Support Forum

I have downloaded FortiClient VPN from the iOS App Store. However, after connecting to the VPN, I found that the internet is not working. On the other hand, it works fine on the Android platform. I would like to ask if you can help resolve this issue.

Hi all, Using Forticlient IPSec VPN to connect back to office network unable to access network shared Please help. The shared folder is only shared by domain PC. I can ping IP, nslookup and ping hostname of the PC. Thank youRegards,RTuesca

Hi everyone! Where can I check the license information for a FortiAp and a FortiSwitch? both are managed by a FortiGate

Hi, Anyone else noticing issues with login to SSLVPN using SAML with Entra after upgrade to 7.0.17 for users with FortiClient 7.4.X ? Did an upgrade on FOS to a client and it broke the connection for newer versions butwith FortiClient 7.2.X it appears to work just fine and it used to work also with this version up until upgraded .A similar issue was also brought up here 

We are migrating to Fortiswitches.  Currently, we use third party switches (HPE).  We have 200F Fortigates in an HA pair.  We are have a Fortiswitch 1048E switch connected to the Fortigate.  We need to migrate the VLANs on a Fortigate "LAN port"  to the Fortiswitch.  We are using this KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Migrating-VLAN-interfaces-from-one-interface-to/ta-p/257285.  When we migrate the Fortigate LAN interface and all VLANs to the Fortilink, we receive a message "Failed to update.  An error occurred when attempting to change this reference (system.interface), this reference must be handled manually."  The migration completely fails.  How can we successfully migrate VLANs from the Fortigate to the Fortilink port?

Having to do this almost every day.  7.6.2 on VMWare. Every morning I check the log receipt vs insertion graph, and almost every morning the insertion line is flat on the bottom even though logs have been received.  I have found reports on this issue going back years. Is there a fix that I haven't found yet? 

 "I have a FortiGate and multiple FortiSwitches managed through FortiLink from the FortiGate. The issue is with the last switch in the topology—Port 1 on the last switch was dedicated as a trunk for FortiLink. I replaced it with another trunk port, but I can't reset Port 1 to default; it remains in the same state as shown in the photo. How can I fix this?" 

Hello everyone, I upgraded the FortiWeb version to 7.4.1 and saw the new Waiting Room feature. In the documentation I did not find a way to replace the original template. I opened a ticket to support but, I was answered that the feature is not available and you have to open an NFR but they did not indicateI think this functionality is essential, the ability to edit the html template of the virtual waiting room seems to me the minimum, think trivially about editing languages.

Hi,  We are looking to replace C9200L-24P-4G.  Which switch series would you suggest? BR Andreas

Hello everyone, When generating a DKIM key for multiple FortiMail appliances across different sites, should a unique key be generated for each FortiMail, or can a single key be used for all of them? If it's the second case, how would the other FortiMail appliances obtain the private key? If it's the first case, do I have to upload all public keys on the DNS ? Thank in advanceBest regards,

Hello,We are currently running FortiWeb with WS_OnDemand 7.4.2, build0622 in our production environment on AWS. We would like to upgrade to a more stable and recommended version. Based on recent information, version 7.4.6 appears to be the latest recommended firmware for AWS deployments.Could you please confirm if 7.4.6 is the best choice for a stable production environment, or if there is another version you would recommend?Kind regards,

I have a ClearPass setup with Fortinet products (FortiGate, FortiSwitch, and FortiAP). Goal is to configure wired and wireless authentication with OnGuard health check. Wired authentication with health check is successful with the whole flow being as follows:User is not connected to internet. User has OnGuard installed on Windows PC. User health status is unknown. User connects to ethernet cable and gets authenticated initially but as UNKNOWN health, thus the enforcement policy enforces the UNKNOWN VLAN profile.Agent gets connected to ClearPass OnGuard when in UNKNOWN VLAN and performs the health check required. User in this example is healthy. Thus it will send to the ClearPass that the user is healthy. The health check policy is hit and it enforces a CoA bounce port message to the FortiSwitch port the user is connected to.The user gets disconnected for a few seconds then reconnects with the new information that the PC is healthy, thus it gets its IP from the HEALTHY VLAN.We want to r

We are planning to utilize a RADIUS server for LDAP and OTP authentication. Our objective is to send the Username, Password, and OTP in a single request. To achieve this, we need to create a Custom Vendor-Specific Attribute (VSA) in the FortiGate firewall. This will enable us to include the OTP along with the Username and Password for authentication purposes. Could you please provide the detailed procedure for creating a Custom VSA in the FortiGate firewall? FortiGate 

Hi  my fortiwan https certificate has expired, so I need to regenerate onebut I can't find a way from fortinet documentif regenerate self-sign, service will affect? Thanks.

Hi All, I have a question regarding a FortiSwitch managed by FortiLink. We have two data centers (DC-A, DC-B), each with a standalone FortiGate. Under each FortiGate, there are two 1048E switches serving the servers. There is a dark fiber link between the two data centers, which connects the FortiSwitches.Since there is L2 connectivity between the two DCs, I encountered an issue where the FortiSwitches from DC-B also appear on the FortiGate in DC-A (and vica-versa), prompting me to authorize them. Currently, I have set them to "Reject," but I'm not sure if this is the official solution or if there is a better approach.Could you provide guidance on the best practice for this scenario?

