Support Forum

Hi all,I’m running into a weird issue with our FortiGate 60F and could use some guidance. Here’s the context:We’re planning to shut down our on-prem DNS server and move some devices to use public DNS at one of our sites. The problem is that, even though all affected devices are on the same subnet/interface and show similar IP config, some are hitting the implicit deny policy while others are hitting my LAN-to-WAN policy.Here’s what I’ve observed. Devices that can’t reach public DNS can still browse the web using our on-prem DNS server. This server has conditional forwarders pointing to 8.8.8.8and 8.8.4.4. I have a firewall policy list as follows:LAN-to-Netsweeper – forwards all HTTP/HTTPS traffic to our web filtering provider.LAN-to-WAN – should catch everything else, including traffic from our internal interface 172.24.XX.XX/22.The problem is that, for devices on the same subnet:Some hit the LAN-to-WAN policy as expected.Some hit the implicit deny instead.I’ve also attached a screensh

Hi All,I have not done this setup but I need to configure it so I'm trying to understand what needs to be done.I have the below setup where a BBU is suppose to reach the Target IP but it doesn't..  I performed packet capture and sniffer to find out the below, 10.2.186.30 needs to reach Target over the 2 IPSec Tunnels.. 2026-02-18 14:05:59.077617 CORE in 10.2.186.30 -> 10.136.137.34: ip-proto-132 16 2026-02-18 14:05:59.077620 CORE in 10.2.186.30 -> 10.136.137.33: ip-proto-132 16 2026-02-18 14:05:59.077624 VDOMA-VDOMB0 out 10.2.186.30 -> 10.136.137.34: ip-proto-132 16 2026-02-18 14:05:59.077626 VDOMA-VDOMB0 out 10.2.186.30 -> 10.136.137.33: ip-proto-132 16 2026-02-18 14:05:59.077627 CORE in 10.2.186.30 -> 10.136.137.34: ip-proto-132 48 2026-02-18 14:05:59.077629 VDOMA-VDOMB1 in 10.2.186.30 -> 10.136.137.33: ip-proto-132 16 2026-02-18 14:05:59.077644 VDOMA-VDOMB0 out 10.2.186.30 -> 10.136.137.34: ip-proto-132 48 2026-02-18 14:05:59.0776

Dial Up IP Sec VPN using SAML authentication and Entra ID as IdP.External clients can connect to the VPN just fine.Internal clients cannot connect to the VPN. has anyone successfully setup IPSec VPN for internal clients?

Hi!Is it true, that when using winbind and PEAP, the only way to login to network is format DOMAIN\username.And username@domain.com doesn't work? Another related question: Is there a way to enforce plain username login to specific windbind domain?So client enters only username and password withoun domain info... BR, A

The vFSA appliance is deployed in IBM Cloud Classic (Dallas) in an active–passive configuration with only one public subnet IP currently assigned, and no additional public IPs available in the subnet. We have five web servers hosting different websites that must be externally accessible. In the absence of spare public IP addresses, we would like guidance on how to expose these services behind the firewall with separate public IPs. Please advise on the recommended architecture or configuration for this setup. If possible please share some links if there are any. Thanks

What are the Windows AD Service Account minimum privileges for the Fortinet SSO user account I must assign in the Windows Active Directory Domain Controller? Granting the overly privileged Domain Admins group to a service account is not permitted due to best practices and the security policies enforced by the security team.

Hello all , I’m a bit confused about the certificate-probe-failed error and would like to better understand why it happens and how to identify its root cause.We experienced denied traffic on the FortiGate firewall to smart.3CX.be:5001 due to a certificate probe failed error, with the following message:"SSL connection is blocked due to unable to retrieve server’s certificate.”(certificate-probe-failed) As the default behavior for CERT probe failed is block so the traffic is blocked.It's strange for me as the issue occurred yesterday, where the traffic was consistently blocked by the firewall. However, today the traffic started passing successfully, and the service is working as expected without any changes made on the firewall side. does anyone have any idea about that ?note : I use default Certificate inspection profile with flow mode .

Hi everyone,I manage like 30 fortigate devices and I updated them to 7.2.13 when it was released.Since I got users complaining about slow SMB traffic inside IPSEC tunnel s2s. The users are all behind this 101E model and they are thé only ones to complain.Bandwidth is like 300KB/s during transfer in 7.2.13I tried to check ipsec config (encrypt. algo.) Changed and adjust MTU but the traffic is still slow...Since the users told me it started since last update I tried to rollback to 7.2.12. same issue. I remember that I updated 7.2.12 and 7.2.13 a week after. So I checked to rollback to 7.2.11 and now speed is back to normal like it was before 8MB/s.I'll open a ticket but it seems linked to this model. Anyone has the same behaviour ?

