Support Forum

Hello everyone,We are currently running several Windows Server 2016 systems (Extended Support until January 12, 2027) using FortiClient 7.2.9.1185. Since this version contains known vulnerabilities, we would like to update to a newer release. Unfortunately, newer FortiClient versions no longer support Windows Server 2016.We are looking for advice and would love to hear from the community:- How are you securing Windows Server 2016 systems with FortiClient?- Are there specific workarounds, additional hardening steps, or complementary security solutions you use?- Do you continue to run FortiClient on Server 2016 despite the lack of official support, or have you adopted alternative approaches?Any experiences, best practices, or recommendations would be highly appreciated! Thank you in advance for your input.

I try to connect Fortigate-VM (v7.4.11 build2878) to Fortimanager VM (v7.6.6 build3654) both of them have trial licenses in the same account. If I try to connect from Fortigate side I get error "The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number."  If I try to connect from Fortimanager as discover online device I get error "Probe failed" after Fortigates login and password entering. Both VMs placed in the same subnet and have fresh installation and only one configured interface and have internet access. FMG-Access enabled on Fortigate's interface.On FortiManager side I configure the follow:"FMG-VM64 # config system global(global)# showconfig system globalset adom-rev-auto-delete disableset enc-algorithm lowset fgfm-allow-vm enableset fgfm-ssl

Is there any good courses for FCP – Network Security (FortiGate Admin) that’s hands on out there? I’m not studying for the certification, I just want to learn it. I passed the CCNA Exam certification like 1 month ago, been doing a lot of labs, and I’m comfortable working on EVE NG. So, I want to challenge myself and start working with firewall instead ACL

We recently introduced iOS clients to our fleet, unfortunately FortiVPN with sslvpn seems to not set DNS server on iOS since our internal stuff won't resolve. Works fine on Android though.

Hello,I have two FortiGates (Site 1 & Site 3) connected via two GRE overlays:GRE_DC1_S3_AS20 – latency: 0.39ms, packet loss: 0%, jitter: 0.05msGRE_DC1_S3_SP5 – latency: 35.15ms, packet loss: 0%, jitter: 2.79msI configured SD-WAN between the two sites.Test scenario:Site 1: 172.16.213.2Site 3: 172.16.233.31. Best-effort / untagged trafficSD-WAN rule: Best Quality, latency criterionTraffic correctly uses AS20When AS20 degrades, traffic fails over to SP5 → works as expectedAfter this test, I modified the SD-WAN rule for untagged traffic:Strategy: ManualPreferred interface: SP5Observed behavior:Untagged traffic correctly goes via SP5 (as intended)2. Classified traffic (CS6) SD-WAN ruleNetwork Control for CS6 class trafficStrategy: Best QualityCriteria: LatencyProtocol specification:Protocol number: 0Type of Service (TOS): 0xc0Bit mask: 0xffTest ping from 172.16.233.2 :ping -s 600 -c 100 -D -Q 0xc0 172.16.213.2Expected behavior:Traffic should use AS20 because latency (0.39ms) is well bel

Hi All, So have some MacBooks with sometimes this message, but wifi is still running, no ip change or whatever. 1 - Why this messages? (How can I find out why this is happening)2 - How to disable them? Any ideas?ThanksFortinac Persistant Agent v10.7.2.13Connected with FortiAP 

My team has been deploying a lot of SDWan lately with DIA and Broadband circuits. We have a couple of sites that have frequently been reporting session disconnects from cloud hosted applications and SIP phones that suddenly lose audio. I asked the sites to start reporting the exact times so I could correlate their issues to events in the logs. So far, each reported event seems to correlate to SDWan changes. Digging in deeper, neither of the circuits seem to be dropping, just falling outside the defined SLA values. Each time it was reported, I checked the active sessions on the firewall for the impacted phones and saw the destination interface being used didn't match the interface SDWan was preferring at the time.  This leads me to believe the SDWan decisions are impacting existing connections.   If I have the "Update Static Route" slider enabled, and a circuit doesn't meet the defined SLA requirement, will it break existing connections by removing the rout

My security team has this compliance requirement."Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters." How would this be configured in FortiGate? 