Hello, I would like to install a Fortigate 200G with active/passive HA.That's mean that only one Firewall is running, the second, just in case of problem on the primary. Our reseller said that's it's required to have both licences and maintenance same on both firewalls.Is that's correct ? Thank you. 

Hi guys,I need some assistance in clarifying some of the information I'm seeing in log 99 from my fortiproxy, particularly the rcvdbytes and sentbytes.Question 1: Does the received bytes refer to the amount of bytes received by the fortiproxy from user or vice versa?Question 2: Does the sent bytes refer to the amount of bytes sent by user to the dest or vice versa?Question 3: Does the HTTP method or any other telemetry within the rawlogs that may affect the order of how we see the bytes?This is crucial because it allows me to understand if there are potential malicious exfiltration happening in my environment.Thanks!

I have challenge concerning the setup diagram provided below. In this diagram, VLAN 30 is designated as the out-of-band (OOB) management VLAN, with the corresponding OOB management network IP address being 192.168.30.0/24. Each device intended for management via the OOB network is connected to the management VLAN ports of the Forti-switch through their respective physical management ports, as illustrated in the diagram. My objective is to manage the Fortigate firewall B using its IP address, 192.168.30.10, which is configured on the physical management port. In pursuit of this objective, I attempted to configure the static route outlined below. However, I encountered an issue where the command SET DEVICE MGMT was not accepted, even after I had removed the management port from being designated as a dedicated port. Could you please advise on the most effective method to achieve my goal of managing the Fortigate firewall B through its management port? config router staticedit 12set d

 AWS EC22 is running Fortigate 7.2 on vCPU, and the license is using 2 vCPU.Display 1/250% of allotted vCPUs after license change.I'm using 2vCPU, is there a reason why it only shows up as 1?Can't I get them to use both as basic?

I've setup ADVPN using BGP on loopback design with SDWAN. Traffic flows and failover to another link when when it disconnected on all devices.  Right now I have 1 hub and 2 spoke. I can steer traffic from spoke 1 out the correct interface - but the ADVPN shortcut is sending traffic into a different interface on spoke 1.  A practical example - I would like to send all backup traffic out our second ISP - WAN2 on spoke1. This works no issues. The traffic however ends up coming in on WAN1 on spoke2. This would normally be fine - except when it comes to traffic like an off-site backup I would prefer it not to be on our primary link.Is it possible to steer traffic to take a certain path if using BGP on loopback - I believe this is possible with BGP per overlay but don't want to invest a significant chunk of time on that design if what I'm trying to accomplish is possible with the loopback method. I am also waiting for a call with Fortinet support but hoping to get so

 For some quick background, I'm trying to establish IPsec VPN tunnels with a fleet of transit buses to allow access to some on-prem servers at our headquarters.  Each bus has a non-FortiGate cellular router using the same 192.168.x.0/24 internal subnet.  Equivalent devices on each bus use the same IP address from that subnet (Device A on every bus is 192.168.x.100). To overcome the issue with 150 or so tunnels all using the same 192.168.x.0/24 remote subnet, someone at FortiNet suggested I use VRFs to isolate each of the tunnels, and that seems like a workable solution.  Traffic comes into the VRF from the IPsec tunnel and as it passes through the VRF it is SNATed to a unique 10.x network.  It can then flow from the VRF across a VDOM link into our HQ internal network to the servers it needs to reach.  Yes, doing it with VDOMs would potentially be better, but I can't afford the licensing nor the hardware it would take to do that. I've got the IPse

What is the impact of implementing SAML Authentication for Access to Fortigate Devices?

I have installed the latest VPN client from https://links.fortinet.com/forticlient/win/vpnagent  After installation accomplishied, I promptly noticed the lack of the tray icon (that indeed arise on other Win10-22H2 Win11-23H2 installations). Anyway I tried launch the client console configured and saved VPN settings according to my firm's guidelines (SSL-VPN on custom port).Unlike the other OSs mentioned above, the client remains stuck on the connection mask without any status/progress expected (indeed the client doesn't connect). I have already tried the solutions proposed herein, but without any success:https://community.fortinet.com/t5/Support-Forum/FortiClient-VPN-only-with-Windows-11-24H2-issue/td-p/348662 https://windowsreport.com/windows-11-forticlient-vpn-not-working/  

Planning on doing some route-map and prefix-list renaming. When testing i didn't see any impact when i just create new routing objects with the same content but different names. When i then change them for example at router bgp route-map-in or out it shouldn't cause any interruptions, might have to do a execute router clear bgp ip x.x.x.x soft though. Anyone with different experience?

Yes, I know that there have been many posts about this, but I still don't get it how in 2025 there is no support for Windows on Arm. The feature has been requested since like 2019, and it becomes a lot more pressing nowadays with the success of the Qualcomm-powered Windows laptops.  All I see is this post getting "updated" (i.e., changing the date) https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-Support-for-ARM-Architecture/ta-p/248361 to remind everyone that there is no support for Windows on Arm. We urgently need this at work. At least release a beta or something. Impossible to believe that, after so many years, they don't even have something close to a beta.