Support Forum

Hello everyone,I am currently configuring administrator authentication on a FortiWeb appliance using RADIUS against FortiAuthenticator with FortiToken MFA, and I am experiencing a login loop after the OTP step.EnvironmentFortiWeb: admin authentication via RADIUSFortiAuthenticator: used as RADIUS serverAuthentication source: LDAP / Active DirectoryMFA: FortiToken MobileFortiWeb admin group configured with RADIUS serverLogin flowUser enters username and password on the FortiWeb login page.Authentication proceeds and FortiWeb prompts for Token Code (OTP).OTP is entered.Instead of logging in, FortiWeb redirects back to the login page.Relevant log from FortiAuthenticatorAuthentication Failed Bad TokenDescription: Authentication failed, bad token codeMessage:Remote LDAP administrator authentication with FortiToken failed: invalid tokenThings already verifiedUser exists in AD and can authenticate normally.FortiToken is assigned to the user and active.RADIUS client configured correctly on Fort

Hello all,I'm currently working with a FortiExtender (FEX-Extender) and noticed that by default it creates a static route:0.0.0.0/0 with distance 1 and priority 1.This route is affecting my traffic because it becomes the preferred default route. When I try to change the distance to 11 (or modify the priority) and push the configuration via FortiManager, I lose connectivity to the FortiGate and I'm unable to continue working remotely.I also noticed that on the FEX interface the option "Retrieve default gateway from server" is enabled.Should this option be disabled in this scenario?Thanks in advance.

My two favourite pubs are both owned by the Greene King chain. There is no cellular signal at either of them so I like to use their free wi-fi. Everything works as expected on a public wi-fi except when I browse one particular site I get a warning that someone may be trying to intercept my communications. Only that one site (so far as I know). The site's legitimate certificate from Let's Encrypt is replaced by a fake one which claims to be issued by Fortinet. I would like to know what is going on; am I being snooped on?

Dears , Can i config mclag between two different models like FS-424E and FS-448E ? Thanks 

Hi Everyone,How can I configure HA on FortiClient EMS 7.4 devices? The device I will run as Passive will be in the FKM (Disaster Recovery Center), so they will not be on the same network. Is this possible? How does the licensing work? I couldn't find a document for the 7.4 version on the Fortinet side; there is only one for 7.2. Can anyone provide information on this?

hi, we want to add blackhole route on fortigate to save the resource. we have one public subnet for example 192.1.0.0/24.Some IP addresses of this subnet are configured on internal servers behind the internet firewall. static routes are configured for this 2x IP on the firewall.    192.1.0.10 configured on internal server 1   192.1.0.11 configured on internal server 2And some IP addresses of the subnet 192.1.0.0/24 are configured on SNAT and DNAT rules.    192.1.0.101 is used as source NATTED IP for some internal hosts.   192.1.0.201 is used as Destination IP on DNAT rule. Now we want to drop the inbound access to the rest IP addresses of the subnet 192.1.0.0/24 on firewall. We plan to add a blackhole rule on the firewall to save the resource. Will this blackhole routing rule affect SNAT and DNAT? I think it should not affect, but not very sure. Can anyone please help to and advise and confirm? Thanks in advance! &nb

Hello, I'm trying to use Fortiauthenticator as IDP for Keycloak, but when keycloak send token request (/api/v1/oauth/token/) with Content-Type including charset=UTF-8 it doesn't work. I use Curl to test the request removing the charset and it worked. HTTP headers:"Content-Type: application/x-www-form-urlencoded; charset=UTF-8"  --> not working"Content-Type: application/x-www-form-urlencoded" --> works Is there any method/config to allow Fortiauthenticator accept charset at Content-Type header ? br,

I connected my fabric root FortiGate, which happen to be my edge firewall to the FortiClient EMS Cloud just fine via the fabric connector. My other fabric FortiGates show up in EMS Fabric soon after, so I authorized them there and attempted to finish the authorization at the fabric firewalls. When I click authorize on the fabric connector on the firewall, I am presented with the certificate to accept or deny. I accept and it goes back to the fabric connectivity window for EMS Cloud on the FortiGate in question, yet never "connects"... it's still in that pending state of showing the EMS Cloud information coming from my root, yet will not connect successfully like my fabric root edge firewall did.

Is it possible to add a second RADIUS cert for testing purposes? We're currently utilizing a public cert and want to test out a local PKI cert without affecting production.

Good morning, First of all, I introduce myself: I belong to IT service in MN8Energy. We use Forticlient to connect with external services since many years. Act  We have got installed many Forticlient version 7.4.2.1737, but this version will expire this summer. We have tried version 7.4.3.8758, but it doesn't work properly, and additionally, it suffers a vulnerability described at CVE-2025-62676. Is there any new version without that vulnerability and fully operational? Is there any other option? Thanks in advance, forum

Hi Is there a way to make a custom decoy with a Windows Server 2025? I have managed to get it installed, but is not booting... Any pointers?FortiDeceptor 

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).I noticed that:If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.So, it looks like remote admin authentication via SSH is only triggered when the admin has&nb

I am trying to deploy an FNC-CA-500F.I changed the IP address of my network card to 192.168.1.10 so it matches the default address 192.168.1.99 of the NAC. I was able to access the device via PuTTY, and I configured allowaccess https-adminuiin port1.The ping to 192.168.1.99 is successful, but I am unable to access the graphical user interface (GUI).Do you know why this might be happening? 

