Support Forum

Hey,I'm trying to limit my students from using all of their devices on the school's wifi network at the same time. I've changed policy-auth-concurrent to 1 (https://kb.fortinet.com/kb/documentLink.do?externalID=FD33675) in hope that this would help I use WPA2 enterprise for the SSID and I use the local FortiGate user database for authentication. I log on just fine, but it still lets me log on with both computer, phone etc. at the same time My question is: Is policy-auth-concurrent the command to use for this or am I all wrong? Anyone know what I could be missing or if there are other commands more suitable for my problem It used to be a simple task with my old Untangle firewall, but seems a bit more complicated here ;-) Sincerely Leswan

FortiClient 7.4.3.1736 has no reaction after set username, password and click on Connect. In forticlient-logs/confighandler.log are messages as:20250428 16:00:13.520 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:13.644 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:30.087 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:31.506 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:57.295 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250428 16:01:01.375 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:01:29.

I have been working on a Fortigate that has over 7000 devices using it as a router and sometimes it goes over 7500 devices. I have noticed that some useful Dashboard widgets and FortiViews seem to reach a limit where they will no longer display more data. For instance the Device Inventory widget will only show up to 5000 devices and it seems if you filter the data it only applies to those 5000 devices. This causes an issue because there is a possibility if I am looking for a specific device it won't be in the 5000 devices that I can filter. I have noticed a similar effect with the DHCP widget but its limit seems to be 7500. Is there any way to increase these limits?

Is there a way to set a custom name of the Forttoken that is mailed to the users (barcode) from the FortiGate?Instead of having the "Fortitoken EFS8", have "Fortitoken Office".I know it can be manually renamed in the Fortitoken app. 

Hi everyone.I'm asking if is there a way to order listing of devices in Assets widget (i.e. for ip, Software OS, Last seen, User.....) and if is it possible to mantain certain selected colums to visualize, 'cause everytime I open the widget it reports default columns.I also can't see donut charts in this widget, but i read it's because my Fortigate 60F (FortiOs 7.4.4) is diskless.It would bo so useful for me, but I believe fon many others... it seems impossible to me Fortinet didn't do it. Thamk you for every answer

Dears, I have build an SD-WAN project for one of my customers that has 2 wan links (ISP1 with public IP, ISP2 F5 modem). Once I come to VPN configuration to connect all branches, I used to go with a dual-up hub and spoke. I have created the VPN in the normal way from VPN category. I have seen a document was explaining how to create VPN under SD-WAN as link below, but still I'm not sure if that scenario was helpful to my case, as I have 2 WAN one of them only with public IP. Im not sure what is the difference between creating VPN from VPN category or from SD-WAN to be added as a member!?Pls can anyone explain and advise about the difference if we have 2 public ips, or in my case 1 public and 1 5G modem with private IP. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-IPsec-VPN-with-SD-WAN/ta-p/209840 thanks

I am unable to login forticlient vpn. using MACBookPro M2. error1: when install forticlient:"Initialize VPN system extension was failed." error2 when configure and login to VPN:"To connect to a VPN with FortiClient, open Security & Privacy Settings and allow system software from FortiTray."  Verified full disk access and noticed fmon and fmon2 unable to add thereReinstalled 5 times forticlient to fix this issue - no success

Hi, just wanted to point out an spelling Error in the second image of the guide from this link:https://docs.fortinet.com/document/fortiextender/7.6.0/admin-guide-fgt-managed/201700 The image shows a FortiGate with the description ForitGate. This has been the way since 7.0.0 till 7.6.0. Version 7.6.1 uses a new image without the spelling error.Old:New:   

Hello,After reviewing the release notes for FortiOS 7.6.3, I noticed that SSL-VPN Tunnel Mode is no longer supported.Does this mean that all users who rely on FortiClient will need to migrate to IPSec?I still do not fully understand the differences between SSL-VPN Web Mode and Tunnel Mode, so I would also appreciate a brief explanation of these.Additionally, I have an environment where I need to continue using SSL-VPN for the next two years.Would it be safe to continue operating with an earlier version of FortiOS (7.6.2 or below) that still supports SSL-VPN functionality?I would appreciate any responses or insights from the community.(Please note that this translation was generated by AI, so I apologize for any mistakes in advance.)

Hi EMS adminsHow many FGT can I integrate with my EMS (7.4.3)?Does is support a high number like 80?

Hi. I've been a user of SSL-VPN until it was removed from the latest firmware.I've clients using ubuntu linux variants and have problems setting IPSEC for them via strong swan. Any advice if switching to ZTNA would solve most issues?I presume I can install this "ZTNA Forti s/w" on linux?Would just getting a ZTNA licence be enough? What about the configuration of EMS. How is it done? Another question I have is I've 2 Fortinet. Fortinet 1 has a public uplink and serves some services in the clear.It has a port that is attached to Fortinet 2 that turns on and off.Fortinet 2 serves services in a locked-down environment. Would I be able to have ZTNA running on Fortinet2 having Fortinet1 as an uplink?End state is my users be able to connect to Fortinet1 and Fortinet2 one at a time to use services in both networks.

I opened a ticket on this but maybe this will be faster...  I am running FortiClient 7.2.4.0850 on a MAC runing macOS 14.5.  But I also have a need to run CloudFlare WARP once a week.  But the logs for WARP show that the ztagent is running and that port 53 has been redirected to the Fnet app. I do not currently have ZTNA setup at all in FortiClient.  But regardless, there must be a way to shut down the client fully for a short time so I can run WARP for a few hours a week.  When I do try to shutdown the forticlient processes they auto restart on my MAC. Does anyone know if there is a way to kill them off for a few hours then manually start them up?  And yes I am connected to an EMS. 