Hi all, So I am trying to setup Azure Saml for the first time and I am hitting an issue that I cannot seem to find an answer to.    So when using the forticlient I can get to show the microsoft login page but after I enter the user/password I get this. AADSTS700016: Application with identifier '' was not found in the directory ''. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Everything I can find seems to point to the making sure the Azure Application Identifier (Entity ID) and the fortigate Entity-ID match but I have verified it and they do match so not sure what else to look at. Eddie

Dear all, i wanted to improve my multicast traffic enabling IGMP snooping and multicast routing. I am using a Fortigate 40F (7.2.10) together with a Fortiswitch 108F and FortiAP 231G. Before, multicast between my VLANS (ports are on NAC mode) worked perfectly, but now I am lost and I do not know what I am doing wrong... Here some information out of my CLI:  FortiGate40F (settings) # showconfig system settingsset multicast-ttl-notchange enableset gui-multicast-policy enableset gui-dos-policy enableset gui-local-in-policy enableset gui-dynamic-routing enableset gui-advanced-wireless-features enableset gui-email-collection enableset gui-multiple-interface-policy enableFortiGate40F # get switch-controller igmp-snoopingaging-time : 300flood-unknown-multicast: disablequery-interval : 125FortiGate40F # diag switch-controller switch-info igmp-snooping groupS108F***********:IGMP-SNOOPING learned mcast-groups:port VLAN GROUP Age-timeout IGMP-VersionGT40F*** 20 querier 120 V2GT40F*

Hi all, We have a Fortigate 81F.  Also have a Cradlepoint R920 router. I am trying to get the two connected via an ipsec tunnel. The Fortigate has a static public IP, R920 is on a mobile network with CGNAT.  R920 is configured to initiate the connection.  I see there is meant to be an option to set the Fortigate side to passive-mode but that command is not on our Fortigate (FortiOS 7.4) We have other site-to-site vpn connections to this Fortigate, using EdgeRouters but they have static public IPs. The Fortigate reports Phase 1 successful, but then both sides seem to be waiting for the other to respond. Here is an extract from the Fortigate debug log (I've replaced the IP addresses with place-holder names in bold):responder received AUTH msgprocessing notify type INITIAL_CONTACTprocessing notify type EAP_ONLY_AUTHENTICATIONprocessing notify type MESSAGE_ID_SYNC_SUPPORTEDpeer identifier IPV4_ADDR R920PUBLICIPre-validate gw IDgw validation OKauth ve

Currently, I am blacklisting IPs that trigger more than three unauthorized login attempts daily via the local access policy. This is causing issues where valid users are getting locked out and complaining about connectivity. Since switching to IPsec VPN would likely present the same challenge, I am considering whether we need to refine our filtering criteria or policy logic.

Hi Fortinet Community,  Claude AI app is installed on a laptop and when it is launched I see this in the FortiGate logs. How can I check what block it and what should be allowed. Thanks in advance. 

I am running FAZ 7.6.6 and have been scouring the internet looking to see if anybody has a solution for setting up an output profile to take and html or maybe even CSV report and putting it in the BODY of the email vs a file attachment.

what can I do? I'm just on the LAN that is connected to the Fortigate 40F. 

Hello Everyone: We need to reset an FAP-234F-A to factory defaults because we don't have the admin password. Here are the details: 1. We have the unit connected to a FortiGate 40F, which has the default IP address of 192.168.1.99 for now while we set things up. The FAP-234F-A is set to 192.168.1.2 and we can ping it and browse to the GUI. 2. The QuickStart Guide for this unit says that it comes with a special POE injector that has a reset button on it because the AP doesn't. Probably because it's a ruggedized outdoor unit and having a reset button would compromise the ruggedness. The model number of the PO injector that shows in the QSG is EPA5006GPR-4P. It's made by EnGenius, but the only one they have is the EPA5006GR, so we bought that one. It has a reset button on it but pressing it for more than 10 seconds doesn't reset the AP to factory defaults. It does nothing. Probably because it's slightly different than the EPA5006GPR-4P and the pinout

We are attempting to install Forticlient 7.4.5 for our users. We are making the switch from SSLVPN LDAP authentication to IPSec using SAML authentication with Office 365. We are running into many issues using the Full EMS client listed below:Frequent Memory Leaks transitioning into a BSODWindows lock screen being a blank blue screen not allowing any user input and only able to be resolved via a restart.VPN Connection configuration completely dropping off of workstations while off the network.  EMS claims remote access to be OK for these machines but only reinstalling or plugging the machine on our private network brings it back. I've had limited success trying to run a version of the client only utilizing the remote access but long term we are wanting to enable other components of EMS.   My main question is whether anyone else has seen these issues now or in the past?  If you have resolved them, what did you do?  Happy to provide more detail