Hello! I wanted to ask for people who are using fortinac for authentication with radius and mac traps alongside persistent agent. How long does it take for a user to go from isolation vlan to production?

Hey guys, so I did a "small" mistake.We bought two new FortiGate clusters (120G and 100F, both active-passive) to replace our old Palo Altos. One cluster is already running and the other is in the lab to set up.While starting to configure the second cluster, I realized that I mixed them up. The running cluster should be the 100F, but those firewalls are currently on my table. What is the best way to replace the running cluster with the other hardware?The issue I have is that I don't have much time. The second cluster has to be installed next tuesday and the already running cluster is already full productive. How can I exchange them with the least interruption? Thank you so much for your answers!

Good morning, I am struggling with an issue with FortiClient SSL VPN (Standalone VPN) on a Windows 11 computer. I have installed the FortiClientVPNOnlineInstaller.exe from the FortiClient downloads page. The install finishes correctly. I am able to set up the VPN. I've used the exact same VPN configuration on other computers with no problems. On this computer, when I click "Connect" it seems that nothing happens.The expected response would be for FortiClient SSL VPN to open a web page for me to log into my SSO to authenticate. I've performed the following troubleshooting steps:1. Restarted the computer.2. Uninstalled FortiClient VPN/reinstalled FortiClient VPN.3. Checked, double-checked, and triple-checked the configuration. Even tried multiple remote gateways that should work.4. Ran SFC scan on the computer.5. Performed a Network Reset via Windows Network Settings on the computer.6. Ran DISM /RestoreHealth on the computer.7. Flushed the DNS cache.8. Tested the FortiClient VP

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hello guys,I am currently configuring FortiNAC to authenticate users using LDAP accounts. This setup is intended for BYOD devices, primarily mobile phones and Windows laptops.I am using EAP-PEAP with MSCHAPv2 as the inner authentication method.The issue I am experiencing is as follows: FortiNAC correctly assigns profiles and policies to the devices upon authentication, but it does not assign the Access Value / VLAN configured in the SSID according to the Logical Network.For comparison, a very similar configuration is used for internal devices, which works correctly — the Access Value/VLAN is applied as expected.I have verified that:The SSID has the VLAN/Access Value properly configured.LDAP authentication succeeds, and users are correctly identified.Policies and profiles are applied as expected.Could anyone advise why the Access Value/VLAN is not being assigned for BYOD devices in this scenario and how to resolve it?There are some pictures and part of debug log:- AccessConfiguration&nb

Hello everyone, I am experiencing an issue with all my FortiGate 101F firewalls running FortiOS version 7.2.12. Since a few days ago, these devices have stopped sending logs to FortiGate Cloud. The problem is affecting my entire fleet of firewalls simultaneously

Hi everyone, after a lot of trial and error, I managed to set up a working IPSec VPN configuration based on certificates (server and client auth) that works for the FortiClient and also for strongswan (on Linux). Now I would like to extend our firewall policies, so that we can limit access for individual users to what services they actually need. Since user matching is already part of the IPSec authentication, I assumed that this would be fairly easy, but it doesn't work. As soon as I select the group containing the authenticated user for the policy, it doesn't match anymore and traffic is dropped. Here are the relevant excerpts of the configuration: # PKI user:config user peeredit "vpnphip"set ca "CA_Cert_2"set subject "CN = vpn-bup"nextend (I first tried with "set cn vpn-bup", with the same result) # PKI group:config user peergrpedit "vpnadmin"set member "vpnphip"nextend # Normal user group:config user groupedit "vpngroup"set member "vpnphip"nextend&nbsp

Hi, we are looking into the migration from SSLVPN to IPSEC, it mostly works with windows, but there doesn't seem to be any ipsec options for the VPNOnly client on linux (only in windows).It seems that the ZTNA Edition is capable of connecting under linux but it requires licensing.So the question would is, with the 7.6 versions disabling sslvpn, are there any free clients that can connect to VPN with IPSEC+SAML? Will fortinet provide them a any time? Regards

Hi Friends,I would like to know if there is a portal on the FortiGate website where we can check the recommended firmware versions for FortiGate firewalls. Coming from a Cisco background, I’m aware that we can verify the recommended firmware for specific Cisco devices on their website. Is there a similar portal available for FortiGate where we can check the recommended firmware for specific firewall models?

