Support Forum

Hello everyone,We're having problems with our connection profiles on Mac. The Mac computers are running the latest version of Forticlient VPN.No matter if we enter the remote gateway with a port number (:443) or in the customize port. When we click save and reopen the connection profile the port number in the URL is gone or the check box for customize port is unchecked - without it it's unusable.  

I have 400F device and on this device we have configured around 1000 site to site VPN tunnels in active passive mode. We need to configure 330 link monitoring entries. I am able to configure 256 entries after that getting an error reached maximum entries. How can we increase the limit of link monitoring entries.  

Hello Everyone,   I have a production device that has already had our template that is for 1 MPLS -1 internet connection ran on it. I want to add another internet connection to that device. I already have a template for 1 MPLS- 2 internet connections which would be perfect. Would I be able to just add the variables for the 2nd internet connection and run the 1 MPLS-2 internet template even though it will have all the same variables from when I used the 1 MPLS- 1 internet except for the additional 2nd internet connection, or will it fail since there will essentially be duplicate variables? I thought I remember hearing or reading somewhere that it will just skip them, but maybe I made that up.  Thanks!

Hi everyone,I want to block my client's uploads (files, documents, images, etc.) to all applications and websites using Fortigate.I'm using FortiOS 7.2.6 on a Fortigate 60F.What should I configure to achieve this? Should I use Web Filter, Application Control, or adjust specific policies?Any advice or detailed steps would be greatly appreciated.Thank you!      

Anybody knows where the API reference for fortiproxy is buried at? I need to do some investigation on some uses or capabilities.

Running a Fortgate 60E running firmware 7.4.5 with a Fortilink connection to a Fortiswitch 124E PoE switch running firmware 7.6.0.  I have created an active trunk using two ports (15 and 17) on the switch controller and trying to change the vlan from the default to another VLAN I have created. When I do this in the GUI I get a red banner in the upper right that says "Failed to Save Changes". I get no other information that I can find in the logs or documentation on why this would happen or how to resolve it.

Is there a Forti solution available to deploy an old FortiGate configuration to a new NGFW Fortigate version? 

Hi guys, I'm stuck with something,  Once enabled SOAR MEA on FAZ 7.4.4, because "execute shell is no longer supported", I can't get in into the CLI for install some connectors. I appreciate some tip. Regards.

Hello.I searched forum, google and reddit and still can't do it. Our ISP manage our switches in lan. He have his router connected to our FG WAN and his switch connected via trunk on our FG aggregate (HA1+HA2). I have 2 VLANs on WAN interface - VLAN 99 (internet) and VLAN 6 (switch management).On LAN side (aggregate port) I have a few vlans in trunk included VLAN 6. Fortigate run in NAT mode, internet on all VLANs working fine. However i need do transparent config for VLAN 6 - between connection on WAN side and connection on LAN (HA) side. How can i do this? I read this - https://community.fortinet.com/t5/FortiGate/Technical-Note-Configure-a-FortiGate-unit-in-Transparent-mode/ta-p/194458 and this https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/402940/vlanIt's the same, based on informations in articles it should work but not working for me, I don't know why. Next I want to try Virtual pairs - https://docs.for

Dears, Recently I configured SSL-VPN in our Fortigate 40F.The connection is successfull in my iPhone but it doesn't on my MacBook Pro with MacOS 15.I have read this: https://community.fortinet.com/t5/Support-Forum/MacOs-Sequoia-15-0-support-for-FortiClient-VPN-7-4/td-p/342309 and tried.However, I don't have FortiClientNetwork.app in the 'Network Extensions' tab of 'Login items an extensions' within System Settings.  And eachtime when trying to open Forticlient in my MacBook.  It always crash with the following messages. Can anyone advises me how to solve the problem?  Thank you.

Hi,i tried with Image v7.4.3.F on VM Ware Workstation 17.6.1 Pro and FortiGate-VM64.ovf as an import.I could register for a trial license. With this Image i was not able to create a Site2Site Tunnel to Sophos XG 20.0 Trial Version, because of Encryption limitations. So i tried FGT_VM64-v7.6.0.F-build3401 with FortiGate-VM64.hw17.ovf, but this Release give me a trial license error, because fo 0 CPU and 0 GB Memory Bug. If i check hardware Settings i get 1 CPU and 2GB Memory. Can someone help and tell me if the 7.6.0 would support 3DES encryption?Sophos week encryption starts at 3DES ...

