Support Forum

i cannot acces the FortiNAC UI, i executed this command:- execute service status nacthe output is:- Master Process is Down! 

Hi everyone,I’m planning to migrate from SSL VPN to IPsec VPN. Here’s the situation:The FortiClient app is already installed on users’ devices, and I need a way to deploy the IPsec VPN profile to those devices via Intune (all devices are managed by Intune).I’m currently using the VPN-only version of FortiClient, and as far as I know, deploying VPN profiles centrally requires an EMS license.Could you please advise if there’s any alternative solution in this case?Thanks

I have been trying to get Dialup VPN users connect via IPSec on a fortigate 80F firewall device but the vpn client cannot reach any internal network. Ping to 192.168.4.x shows request timed out. I have double checked the configurations thoroughly but could not find any issues on the ipsec tunnel setup or firewall policy.  show vpn ipsec phase1-interface Dialup_VPN//config vpn ipsec phase1-interfaceedit "Dialup_VPN"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 192.168.4.3set ipv4-dns-server2 10.61.50.3set proposal aes256-sha256set dpd on-idleset dhgrp 14set xauthtype autoset authusrgrp "vpngroup"set ipv4-start-ip 172.16.2.10set ipv4-end-ip 172.16.2.50set ipv4-netmask 255.255.255.0set ipv4-split-include "MAF_Servers"set psksecret ENC 1KvTP2fJpmTD24X4AvgNLfMByHhIF5Ajxnr4iofvNF0iXUQt0lxHgModqbtzPRg3Pw1W45otRTxZpRzpqh7pgGQ68CkUucW1pZMv82xUtwXxGqyyQEJqPXRh/QpUDf8OrOozkcpNE43+8ZhMMjUU187

Dear FortiGuard Support & Web Filtering Team,I am writing to urgently appeal the recent categorization of my website, thecupcut.com, which was mistakenly updated to the "Phishing" category by your automated system.This is a massive False Positive. I request a manual review by a security analyst based on the following facts:1. No Phishing Elements Exist: My website is a simple software informational blog. There are absolutely NO login forms, NO password fields, and NO credential-harvesting mechanisms anywhere on the site. It is physically impossible for this domain to be used for phishing.2. Cleared by Global Authorities:Google Safe Browsing has thoroughly scanned the domain and officially cleared it (Current Status: "No unsafe content found").Out of 94 global security vendors on VirusTotal, over 90 top-tier companies (including Kaspersky and McAfee) list the site as 100% Clean.Your automated scanner may have misinterpreted a standard layout, text, or an advertisement as a threat. C

I looking a way to fix the CVE-2025-31514 then i got this article PSIRT | FortiGuard Labs.Can i know what mean of 'Migrate to a fixed release'?  My FGT running on version 7.4.11 

Please tell me.Until recently, the following KB article, which describes a workaround for automatic firmware upgrades after End of Streaming (EoES), was available.However, it now displays "Access Denied." Technical Tip: Disable auto-upgrade for unlicensed FortiGateshttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Disable-auto-upgrade-for-unlicensed-FortiGates/ta-p/414696 Please tell me why it has been made private.

Hi, I got and issue with my fortinet account, my third party authenticator not work and when i want to reset it, i received correctly the OTP code but when i add it on fortinet to reset, i got this ERROR Either your email or sms or password is incorrect. Please try again.

 Been looking into conserve mode (on current versions, 5.6+, so only memory conserve mode) and to understand it better made the image above. Threshold values are based on the defaults. Some things I'm pretty sure about from documentation. But there are some things not clear to me, they either aren't described or at least I can't find that documentation. So primary question. Are the things shown in the image above how you believe conserve mode works? Anything which is wrong? Secondary question does anyone have any insight (preferably with links to documentation) on the question marks?* Are there other actions taken after entering conserve mode?* Does something change when dropped out of "extreme" conserve mode, or does that also have to return to green threshold before new sessions are allowed again? sources:changes (since 5.6...) : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Conserve-mode-changes-in-FortiGate-5-6-and-above/ta-p/198502tri

Is there a way to recover the deleted FortiToken, my colleague use Google authenticator (he's authenticator is already sync to cloud) and he accidentally deleted it. And he hold the master account on our Fortinet Support portal. He tried to use the Lost FortiToken in thrid party-app but no good, event the supplied information are all correct.

