Support Forum

Hi, It seems that the FortiClient only performs automatic registration under the user under which the software is installed. We deploy the initial installation with Intune, which use the system user.When the user starts the client, no registration has taken place. How can I solve the problem?

My Fortigate device is out of support, and is currently running 7.4.8.It has started to attempt upgrading to the latest patch (7.4.9) as per the new upgrade mechanism: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/320693/automatic-firmware-upgrades-for-fortigate-appliances-with-invalid-support-contracts-or-that-have-reached-end-of-support-7-4-8 However it keeps failing and sending emails that it has failed.logdesc="A federated upgrade could not be completed by the root FortiGate" msg="Federated upgrade failed after reaching state downloading" reason="download failed" Its sent that one a few times, is now also sendning emails regarding the schedule being changed: logdesc="Automatic firmware upgrade schedule changed" user="system" msg="System patch-level auto-upgrade new image installation (re)scheduled to between local time Thu Oct 23 01:42:23 2025 and local time Thu Oct 23 04:00:00 2025. This installation is forced and cannot be cancelled." Do

Hi everyone,I am configuring a Dial-up IPsec VPN on FortiGate (FortiOS 7.6.6) and I want to restrict access based on the user group.RequirementI have two local user groups configured on the FortiGate         RA-ADMIN-USER         RA-CCTV-USERBoth groups should be able to connect to the same Dial-up IPsec VPN tunnel, but with different access permissions         RA-CCTV-USER → should be able to access only the CCTV subnet          RA-ADMIN-USER → should be able to access all internal subnets What is the recommended way to allow multiple user groups to authenticate to the same IPsec Dial-up VPN? If anyone has implemented a similar setup, I would appreciate guidance or example configuration.Thanks in advance.

Hello, for the last two weeks I have been trying to connect FCEMS (7.4.4) to Intune to deploy ztna certificate to Android devices (Samsung S25, Android 16, work profile). I have ran into a brick wall of device being stuck in „MDM Deployment Status Pending“ and the intune polocy to deploy SCEP certificate having error without any further details. I have been following this guide Provisioning ZTNA certificates to FortiClient mobile using Intune | FortiClient 7.4.0 | Fortinet Document LibraryI walked through it multiple times with the same result. Maybe I am missing something? Can someone please help, if you have such setup in working order? :) I have configured the app with correct permisisons in intune and set up MDM integration in FCEMS. Have user with correct licences.In intune app configuration policies have set up:Go to Apps > App configuration policies. Create a new policy.Add key-value pairs. The intune_device_id key is mandatory. All other keys are optional

Hi I'd like to know how to restrict encryption to TLS 1.2 / TLS 1.3 only when accessing the FortiADC WebUI.On FortiGate, this can be done by using the global setting set strong-crypto enable.However, on FortiADC (version 7.6.x), this command does not appear. Does anyone knows this ?

Hello,I’m currently staging a pair of FortiGate 90G firewalls and noticed the factory default configuration assigns the x1 and x2 interfaces as a FortiLink aggregate, while the A and B ports appear intended for WAN connectivity.From the default configuration I observed:x1 + x2 configured as an aggregate interface with FortiLink enabledA and B presented as standalone physical interfaces that can be used for WANport1/port2 included in the internal hardware switchMy questions are:Is the intended design on the FortiGate 90G that A/B are the preferred WAN interfaces, while x1/x2 are reserved primarily for FortiLink or high-speed LAN uplinks?If FortiSwitch is not being used, is it recommended to remove FortiLink from x1/x2 and repurpose those interfaces as normal 10G LAN or WAN ports?Is there any Fortinet best-practice guidance on which interfaces should be used for WAN vs LAN when FortiLink is not required on this model?This unit ships with FortiLink preconfigured on x1/x2, so I want to con

Some users need to access Tor, so I created a rule and set the destination to the Fortinet Internet Service Database (ISDB) associated with Tor. We tested it and saw that they could access Tor pages via the web. However, when the user tries to access the "tor.browser" application, it doesn't load. These users have internet access, but only through HTTP and HTTPS ports. Wasn't the TOR.BROWSER application part of the Fortinet Internet Service Database (ISDB)? Or is it necessary to add the ports used by TOR.BROWSER to the internet access policy? Do you know which ports that application uses, tor.browser?