I need to have load balancing between two servers, so I have created a virtual IP and linked it to the virtual sever I have created on Fortigate, of course the virtual server is linked to the two real servers. The issue is that the VIP is getting hit counts normally (even if I link a real server to it, I have access), but the virtual server is not getting any hit counts, So, I want to ask if it is possible to do this configuration? If yes, what may be the issue with it?

Hi Everyone, i have a problem when i try to connect the EMS 7.2.5 to my LDAP server the same parameters work well in version 6.4.9 and 7.0.13 but since the update to version 7.2.5 impossible to reconnect the LDAP server i have the error message: unable to read LDAP response packet: unexpected EOF does anyone have an idea about this error Thanks for your help 

Hi Fortigate 101FVersion 7.6.0 I'm trying to reduce the TTL for a number of fqdn addresses by setting the cache-ttl on the address object itself. When the default cache-ttl is set to 0, and also the global setting for fqdn-cache-ttl is set to 0, it is using 2400 seconds - which I assume is from the DNS query response. (The Fortigate is configured to use our DCs for DNS). To overcome this, I have set the cache-ttl to 60 under the FQDN type address object, but it continues to use the 2400 timer?. I am checking this by using command - diag test app dnsproxy 6  Any help much appreciated FortiGate 

Hi. Got some Q about forticlient EMS.We are using windows allways on vpn right now (not my choise) and would like Forticlient because of the VPN and ZTNA thing.So can the Forticlient vpn in IPSEC mode use the computer certificate before login so the user can reset password (with a policies only allowing the things needed for that) and when the user logs in uses the user certificate to get more access? mayby with the ztna tags? like EAP-TEAP where you have the outher and inner methode.if yes, does the client reset the first ipsec tunnel og makes another for the "inner" methode?if its possible, then ill proberly make the samme setup from the outside and inside, so we are full ztna.I'm about to do a poc so i can test it, done a lot of traditional ssl vpn remote access on fortigates, but would like the advance mode this time and ipsec other than ssl.We got about 2200 clients and a 900g so the FGT can handle 50k ipsec tunnels.Morten

Hello everybody, We are facing an issue where the Application control isn't showing in the security profile in our FortiGate firewall we are using 60f we noticed this problem since we updated the firewall to the latest version 7.6.0, also note that when I go to certain policy it doesn't show when I edit the policy ,but strangely when I point my mouse on the security profile part in the policy it shows the application control and i can edit it.can anybody tell if this is a bug or something else. Thanks in advance

I am attempting to create a second VPN tunnel on our Fortigate. I have followed the wizard, but I cannot finish creating the tunnel: all I receive is a pop up stating "invalid length of value -1". This occurs when I use a template from the VPN wizard, or when I do a custom tunnel, filling out all the information. I have also tried creating a tunnel using a different interface than the one the first tunnel is on, but I still get the same error. This is on 7.0.14, but I have also tried on another Fortigate (7.4.3), and I receive the same error. The error seems to indicate to me I have not filled something out, but I am positive I have selected every possible value. What am I doing wrong? 

Hi there, I am currently trying to configure BGP for my SD-WAN IPv4 over IPv6 ADVPN environment, following the guide from Fortinet’s documentation on Active Dynamic BGP Neighbor Triggered by ADVPN Shortcut→Active dynamic BGP neighbor triggered by ADVPN shortcut 7.4.1 | FortiGate / FortiOS 7.4.0 | Fortinet Document LibraryAfter configuring BGP, I tried to check the BGP routing table using the command:get router info routing-table bgpHowever, I am receiving the message "No route available."What could be the possible reasons for not seeing any routes in the routing table..?Below is the current BGP configuration on my hub router.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~FortiGate-60F (bgp) # showconfig router bgpset as 65100set router-id 10.200.1.1set ibgp-multipath enableconfig neighbor-groupedit "EDGEv6"set remote-as 65100set update-source "advpn-hub"nextendconfig neighbor-range6edit 2set prefix6 2001:db7::/64set neighbor-group "EDGEv6"nextendconfig networkedit 1set prefix 192.168.0.0 255.255.

fortigate 40G we can save user name but we can not save the password.

