Support Forum

Hi, I'm trying to run FortiClient 7.4.3 in a Docker container based on Ubuntu 24.04 All goes well with the installation, all dependencies are resolved, but when I try to runforticlient vpn edit vpn_nameI receive the error:Failed to get response from confighandler Here is my Dockerfile:FROM ubuntu:24.04 RUN apt-get update -y && apt-get upgrade -y && apt-get install -y sudo libayatana-appindicator3-1 libnspr4 libnss3 libx11-xcb1 libxss1 libsecret-1-0 libnss3-tools iptables COPY forticlient_vpn_7.4.3.1736_amd64.deb . RUN dpkg -i forticlient_vpn_7.4.3.1736_amd64.deb && apt install -f CMD /bin/bash When I run confighandler:/opt/forticlient/confighandler It doesn't get any error, but also doesn't respond with anything. Anyone can help, please.

Hello I have an EMS Cloud deployment with assets deployed with Forticlient.Under the Vulnerability profile, there is an option for "Automatic Patching" which is currently enabled for Criticals. Can someone help me understand the following:- Confirming this only applies to applications that support automatic patching (i.e. Chrome, Firefox, etc)- When does auto patching take place?  Is it after a vulnerability scan or a specific interval? I'd like to understand this behavior better.  Thank you

We've got some development that's going on in Azure which makes a call to our internal servers.  I've got the "source" inbound rule pointing to a VIP and restricted to traffic coming from *.azure-api.net*.microsoft.com*.slope.ioThe problem is with something like apimanagement-cors-proxy-prd.azure-api.net depending on what IP that resolves to, the firewall may or may not allow traffic coming from that URL.  As I understand it from FortiNet support, this is "expected" behavior.  IE if the firewall has resolved apimanagement-cors-proxy-prd.azure-api.net to be 13.91.254.72 and the traffic is coming from 13.91.254.72, then the traffic will be allowed in.  However if traffic coming from apimanagement-cors-proxy-prd.azure-api.net is coming from 20.121.82.216 and the firewall hasn't resolved 20.121.82.216 as a valid IP for apimanagement-cors-proxy-prd.azure-api.net then the traffic won't be allowed in.  The only other option would be to allow Azure

Hello,We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.The raw log, as sent by the FW to the FortiSIEM is the following: <185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 cr

I have problem with Meru MC1550.  Device does not respond to ping... I can connect via console cable, but I get errors... What can I do? [ 2.119455] usbhid: v2.6:USB HID core driver[ 2.123843] Netfilter messages via NETLINK v0.30.[ 2.128635] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)[ 2.134982] ctnetlink v0.93: registering with nfnetlink.[ 2.140463] TCP bic registered[ 2.143591] Initializing XFRM netlink socket[ 2.147938] NET: Registered protocol family 17[ 2.152471] Using IPI Shortcut mode[ 2.761588] ata1.00: SATA link down (SStatus 0 SControl 310)[ 2.767338] ata1.01: SATA link down (SStatus 0 SControl 310)[ 3.478989] ata2.01: failed to resume link (SControl 0)[ 3.494968] ata2.00: SATA link down (SStatus 0 SControl 310)[ 3.500716] ata2.01: SATA link down (SStatus 0 SControl 0)[ 3.506317] md: Waiting for all devices to be available before autodetect[ 3.513185] md: If you don't use raid, use raid=noautodetect[ 3.519192] md: Autodetecting RAID arr

hi,i have a remote FW that i need to change to a new WAN public IP.it currently has a ipsec VPN established using the old public/peer IP.my question, can i change/update the remote IP address on the fly?i checked it currently has a reference to the ipsec phase 2 tunnel config.  

Hello Community, we have several employees experiencing severe performance issues with the Forti EMS Client 7.2.8, particularly when accessing internal websites via VPN and using applications like SAP GUI. In some cases, connections even drop unexpectedly.Even after reinstalling the client, the problem persists. However, when switching to the free Forti VPN Client, the issues disappear immediately, and everything runs smoothly. Our environment:- In-house EMS Server 7.2.8 with FortiClient 7.2.8--FortiGate connected via IPv4 only (IPv6 is disabled on WLAN and VPN adapters)- Only SSL VPN is used; all other VPN options are disabledDoes anyone have an idea? Many thanks in advance!

How can we do the radius configuration in Fortiswitch if Fortiswitch manged through Fortilink in Fortigate.Please guide.

Requesting Forticare Trial License. proxy:(Null) Failed to download VM License. I am getting this error while requesting a trial license. Unable to resolve it. 