 Dear expert,i am seeking your guidance and assistance to fix the routing problem. Recently we got direct-connect ( MPLS) link to connect AWS EC2 from on-prem data center. not configured yet. apart from that site-to-site IPsec VPN tunnel also established with AWS and working fine. All BGP handling is taken care by ISP with regards to direct-connect. The issue isoutgoing data from local lan ( port 9) is not going to AWS through port 4 (10.18.152.4/24). working From port4 to gateway of ISP router gateway 10.18.152.1 is reachable.From port4 to AWS EC2 subnet 10.18.144.0/24 is reachable. AWS EC2 subnet to ISP Router GW 10.18.152.1 is reachable.From port 9 to port 4 / 10.18.152.4 is reachable not workingLAN port 9 to port 4's gateway 10.18.152.1 is not reachable.AWS EC2 to port 4 (10.18.152.4) is not reachable. FW polices areport 9 to port 4 > all traffic allowedPort 4 t port 9 > all traffic allowed static route are configured in

So I finally upgraded to 7.6.6 on my FWF60F and initially things were running fine. But now that is has been up for a few days, the GUI loading has gotten really slow. Doing a diag sys top, I am seeing the httpsd process as zombie and on each update, the process id is incrementing.Anyone else seeing issues like this on the smaller units?

Hello Everyone: We need to reset an FAP-234F-A to factory defaults because we don't have the admin password. Here are the details: 1. We have the unit connected to a FortiGate 40F, which has the default IP address of 192.168.1.99 for now while we set things up. The FAP-234F-A is set to 192.168.1.2 and we can ping it and browse to the GUI. 2. The QuickStart Guide for this unit says that it comes with a special POE injector that has a reset button on it because the AP doesn't. Probably because it's a ruggedized outdoor unit and having a reset button would compromise the ruggedness. The model number of the PO injector that shows in the QSG is EPA5006GPR-4P. It's made by EnGenius, but the only one they have is the EPA5006GR, so we bought that one. It has a reset button on it but pressing it for more than 10 seconds doesn't reset the AP to factory defaults. It does nothing. Probably because it's slightly different than the EPA5006GPR-4P and the pinout

Hello Everyone: We need to reset an FAP-234F-A to factory defaults because we don't have the admin password. Here are the details: 1. We have the unit connected to a FortiGate 40F, which has the default IP address of 192.168.1.99 for now while we set things up. The FAP-234F-A is set to 192.168.1.2 and we can ping it and browse to the GUI. 2. The QuickStart Guide for this unit says that it comes with a special POE injector that has a reset button on it because the AP doesn't. Probably because it's a ruggedized outdoor unit and having a reset button would compromise the ruggedness. The model number of the PO injector that shows in the QSG is EPA5006GPR-4P. It's made by EnGenius, but the only one they have is the EPA5006GR, so we bought that one. It has a reset button on it but pressing it for more than 10 seconds doesn't reset the AP to factory defaults. It does nothing. Probably because it's slightly different than the EPA5006GPR-4P and the pinout

What is everyone's plan for replacing SSL/RADIUS certs moving forward since certificate lifetimes are decreasing drastically over the next few years? Does FortiNAC have any plans to allow for automatic renewals? Once 2029 comes and the expiry is 45 days, it's going to be a headache to renew and upload manually.

Been troubleshooting intermittent FortiClient VPN user issue for MONTHS. Finally caught it in the act with a TAC and MS Support. Still no answer so I'm sharing the oddity here. VPN Clients have traffic stop until DPD times them out. This happens to any user, on any ISP, at any time of day. Client is on Port 61020 to port 4500 on the Firewall... Typical NAT-T session.They were fully connected and working, then... Traffic stops. Here's the output of the sniffer 4 0 1 capture from the Client side FW:2026-03-09 14:47:24.661204 port3 out HQ-IP.61020 -> AZ-IP.4500: udp 3442026-03-09 14:47:24.688854 port3 in AZ-IP.4500 -> HQ-IP.61020: udp 5362026-03-09 14:47:24.733526 port3 out HQ-IP.61020 -> AZ-IP.4500: udp 882026-03-09 14:47:25.441206 port3 in AZ-IP.4500 -> HQ-IP.61020: udp 1042026-03-09 14:47:25.441821 port3 out HQ-IP.61020 -> AZ-IP.4500: udp 1042026-03-09 14:47:26.451448 port3 in AZ-IP.57802 -> HQ-IP.61020: udp 104 WTF?2026-03-09 14:47:27.963936 port3 out

Hi, I recieve this error when I'm trying connecting "Notification: Backup DNS failed" when I'm trying to connect. What's the problem? I installed the last version of Forticlient, I'm using Ubuntu 22.04 

Since Fortinet is transitioning from SSL VPN to IPSec VPN, we would like to request your guidance regarding this scenario. Our client currently uses SSL VPN for their remote users. These users access the network from phones and tablets without FortiClient, simply by entering an IP address and port in their browser. Configuring a VPN client on these devices would be cumbersome for them. However, IPSec VPN does not natively support browser-only access in the same way. Could you advise on the best approach to implement IPSec VPN for this use case while keeping remote access simple for users on mobile devices? Thank you for your support.