Hi, I have a question about upgrade my fortigate 101E.Right now I have two fortigate 101E, one's firmware is v5.6.9 build1673, the other is v6.0.6 build0272.And I plan to upgrade both of them to v7.2, I already download all the necessary firmware files according to the upgrade path tool.But my problem is, one of my colleague said he had once upgrade another device from 5.X to 6.X, and the device's license will be expired after upgrading, no matter the expinonesensered date is in the next year.I am curious is it possible?? Cause my devices' licenses will be expired in 2024, if they expired after upgrading, that means I will lost two years license and need to purchase new license?!Does anyone have the same problem? Or It's just nonesense and I should just upgrade  firmware?Thanks for any reply.

This post is tied to another one  (see link to post below) I made regarding using the ISP DNS servers for DNS resolution rather than FortiGuard DNS servers or having to specify the DNS ISP  servers IP addresses manually in the Fortigate DNS settings. To see if I could disable DNS resolution with FortiGuard DNS servers, I have tried to set in the Fortigate settings the primary DNS as 1.1.1.1 and the secondary dns server as 8.8.8.8 and then making a policy which blocks all communication for all services between my host and the FortiGuard DNS servers (i.e. 96.45.45.45 and 96.46.46.46). However, after doing all of this, if I run nslookup youtuber.com 96.45.45.45, my query is resolved. How is this possible? How may I disable all communication to the Fortiguard DNS servers? Post link: https://community.fortinet.com/t5/Support-Forum/How-to-configure-a-LAN-interface-with-DHCP-disabled-to-use-the/td-p/350392

I have installed Forticlient on Debian 12 But it shows the error. Then i installed it on ubuntu 22.04 but it also shows same error. On windows and android vpn client works fine but does working on linux any one knows the solutionFailed to connect to vpn tunnel please try againDetails Error Error invoking remote method keytar.deletePassword error unknown or unsupported transport for address disabled  FortiClient @support 

We have Active/Passive with Virtual Clusters setup. With default HA configuration, the "link-failed-signal" is disabled. From some doc, it says the option is to enable/disable signaling to internal hosts when failover happens for fast switchover. So it sounds good but why it is disabled by default? Should I manually enable it? Please advise. 

Hi, The situation where we have the error is using the shared connection of an iPhone and connecting with FortiClient from a Windows 11. The iPhone is only used to provide Internet access to Windows laptops, the FortiClient is installed on those Windows laptops and from here the error sequence is the one I mentioned in the first message - We connect and it asks for username and password- We enter the data and it asks us for the FortiToken.- Enter the code provided by FortiToken.- After about 12 seconds the client does not connect and in the firewall logs appears the message “delete IPsec phase 1 SA”. This is the progress of the connection in phase 1 of IPsec: 2024/09/26 11:40:55 -> negotiate IPsec phase 1 -> XAuth authentication successful2024/09/26 11:40:55 -> progress IPsec phase 1 -> OK2024/09/26 11:40:55 -> progress IPsec phase 1 -> DONE And 12 seconds later the message “delete IPsec phase 1 SA” is displayed. Thanks.

Hello Fortinet Community,I’m facing an issue with transferring large photo files over a FortiGate VPN connection, and I’m hoping someone can help me troubleshoot.I’m a photographer and regularly transfer large, high-resolution image files (RAW and JPEG) from my home office to my team’s server through a FortiGate VPN. Lately, I’ve noticed that some of the files, especially RAW images, seem to lose quality after the transfer, or sometimes the images appear slightly corrupted or compressed.Here’s my setup:- FortiGate Model: FG-60E- Firmware: FortiOS v7.0.4- Connection: FortiClient VPN (IPsec)- File Sizes: RAW files around 25MB - 50MB eachThe original files are perfectly fine before transfer, but once they’re on the server, some seem slightly pixelated or show signs of compression. I’m not sure if it’s a VPN issue, a bandwidth problem, or something with the file transfer protocols. I use FTP for the file transfers. Could this be a data integrity issue with the VPN encryption?I’ve tried:- R