I am no longer able to log in to the AP GUI and am not proficient in CLI yet. If this is an issue, what should I be checking? Although the AP's have the DHCP server enabled when we connect to either of the two SSID's we receive an IPADDR from the pool set up for the DHCP on port 4. Be advised that the AP's are connected to port 4 but have a different DHCP range set up on the individual AP. Does the AP not distribute from its own DHCP range?

I work at a small non profit in New York City. Our network administrator was in a bad accident. I have been asked to help out until a replacement can be found. I have no experience with firewall administration. I need to add IP addresses to the whitelist of  a Fortigate 200D and a Fortigate 60D. Where on the interface do I add these IP addresses. Thank you very much.

Hi there, I have configured Radius server in window server to authenticate Firewall user so that users can manage Firewall. Radius server is accessible from Fortigate Firewall and user is also reachable when I test from FortiGate test connectivity. But when I do ssh or access GUI to access the firewall by entering username and password showing incorrect password. Please need your suggest what I am missing.   Even after entering correct username & password which configured at Radius server is not able to login.  Thanks for your attention on this problem

IntroductionAre you alerted when or if a rogue AP broadcasts your companies SSID? Are you alerted when or if large volumes of de-authentication packets are sent to your wireless clients? These are some questions I've been asking recently as I've researched WIDS and how Fortinet can help. This isn't really a support request for the forum; it's more of an information sharing post for those interested.  Generally, most wireless deployments I see using Wireless Intrusion Detection Systems (WIDS) or Wireless intrusion Prevention System (WIPS) are using default vendor setting rather than fine tuning the settings to suite your business needs or align with your company cyber security policies. In some cases, WIDS may be disabled all together due to concern of resource usage on the AP hardware itself or limiting the available radios of the AP by using radios as dedicated monitors. Most of what can be found via a quick google search regarding wireless security is more centered around u

Currently, two separate FortiMail VM instances are running in Server Mode for two different zones. Both zones use the same mail domain, and FortiMail is providing full mail server functionality (mailbox services) along with email security features.Now, there is a plan to migrate from 2 FortiMail VMs to 2 FortiMail bare-metal appliances (zone-to-zone replacement).I would like to get guidance from the community on the following:What is the recommended process for migrating FortiMail VM (Server Mode) to hardware appliances?Is configuration backup and restore between VM and hardware models fully supported, or are there limitations?What is the proper approach for migrating mailbox data, mail storage, and mail queues?Are there firmware compatibility requirements between VM and hardware before restoring configuration?What storage-related concerns should be considered (e.g., disk initialization, RAID configuration differences)?What are the key risk factors during this migration, especially whe

Last week, I upgraded the Forticlient EMS server to version 7.4.5. The workstations are still running 7.4.4.A few days later, I noticed that there were 3500 files in Quarantine.This wasn't the case before. Users can no longer find some of their files.For example, Spyder is a scripting app we use for data analysis, modeling, and reading/editing files.I've never had a problem with it.But now users are getting the following error:I also see, for example, .xlsx files from some users' OneDrive files incorrectly in Quarantine.These exclaimer files are also valid:When I click on the ransomware link, I get the FortiGuard Labs message below:UnavailableCould not retrieve this virus at this time. Please try again later.Any idea why there are suddenly so many false/positives?

Hi I'm having trouble connecting to the server of one of our customers. In the last 2 weeks it worked but now all I'm getting is Status: DisconnectedNotification: Error: Can not connect to VPN server. I'm using the Foriclient (VPN only client) 7.4.3.1736 für AMD64 linux on a freshly updated Debian 13. In 3 of 5 cases, I enter the password and immediately get this error messages. And even when it manages to connect to the server, it prompts me for the token. And the generated token does not work anymore (using latest FortiToken Mobile on android). This is the error message that I see in /var/log/forticlient/sslvpn.log 20260218 00:15:24.439 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:/CN=<REDACTED>20260218 00:15:24.462 TZ=+0100 [sslvpn:DEBG] vpn_connection:669 http connection closed.20260218 00:15:24.463 TZ=+0100 [sslvpn:DEBG] vpn_connection:531 Response line: 200 OK2026021

Seeking a Fortinet solution to replace our Umbrella DNS Advantage for remote users. The goal is to enforce DNS filtering for all remote users, regardless of whether or not they are on/off VPN. Forticlient doesn't support the DNS filtering profile (only on Gates). My research comes up with the following potential solutions. Looking for any other comments or suggestions. User on prem = use DNS filter on the gateRemote user on FCT/EMS = force always-on vpn and make sure DNS traffic is routed over the tunnel and DNS Filter profile is applied to a FW policyRemote user on SASE = force always-on and apply the DNS Filter profile in the SASE POP. Thanks all,Don