Hello All, As i have done Geo-Fencing for CHINA on SSL-VPN. But in case any of my colleague goes to china & needs to access vpn he wont be able to get any. is there any way in fortigate to implement an exception where the geo-fencing for China remains in place globally, but SSL-VPN access is allowed for a specific VPN user group (for example, a temporary travel group) when connecting from China? pls guide. Regards

Hello everyone, I’ve been reading a few articles about FortiNAC configuration and got a bit confused. Some sources mention that it’s not recommended to configure RADIUS, L2 MAC traps, and syslogs together, and that the preferred option is just L2 MAC traps. But in another article, I read that configuring syslog is recommended.  https://community.fortinet.com/t5/FortiNAC/Technical-Tip-An-example-of-a-simple-network-deployment-of/ta-p/266446 BR,

Hello everyone, So I know when a guest (rogue) first connects to a switch port, they are isolated and need to register/auth with the captive portal based of the group membership/enforcement group configured on that port. I get this part. My question is for corporate devices, do they need to authenticate via the captive portal each time they connect ? BR,

Hey all, I've got a location with fortigate/ipsec site to site VPN; i.e. branch to HQ.  There is a user on wifi at branch, where wifi only has internet access.  Internet access from wifi leaves the local fortigate via the same interface the site to site vpn traffic uses, and that user would like to VPN to HQ. Is there some combination of IPSec settings that will allow the site to site VPN and "dialup" users to connect to the same target Fortigate from the same source WAN IP?  I've attempted aggressive mode IKEv1 with a variety of combinations of peertype any vs one, unspecified, and then either phase 1 local id set or not set, etc. but have not arrived at a combo that allows both to exist in harmony.

We are currently evaluating the integration capability of FortiNAC with the existing network devices in our environment, including FortiGate, devices from Cisco, and Extreme Networks. According to the reference documentation, we understand that FortiNAC supports FortiGate starting from FortiOS version 6.0+ and later. Therefore, we would like to clarify whether FortiNAC can still integrate with or manage FortiGate devices running older FortiOS versions (for example 5.x) in case the firmware cannot be upgraded. If supported, what level of integration or functionality would be available? Additionally, for network devices from Cisco and Extreme Networks, we would like to clarify whether there are any minimum firmware version requirements for integration with FortiNAC. Specifically, do these devices require a firmware upgrade to be supported, or can the integration be achieved using standard protocols such as SNMP, SSH, or RADIUS without upgrading the existing firmware? 

Hi,I want to understand what's the steps for configure a secret with domain credentials (a secret in my personal folder) and use it in other windows/ssh secrets and targets(shared in the public folder with others).Obviously every user needs to have its domain credentials. The users in fortipam must be local users. I'im trying to do this with smart associations but with some difficulties. Thanks in advance

I have a Fortigate Instance deployed on AWS with 4 ENIs.. instance type c5.xlarge Recently we reduced the license from 4vCPU to 2vCPU and now i am looking to change the instance type accordingly. But as i am using 4ENIs the only viable option i see with 2vCPU is r7i.large .. will it support the fortigate vm or are there any other checks i need to look into ? or a compatibility matrix Thanks

Hey everyone, hoping someone has run into this before because it's driving me crazy. Setup: Remote site FortiGate with two WAN links (wan1 and wan2), each with a separate IPsec tunnel (VPN1 and VPN2) connecting back to a data center. The data center side has a single WAN interface. Tunnels are configured as dialup on the hub/data center side because the remote site has dynamic IPs on both WANs.VPN1 on wan1 is the primary. VPN2 on wan2 is the backup. Static routes are configured with different distances so VPN1 is always preferred. The problem: When the tunnels first come up (after a reboot, or after clearing SAs), everything works perfectly. Traffic flows symmetrically through VPN1 as expected. This can last a week or even longer with no issues. Then at some random point, traffic becomes asymmetric. I'll notice the traffic counters on VPN2 start incrementing heavily on one direction — usually incoming data. Outbound traffic from the remote site is still going out VPN1 co

Hello Guys, I downloaded FortiGate Hyper-V version. after installing and activated port1 it. I try to login using Browser Interface it become blink and the URL went to: https://FortiGate IP /prompt/fortigate-setup?viewOnly=1anyone know how to solve this issue.Thanks in advance Mina Greas

So, I've got BIND9 running on Debian Trixie (which absolutely does DDNS updates because I can do them using the same key from other places on the network using `nsupdate`) and I've been trying to get a Fortigate (a 101F running 7.6.6)  that's handling DHCP for the local network to push DDNS updates over to the thing, and it appears to fail with a NotAuth- message every time.  This suggests rather strongly that there's something utterly undocumented with the way Fortigate handles the keys.Steps performed: 1. BIND9 server set up and tested (obvs) but the configuration snippet is effectively this:| key "test.key" { algorithm hmac-sha256; secret "P4Q4yPOnJXv/pithZ9wK/blCAFTo81oOSg5PtVzsOP8="; }; zone "test.company.tld" { type master; file "/var/lib/bind/test.company.tld.zone"; allow-update { key "test.key"; }; }; 2. Over in the console of the Fortigate:config system dhcp server edit 5 # because that's the one for the interface