Hello,We have encountered an issue where FortiClient VPN Only clients are unable to connect, and the debug log shows the error "gw validation failed", whereas the full FortiClient EMS client works as expected. At the moment, the following setup is working correctly only with the paid FortiClient EMS:Remote Access VPN (IPsec)Certificate-based authenticationSAML authentication via Microsoft Entra ID (Azure AD)phase1-interface:config vpn ipsec phase1-interfaceedit "RA-VPN-IPSEC"set type dynamicset interface "wan2"set ike-version 2set authmethod signatureset net-device disableset mode-cfg enableset ipv4-dns-server1 10.102.xxx.xxxset ipv4-dns-server2 10.102.xxx.xxxset ipv4-dns-server3 10.100.xxx.xxxset proposal aes256-sha256set dhgrp 14set eap enableset eap-identity send-requestset eap-cert-auth enableset certificate "<our-worldwide-trusted-certificate>"set peer "RA-IPSEC-VPN-CLIENT"set ipv4-start-ip 10.102.251.10set ipv4-end-ip 10.102.251.200set ipv4-split-include "10.100.0.0-14

Hello,This is my current topology:FortiGate → FortiSwitch (FortiLink) with the following VLANs:DataVoiceThe FortiGate is also configured with SD-WAN using two MPLS interfaces.The issue I'm seeing is the following:When I connect a notebook to a port on the FortiSwitch, I can access all LAN devices without any problem. However, when I try to access the internet, for example by doing a ping, the traffic does not go beyond the Data VLAN gateway IP.Important detail:Both LAN and internet traffic should exit through the same MPLS path.To validate the issue, I reverted the MPLS interfaces back to the Huawei device, and in that scenario the customer has both LAN and internet connectivity working correctly.The configuration on the FortiGate is fairly straightforward, mainly BGP with SD-WAN, nothing unusual.Has anyone seen a similar behavior or have any ideas on what could be causing this?Thanks in advance.Si querés, también te puedo armar una

I have trouble connecting using FortiClient VPN version 7.4.3 hotfix 1.8758 and the latest Windows 11 25H2 update. After entering my login and password, I don't get any connection status feedback – I only get a "disconnect" button, which, when pressed, freezes the program and shows "disconnecting" all the time. I also have FortiClient VPN with an earlier hotfix version on other devices and have no connection issues but installing older version is not a solution, so I will be thankful for any advice.

RAM activationCPU(00:000106ca bfebfbff): MP initializationCPU(01:000106ca bfebfbff): MP initializationCPU(02:000106ca bfebfbff): MP initializationCPU(03:000106ca bfebfbff): MP initializationTotal RAM: 4096MBEnabling cache...Done.Scanning PCI bus...Done.Allocating PCI resources...Done.Enabling PCI resources...Done.Zeroing IRQ settings...Done.Verifying PIRQ tables...Done.Boot up, Initialize boot device failed. Changed Different Hard drives and still same error I cannot even get to the tftp configuration to install the latest OS Anyone have any insight about this error?

Hi,I'm new to Fortipam and I want to understand if there is a desktop application of Fortipam for the IT personal that connects to the fortipam and where you can create and use your secrets. Thanks in advance

We recently upgraded from 7.4.4 to 7.4.5.In the meantime, the workstations have also been replaced with Windows 11 and are now Azure AD (Entra ID) Joined instead of AD joinedDeployment at workplaces is done via Intune / Patch my PCWhen I currently do a search in the Forticlient EMS console for an endpoint, I see the endpoint, but also 3 or 4 other endpoints in the search result. These "extra" endpoints can be seen with every searchI only expect to see the one endpoint I'm looking forIs there a duplicate GUID, Hash, or something like that somewhere?

HiI need to migrate all IPSec Tunnel to one zone to create a single policy.Now i can't migrate tunnel because "Integrate Interface" is gray and it can't select it. 

Here is a cleaner and more professional version for your post:Hello everyone,I’m currently working with a FortiExtender (FEX) using LTE connectivity, and I’m facing an issue related to public IP changes.Every time the LTE provider assigns a new IP address, the connection drops completely. The only way to restore connectivity is by rebooting the FortiExtender.Has anyone experienced a similar behavior?I would like to understand:Is this expected behavior with LTE dynamic IP?Is there any configuration (keepalive, DPD, monitoring, etc.) that can prevent losing connectivity after an IP change?Would enabling specific SD-WAN or tunnel monitoring settings help in this case?Any recommendations or best practices would be greatly appreciated.Thanks in advance!

I would like to know if anyone has experience implementing guest authentication using QR codes or guest access codes through the FortiGate captive portal at the interface level.Currently, I am configuring a captive portal for guest WiFi access, and I would like to provide a more user-friendly authentication method for visitors. Ideally, I would like to implement one of the following options:Access through QR codes that redirect users directly to the captive portal login page.Guest access codes or vouchers that users can enter in the captive portal to gain temporary access

Hi,I tested a FortiExtender LAN Extension on an FGVM-02. After removing the Extender configuration, only the tunnel interface remains, which cannot be deleted. The error message is: (phase2-interface) # delete fext-ipsec-***Can not delete a static table entryCommand fail. Return code -61 Does anyone have an idea how I can remove it? Thanks. 