We have an existing Fortigate 7.4.11 firewall configuration with 100+ firewall policies and 10 VPN, IPSec connections and 2 WAN connections.  We are wanting to now configure SDWAN to handle the 2 WAN Connections. Has anyone retrospectively added SDWAN to your existing config?  We are looking for options.Current options seem like1. configure SDWAN and remove all references to the WAN interfaces (ie assigning those references to some other interface), then building SDWAN and reassigning to the zones.  Pros: point and click Cons: take the network down for a bit while this configuration is being done and then troubleshoot issues2. dump the config, and integrate the changes, then try to import that new config into the fortigate Pros: seems quick, little downtime cons: seems like it will fail. 3. script the changes and dump those into the CLE Pros: seems quick, prone to errors cons: troubleshooting after it fails4. Building another

Hello, We are starting to patch our Fortinet devices. Several of them are configured in HA (FortiGate, FortiAuthenticator, FortiWeb, FortiADC, and FortiMail). In a critical scenario, we may need to restore the OS via TFTP on each node. In this case, should we take a separate backup from each HA member, or would restoring the HA backup on both devices be sufficient to fully recover the cluster configuration? 

Hi All, new to the fortigate/FortiAP world so needing some help on a few issues   We Have recently installed a new Wifi network into a school using the fortigate being used as a wireless lan controller and the APs are the FortiAP241k models. We are trying to connect a device which is a large touchscreen television to the network and it does not authenticate and can not connect to the wifi.   The device is a promethean Active 9 device. We have tested the screen by connecting them to a personal hotspot and these work fine so it is just the fortigate Wifi it can not connect to. We have also tested plugging the devices directly into a switch port and these work fine this way also.   Is there anything we need to do on the fortigate to make these connect to the wifi and is there anything that would be stopping these devices connecting.   We have also tried to screen share from a laptop and an iPad to the screen when they are on the same network and this also does not w

Hi everyone,I am looking for some guidance on an issue I'm having with my Web Filter configuration. A specific betting/gambling website is still accessible to users, even though I have explicitly blocked it.Here is what I have configured so far:Blocked the Gambling category in the applied Web Filter profile.Added the specific website to the Static URL Filter with the action set to "Block". Any help or troubleshooting tips would be greatly appreciated!Thanks in advance. 

In a custom dial-up VPN configurationWith ike v2 and mschap2 enabledI need to match users who connect to the VPN with their respective groups via radius attributes passed by Forti Authenticator.Currently, if I configure the IPSec tunnel with ike v1Xauth within the policies, it works.However, if I enable IKE v2, I connect to the VPN, and authentication works even with 2FA.Nevertheless, the user is not matched on Fortigate because I do not see them in the list:diagnose firewall auth listTherefore, the user is not associated with the remote radius group membership in Forti Authenticator.Is it possible to emulate the behavior of xauth while maintaining the relevant remote groups of Forti Authenticator within the policies, even with IKE v2?I would like to avoid creating x pahse1 interfaces for x groups on my Fauth that belong to two different LDAP servers.

Hi. Does anybody have an opinion about FortiGate appliances setup in a design where all routing is between sub-interfaces on the Fortilink interface? I call this a "FortiGate-on-a-Stick" design.I am considering the ISP connections for a new install consisting of three FS448E switches in a FortiLink design with two FG121G appliances in HA mode. I will use Vlan sub-interfaces on the FortiLink interface for two ISP DIA circuits as well as Vlans in my LAN.FortiGates-on-a-Stick design Is this a bad idea? Is FortiLink stable enough for this design to be reliable? Does FortiOS prefer to separate Inside and Outside on different physical interfaces for NAT and SDWAN features? 

Maybe other users can take advantage of it, i've created a FortiWeb API Package, downloadable via PyPi "pip install fortiweb-api". Doc/Code on Github: https://github.com/thom-gyger/fortiweb_api.git. I also created an Fortiweb API Agent (MCP server ) to be used with an LLM. Github: https://github.com/thom-gyger/fortiweb_api_agent.git have fun, Thom#api #automation #ai FortiWeb 

HelloIs it normal that FAC 6.6.9 has more known issues that 6.6.8, which in turn has more known issues thank 6.6.7, which in turn has more known issues than 6.6.6?From what I understand, normally each new patch should fix known issued from the previous version, right?