I did a simple exercise where I connected the two PCs to the physical FortiGate (to port1 and port2). Then I created a rule where I set the incoming traffic to port1 and outgoing traffic to port2 (with all other parameters set to 'all'). I also created another rule to permit the reverse traffic. However, all traffic is being denied due to the implicit deny rule. Does anyone have a suggestion regarding this configuration? I can ping the FortiGate from the PCs. The FortiGate is not registered yet (I did the same configuration in VMware Workstation with the FortiGate running on a VM, and it worked).

Hello, FortiGate-100E # diag sys ntp statussynchronized: no, ntpsync: enabled, server-mode: enabledipv4 server(192.168.0.61) 192.168.0.61 -- unreachable(0x0) S:7 T:684no data I have the following issue: I have activated NTP on a FortiGate 100E. Unfortunately, I do not have a WAN interface configured on the interfaces, and I cannot assign an external IP address directly to the device. I want to extend the NTP address to the firewall through a tunnel, so the access is open. The access is open, and I can ping it from different interfaces that I have configured under "listen on interfaces."However, it still cannot synchronize and has a 2-minute delay. What could be the cause of this issue? What should I check first, and if possible, could you provide a solution? #FortiGate #NTP #System_Settings

Hello Team, now I have a cluster of FGT 500E with five vdom that manage via FortiManager. I need migrate all configurations of FGT 500E on a new cluster FGT 400F. Now on FGT 400F i have configured only the management interface. what is the best way to migrate configurations? Configure the new cluster locally and then hook it up to the fortimanager or the other way around? Thanks for the supportBR

Hi Community, We are using FG + FAC300 to establish sslvpn tunnel, with FotitokensMobile and FTM push. For some reason, somme phones are not able to handle FTM push properly (approx 3/100 users). We would like to disable FTM push for these users. On the FAC, i created a group "nopush", type remote-LDAP / importe-remote-LDAP users.This group is set with a radius attribute "fortinet - group - name" - static -  string "nopush". On the Radius service, i created a supplemental policy, with highest priority, and RADIUS attribute criteria matching the previous fortinet group.This policy has an advanced option in Authentication factos, to not 'allow FTM push'. But every test i do, with an apporpriate user, i giving me a FTM push. What am i missing ? Ragards,   

Dear All, I have come here to know whether it is known issue or not. My SSL vpn connection is getting established but  when I try to connect RDP access at that time RDP connection gets freezed with forticlient. I have also seen that when SSL VPN gets connected at that time ping response was getting but after few seconds ping response not getting also RDP connection gets disconnected. Windows latest patch - KB5050578, KB5053602     

I created a nice IPsec profile in my FortiClient so I could test out IPsec.  When I look at the dialup IPsec config in FortiEMS Cloud very little matches up with whats in the client.  Perfect example I cannot find the "Enable Single Sign On (SSO) for VPN Tunnel" option in EMS Cloud to save my life.  I am sure its there but its where I am expecting it.  Also the IKE: Version 2 setting under VPN Settings -> IKE Options is not there in the EMS Cloud. So to make sure I am configuring EMS the same way I have configured the client. Is it possible to export (backup) the config in the Client and import it in to EMS?  If it is possible do I need to do a lot of hacking to clean up the "backup" config so EMS will be happy?

We are planning to put two Fortigate in line in HA active passive and transparent mode behind existing Cisco firewalls to inspect traffic.I was wondering if there are features not supported under this configuration?Can the incoming ports on fortigates be directly connected to firewall ports without going to a switch first? Firewalls are in HA as well. If it fails over, how will the Fortigates know to fail over to the other unit?If we turn on deep inspection, what kind of certificates are required and where should they be installed? Is it internal sub-root CA? For incoming traffic? For Outgoing traffic?

Hi Fortinet Community,I’m currently experiencing recurring issues with Microsoft Teams on my MacBook Pro (Apple M3 Max, 32 GB RAM) running macOS Sequoia 15.3.2.When joining Teams meetings that involve video streaming, I regularly encounter interruptions or complete application crashes. This significantly affects my ability to participate in video calls.My system is running both FortiEDR and FortiClient EMS (VPN connection active or inactiveAfter some testing, I’ve noticed that when I disable #FortiEDR, the crashes no longer occur. This leads me to believe that FortiEDR may be interfering with Teams or some system-level resources like video, audio, or network handlingHas anyone experienced similar issues or is aware of known compatibility problems between FortiEDR and Microsoft Teams on macOS?Any advice, workarounds, or recommended configurations would be greatly appreciated.

Hello I have a question: when using SDWAN rules with Maximize Bandwidth (SLA) or Best Quality strategies, what happens to sessions already started on an Internet link that no longer meets SLA requirements? Are these sessions terminated by Fortigate or do they remain on the low-performance link until they are formally terminated by the application?