Hello, We have FortiSwitch user ports configured with 802.1X authentication, using a Microsoft NPS server as the RADIUS server. We now need to ensure that IP phone ports and access point (AP) ports are also protected with 802.1X, so that if a device other than an AP or IP phone is connected, it must authenticate. I tried creating a dynamic port policy with the following logic: * The first three rules match APs based on vendor and device type, and assign them a VLAN policy without 802.1X.* The last rule assigns our 802.1X policy to any device that does not match the previous rules. However, when I connect a PC to these switch ports, it somehow receives the native VLAN configured in the VLAN policy used for the AP rules. This happens even though the PC does not appear as a matched device for those AP rules. Does anyone know why this might be happening? Or can you suggest another way to bypass 802.1X only for IP phones and APs without using MAB(without h

Last year we closed a location in the Eastern time zone and put the recovered AP's in storage. When a site in the Central time zone had an urgent need, we shipped them 5 AP's from this inventory, and now the site is complaining all their computers are defaulting to the Eastern Time Zone.  Now the finger pointing is going on between the Windows desktop team and the Networking team. I discovered a portal MS provides where you can request your BSSIDs to not be tracked in their geo database, but it's an input only form that leaves you wondering if anything is really going to happen. It also provides no way to determine if BSSID is what is causing the incorrect time zone detection.   The FortiGate is set to the correct time zone, has the correct time, and DHCP points clients to the internal NTP servers for centralized time.  I am curious if anyone else has come across this and have any advice on resolving it? Denny

Hey guysI already know that we can update IPS Engine manually.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-manually-upgrade-the-IPS-Engine/ta-p/194513https://community.fortinet.com/t5/FortiGate/Technical-Tip-Upgrading-IPS-Engine-on-the-primary-FortiGate-will/ta-p/202345But can we update IPS Engine automatically ? Are there any related document ?

Lab Setup:Host Machine:Connected to internet.Default gateway: 192.168.1.1/24Running VMware WorkstationVM Configurations:FortiWeb VM:Port1 (LAN segment: WAN): 10.10.10.10/24Port2 (LAN segment: Lan): 192.168.2.101/24Port3 (Management - Bridged): 192.168.1.121/24Windows Client VM:LAN segment: WANIP: 10.10.10.2/24Default gateway: 10.10.10.10Firewall disabledWindows Server_1 VM (IIS):LAN segment: LanIP: 192.168.2.250/24Default gateway: 192.168.2.101Windows Server_2 VM (IIS):LAN segment: LanIP: 192.168.2.240/24Default gateway: 192.168.2.101FortiWeb Configuration:Created VIP: 10.10.10.50/24 on Port1Created Virtual Server using this VIPCreated Server Pool:Type: Reverse ProxyServer Balance: enabledHealth Check: HTTPLoad Balancing: Round RobinAdded both servers (192.168.2.250 and 192.168.2.240)Port: 80Health check: InheritCreated Policy:Linked to Virtual ServerLinked to Server PoolProtocol: HTTPLog traffic: enabledIIS Configuration:IIS installed on both Windows ServersDefault website works when

Hi,I download the latest Fortinet VPN file.Trying to install it ion Windows 11 25H2The process seems working but at the end, application is not installed. no error message.I'm trying to supress microsoft visual C++ distirbution, then retry to install but same result.How to fix it  & install the VPN client ?

these 2 microsoft team network are injected into mac route table to be sent over  vpn tunnel and when it does this, user fails to join the meeting (see attached screenshot). Our vpn set up is ssl vpn and with split tunnel based on firewall policy destination with FQDN route injectionBelow are those network:Below are microsoft team network on netstat -nr above52.112.127.222Query name (QNAME):api.flightproxy.teams.microsoft.comAnswer (A record) name (RRNAME):epx-enterpriseproxy.d03-058.ic3-calling-enterpriseproxy.01-eastus-prod.cosmic.office.netReturned IP52.112.127.222 52.112.23.78Query name (QNAME):epx.usea-03.ic3-calling-enterpriseproxy.eastus-prod.cosmic.office.netAnswer (A record) name (RRNAME):epx-enterpriseproxy-1.d03-058.ic3-calling-enterpriseproxy.01-eastus-prod.cosmic.office.netReturned IP:52.112.23.78It appears so far only mac user having this issue . The issue  is reproducible  easily. We  run through diagnose firewall fqdn list-all and the injec