Can anyone provide information on this?

hi, we want to add blackhole route on fortigate to save the resource. we have one public subnet for example 192.1.0.0/24.Some IP addresses of this subnet are configured on internal servers behind the internet firewall. static routes are configured for this 2x IP on the firewall.    192.1.0.10 configured on internal server 1   192.1.0.11 configured on internal server 2And some IP addresses of the subnet 192.1.0.0/24 are configured on SNAT and DNAT rules.    192.1.0.101 is used as source NATTED IP for some internal hosts.   192.1.0.201 is used as Destination IP on DNAT rule. Now we want to drop the inbound access to the rest IP addresses of the subnet 192.1.0.0/24 on firewall. We plan to add a blackhole rule on the firewall to save the resource. Will this blackhole routing rule affect SNAT and DNAT? I think it should not affect, but not very sure. Can anyone please help to and advise and confirm? Thanks in advance! &nb

Hello, I'm trying to use Fortiauthenticator as IDP for Keycloak, but when keycloak send token request (/api/v1/oauth/token/) with Content-Type including charset=UTF-8 it doesn't work. I use Curl to test the request removing the charset and it worked. HTTP headers:"Content-Type: application/x-www-form-urlencoded; charset=UTF-8"  --> not working"Content-Type: application/x-www-form-urlencoded" --> works Is there any method/config to allow Fortiauthenticator accept charset at Content-Type header ? br,

I connected my fabric root FortiGate, which happen to be my edge firewall to the FortiClient EMS Cloud just fine via the fabric connector. My other fabric FortiGates show up in EMS Fabric soon after, so I authorized them there and attempted to finish the authorization at the fabric firewalls. When I click authorize on the fabric connector on the firewall, I am presented with the certificate to accept or deny. I accept and it goes back to the fabric connectivity window for EMS Cloud on the FortiGate in question, yet never "connects"... it's still in that pending state of showing the EMS Cloud information coming from my root, yet will not connect successfully like my fabric root edge firewall did.

Is it possible to add a second RADIUS cert for testing purposes? We're currently utilizing a public cert and want to test out a local PKI cert without affecting production.

Good morning, First of all, I introduce myself: I belong to IT service in MN8Energy. We use Forticlient to connect with external services since many years. Act  We have got installed many Forticlient version 7.4.2.1737, but this version will expire this summer. We have tried version 7.4.3.8758, but it doesn't work properly, and additionally, it suffers a vulnerability described at CVE-2025-62676. Is there any new version without that vulnerability and fully operational? Is there any other option? Thanks in advance, forum

Hi Is there a way to make a custom decoy with a Windows Server 2025? I have managed to get it installed, but is not booting... Any pointers?FortiDeceptor 

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).I noticed that:If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.So, it looks like remote admin authentication via SSH is only triggered when the admin has&nb

I am trying to deploy an FNC-CA-500F.I changed the IP address of my network card to 192.168.1.10 so it matches the default address 192.168.1.99 of the NAC. I was able to access the device via PuTTY, and I configured allowaccess https-adminuiin port1.The ping to 192.168.1.99 is successful, but I am unable to access the graphical user interface (GUI).Do you know why this might be happening? 

We currently use the FW-40f firewall in some branches. Its licenses expire on April 5, 2026, and we need to review the licenses to renew them or replace it with a newer firewall, such as the FW-50G. Please provide your suggestions on this matter.

Hi there, due to crazy pricing in subscription models and such we're considering FortiADC as a possible replacement for our F5 BIG-IP 2-node-cluster. I have FortiADC v7.4.4 running in an eve-ng lab and some questions arose. We have BIG-IP LTM & APM but we do nothing with App Portals, we just use 1:1 mappings (almost) with a portal front with complex logic. So something I would need, and I do not know if FortiADC can do that, or if things would have to be designed differently: On BIG-IP I have an Access Profile, an equivalent I assume to HTLM Forms, where I have a form with CAPTCHA, user name and password, which then goes to AD/LDAP, then a second dialog for internal MFA authenticating over RADIUS, and then it saves the successful auth state as a user session variable, which is then used in a script for Remote Desktop Gateway clearance in the background. The BIG-IP then internally transitions to a forwardable Kerberos ticket for the user to access all the publish