I was not able to install forticlient on Ubuntu 24.04 LTS    ~/Downloads/vpn $ sudo dpkg -i forticlient_vpn_7.4.0.1636_amd64.deb Selecting previously unselected package forticlient. (Reading database ... 234015 files and directories currently installed.) Preparing to unpack forticlient_vpn_7.4.0.1636_amd64.deb ... Unpacking forticlient (7.4.0.1636) ... dpkg: dependency problems prevent configuration of forticlient: forticlient depends on libappindicator1 (>> 0) | libayatana-appindicator1 (>> 0); however: Package libappindicator1 is not installed. Package libayatana-appindicator1 is not installed. dpkg: error processing package forticlient (--install): dependency problems - leaving unconfigured Processing triggers for hicolor-icon-theme (0.17-2) ... Processing triggers for mailcap (3.70+nmu1ubuntu1) ... Processing triggers for gnome-menus (3.36.0-1.1ubuntu3) ... Processing triggers for desktop-file-utils (0.27-2build1) ... Errors were encountered while p

Hi, - FortiOS 7.2.10Currently we are using Dialup Ikev2 with certificates and it is working, the issue is when some home users using latest NBN/Internet which by default use IPV6 are unable to connect to VPN and we are forced to change the source to IPV4 for the home users.We are looking the best way to fix this issue, thinking if we enable IPV6 on the firewall external interface, it might fix it. If we enable IPV6 support on the External WAN interface and ensure the new IPV6 public is matching the VPN gateway, so that VPN users using IPV6 can connect to VPN and use IPV4 for client to server communication. I can't see clear documentation for IPV6 on this. Any advise or suggestions is highly appreciated.  TIA :)  

Hello,My linkedin today was blocking by Intrusion Prevention security profile.But we know that linkedin is a safe website.How we can bypass or fix it to not block linkedin?Thanks guys, there is below the message.Attack Name WebRTC.Local.IP.Addresses.DisclosureAttack ID 40.038Reference https://fortiguard.fortinet.com/encyclopedia/ips/40038Incident Serial 824.415.275Direction incomingSeverityLowMessage web_app3: WebRTC.Local.IP.Addresses.Disclosure

I'm looking for configuration example on the FortiAP to solve this use case.  Client connects to an Open SSID, gets an IP from FortiNAC's registration interface. It is then directed to FortiNAC registration portal. Once the user is authenticated, NAC policy is applied and the Wifi vlan is changed to allow access. On the "Main" SSID interface, should there be any IP address ?Should Captive Portal be enabled with the external IP of NAC's registration interface ?Would you have two SSID "subinterfaces", one for each the registration vlan and guest access vlan ? Or just one for the guest access vlan. Any example configs or guide on the AP side would be much appreciated. I believe I have what I need on the NAC side.Don    

Greetings...  I have a FortiGate 60F in a building that is central to three legs of a campus, south, west and north. Mounted on south, west and north exterior/outdoor walls of the central building are three FortiAP 234F units providing WiFi to each leg as noted. Some recent renovations have left the signal poor at the end of each leg inside buildings, so we have purchased three more FortiAP 234Fs and plan to turn the existing WiFi network to a Mesh Wireless Network and are curious as to the best route we should go to configure this. Currently, all three APs are directly wired to the FortiGate and use the same SSID to make connecting and roaming the campus seamless. Each leg will have two FortiAP 234F units, a total of six on campus, one direct wired connection to FortiGate as noted and one mounted at end of each leg to provide stronger signal. Is it best to set up each leg as its own Mesh Wireless Network with its own SSID, or can all six units use one, si

Hi Folks,Our current WAN backup line isnt working, passes traffic fine but we need to implement BGP. I am thinking of gutting it and starting from stratch. We have two fortigates HA A/P config. At the moment it just uses static routing. See below. This works OK but we need to implement BGP on the external switches for route advertisement for inbound traffic. (Static with our ISP atm). However we have a further issue. We are migrating to AWS. The AWS tunnel keys off our WAN1 (fortigate 123.123.123.2) address. Therefore if we get a senario were WAN2 has to take over traffic our VPN tunnel to AWS will drop.   I am thinking of replacing the entire setup with the below. So remove WAN2 (as its IP would never connect to the AWS tunnel). Does this design make sense, using HSRP between the two external switches, the fortigate would have static external route to the HSRP address and the external L3 switches would handle the BGP (our ISP will only add these to the BGP nei

Over the past 3 weeks the VPN connection is showing the above error and can’t be stopped until you connect to a Personal Hotspot from a mobile device. This is happening to staff working in all area's outside the Wellsway school campus.As a admin user I can stop this message from appearing every couple of seconds, but a user can not until they connect to their phone. In the past the VPN connection screen would appear and the user could just minimize it and they could get on with their work. Please could you advise how we can fix this issue.  This problem is stopping the user from being able to work on their laptop as the message wants to be in the foreground all the time.