Hi All, I'm trying to setup:Fortigate 40F v.7.2.11 as VPN IPSec server.Apple iOS as VPN IPsec client, the built-in client.I'm still trying to use IKE1 to do not go with certificates for now.The problem what I see is:Whenever I'll enable Split tunnel and only expose specific networks (IPv4 works, IPv6 not) it's works.On Windows with Forticlient both networks are working IPv4+IPv6, so IPv6 issues could be Apple centric case, not focusing right now.Whenever I'll disable Split tunnel and want that all traffic from iOS go thru Fortigate once VPN is UP the session do not come up.Before I'll provide my technical setup, I just want to ensure, it is even possible to have such scenario that Split Tunnel will be disabled and all traffic will go over Fortigate (IPv4+IPv6, even only IPv4) using built-in Apple iOS VPN client?Have anyone done that?In theory it should be, because SSLVPN using Fortigate client on iOS (IPv4 only of course) is able to do so, but as SSLVPN is going away, I'm looking

Dear All. I have S2S Ipsec tunnel with configured performance SLA from HQ to BR. due to some reason customer has changed ISP to new ISP. So I have changed IPsec gateway old to new IPsec Gateway. When I changed IPsec using GUI. i has changed but we use command to check into CLI - get router info routing table details x.x.x.x. Here still showing Old IPsec Gateway. but in the GUI it is showing changed. S2S Ipsec tunnel are showing up, I have changed only Ipsec Gateway. even after showing IPsec tunnel up Performance SLA is showing down. Can you suggest also why Old Ipsec gateway is showing in CLI tunnel interface. Let suppose old Ipsec gateway was 1.1.1.1 and I changed it 2.2.2.2 thats it.thanks.    

Hello,I tried to install FortiClient 7.4.3 on Suse Leap 15.6 with this result:bad dependecies       systemd-libs > 0 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXcomposite >= 0.3-1 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXcursor > 1.1.2 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXdamage >= 1.1 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXext je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXfixes >= 5.0 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXrandr >= 1.2.99.3 je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64       libXrender je potřeba pro forticlient-7.4.3.1736-1.el7.x86_64   

Try to config ZTNA Shortcuts on SASE end point already integrated with Entra ID. Need clarify  config user samledit "saml_ztna"set cert "Fortinet_CA_SSL"set entity-id "https://fgt9.myqalab.local:7831/samlap"set single-sign-on-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/login/"set single-logout-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/logout/"set idp-entity-id "http://MYQALAB.LOCAL/adfs/services/trust"set idp-single-sign-on-url "https://myqalab.local/adfs/ls"set idp-single-logout-url "https://myqalab.local/adfs/ls"set idp-cert "REMOTE_Cert_4"set digest-method sha256set adfs-claim enableset user-claim-type upnset group-claim-type group-sidnextend The entity-id single-sign-on and single-logout URLs from SASE and  idp URLs from SMAL authenticator ( In My case it's Entra ID )  i follow below guidelines https://docs.fortinet.com/document/fortisase/latest/spa-using-ztna-deployment-guide/976373/configuring-authen

Hello and sorry for my english, In fortigate automation, i have FortiOS Event Log on 'admin login successful' and after sticth to send email. that works very good. When admin connect, i receive email. But i want only alert the night from 9.00 PM to 8.00 AM, it is possible ? thanks a lot

 Some one can help me how to appear RIP,OSPF, BGP in my firewall

When I tested it through FortiVPN with a Windows 10 laptop, it worked fine, but when I tested it through FortiClient with a Windows 11 laptop, it didn't work.It is the same environment except that Windows 11 laptop has EMS interworking as FortiClient.What is the problem? 

Hi we deployed a firewall and there is no webfiltering on.client can ping printer and it gets added in 3d software but something block file transfer and client can't put things in que or print on this particular 3d printer they just bought.it works fine if we connect a network switch with both pc and printer without firewall connecting to switch Plz help

I can't add any FGTs to my FMG within Eve-NG, debugs are showing it to be a SN issue, found several post to do below, but I don't seem to have that option on 7.4.6 The fix is to disable cert check:FMG-VM64-KVM # config system global(global)# set fgfm-peercert-withoutsn enable Any help would be greatly appreciated? Thanks

I created DNS rule for access internal domains from clients but not resolving URLs. How can i troubleshoot the issue?   

Good morning!I have problems with connecting 2fa vpn. I have IPSEC tunnel vpn. If I connect vpn with 2fa it dies immediately and does not even allow me to enter a password. But if I turn off 2fa, everything works fine.I used thisconfig user local edit "epass" set type password set two-factor email set email-to "manny@infosecmonkey.org" set passwd SuperSecretPassword next endmail server isconfig system email-server set server "notification.fortinet.net" set port 465 set security smtps endand thats all 

Getting ready to take the secure wireless lan 7.4 exam to finish my fcp. Just seeing what anyone else's experience is with this test or previous versions of the FortiAP test https://mobdro.bio/ .

Hello everyone. Thank you very much for trying to help me. I'm sharing my question or problem, as I don't know if this is expected behavior.I changed the FortiCloud account for my Fortigate from the website, using the "Transfer FortiGate to another account" option.But this only seems to have changed the account for my master Fortigate. On the website https://support.fortinet.com/asset/#/views/products, only that account appears, not the slave account.What am I doing wrong, or what should I do to get the two to sync? Regards