We currently use the FW-40f firewall in some branches. Its licenses expire on April 5, 2026, and we need to review the licenses to renew them or replace it with a newer firewall, such as the FW-50G. Please provide your suggestions on this matter.

Hi there, due to crazy pricing in subscription models and such we're considering FortiADC as a possible replacement for our F5 BIG-IP 2-node-cluster. I have FortiADC v7.4.4 running in an eve-ng lab and some questions arose. We have BIG-IP LTM & APM but we do nothing with App Portals, we just use 1:1 mappings (almost) with a portal front with complex logic. So something I would need, and I do not know if FortiADC can do that, or if things would have to be designed differently: On BIG-IP I have an Access Profile, an equivalent I assume to HTLM Forms, where I have a form with CAPTCHA, user name and password, which then goes to AD/LDAP, then a second dialog for internal MFA authenticating over RADIUS, and then it saves the successful auth state as a user session variable, which is then used in a script for Remote Desktop Gateway clearance in the background. The BIG-IP then internally transitions to a forwardable Kerberos ticket for the user to access all the publish

Dear Community  Please Guide How to access      

We are running into an issue with our Fortivoice system where when someone calls our auto-attendant, and they dial the extension of the party they would like to speak to, they get an invalid extension message. When looking back through the logs, it is appearing that they are dialing too many digits. For example, I call in, dial extension 1523. When I look at the log, Fortivoice shows that I dialed 155523. Sometimes just one extra digit is inserted, and I have seen as many as 20 extra digits get inserted. Other times it works perfectly fine and dials the correct digits.  Has anyone experienced this issue or know if any reason why this would be occurring? 

When launching an RDP session using a stored Secret through FortiPAM (via Proxy mode and NLA mode), the connection does not automatically inject the stored password.Instead:The RDP client pre-populates the username field with the currently logged-in Windows user from the client machine.The session then prompts for a password.The stored Secret credentials in FortiPAM are not injected.Authentication must be completed manually.

Hi,We are looking into a solution for machine to machine traffic with FortiProxy. We saw that there is an option for oidc in recent versions of FortiProxy and were wondering if that is something we can use. The IdP we would like to use is Entra ID. As said, this is machine to machine, so no browser popup or user interaction should be required. Is this setup possible with FortiProxy?

In the VPN we can select Peer Option to 'Peer ID from dialup group'. How we can create the dialup group?When we create the group then which type should i select (Firewall, FSSO, RSSO, or Guest)?Also we must have the user and this user should be as member for above group. When create the user which user type should i select (Local User Remote Radius, Remote TACACS, Remote LDAP, FSSO or FortiNAC user)? 

I have to deploy the Overlay Orch, the default ASN is 65000. The ASN should be private, or it can be public, this is because the customer is using the 65000. Thanks.

Hello,I wanted to replace our existing Aruba Core Switch with a FortiSwitch 148F.Currently the Aruba is connected to my Fortigate 100F via an LACP with different VLANS , the VLAN 1 is currently used by the network. Here's the screenshot of the existing conf with the Aruba switch connected to port1 and port2      I've tried to create a software switch with the Fortilink interface and the LACP but i can't use the LACP for the hd switch.So i attached the Fortiswitch to the Fortilink in order to preconfigure it but i can't create the same VLANS/Subnet on the Fortilink and the fortigate says that they are already used in the LACP.So i would like to know how to migrate this, i can't attach the fortiswitch directly to the LACP becouse it is a production environment and i have to minimize downtimes so i wanted to attach the Fortiswitch to the Fortlink, then preconfigure the Switch AND the Fortilink with the existing VLANS (but i can't create those networks...

Hello, Ive got  this situation with a fortilink lacp already working but only 1 physical connection.  I wan to add a new connection but I want to confirm if I can add the cable while hot-swapping without any disruption, and the business doesn't allow for a maintenance window, I'd like to know if adding a cable between the firewall and the switch would cause any problems. Additionally, I'd like to know if any further configuration is necessary, given that the firewall is already configured with the FortiLink LACP to use this new physical connection. Any suggestions or link would be really appreciated.

Hey guys, Is it correct to say that when I disable the password policy on my FortiGate, the IPSEC tunnels with PSK configured in it will remain up and no network impact? Background:I have an existing IPSEC tunnel configured with PSK, also password policy is enabled.I wanted to disable password policy. Thank you!

Hello, As a continuation of a previous thread that was marked as Solved by the person that opened it, the issue appears to be present on 7.4.3.6667 but on 7.4.1.1716 it was not present/affected by whatever is causing it. It happens when the lock screen is either manually initiated or the computer reaches the timer that is set to start it.The disconnect is almost instant as soon as the lock screen is being trigger with the laptop being connected to a power outlet so not on battery. At the previous version 7.4.1 it never disconnected even if the laptop was in lock screen for hours, it remained connected to the VPN. These are the only logs that I could find and maybe someone could help remediate this issue because it's quite annoying to be fair.We are aware that it's a free version of FortiClient w/o support but considering some vulnerabilities are fixed within the latest version and a downgrade to a previous one isn't a real option and neither deactivating lock screen