Support Forum

Currently, two separate FortiMail VM instances are running in Server Mode for two different zones. Both zones use the same mail domain, and FortiMail is providing full mail server functionality (mailbox services) along with email security features.Now, there is a plan to migrate from 2 FortiMail VMs to 2 FortiMail bare-metal appliances (zone-to-zone replacement).I would like to get guidance from the community on the following:What is the recommended process for migrating FortiMail VM (Server Mode) to hardware appliances?Is configuration backup and restore between VM and hardware models fully supported, or are there limitations?What is the proper approach for migrating mailbox data, mail storage, and mail queues?Are there firmware compatibility requirements between VM and hardware before restoring configuration?What storage-related concerns should be considered (e.g., disk initialization, RAID configuration differences)?What are the key risk factors during this migration, especially whe

Last week, I upgraded the Forticlient EMS server to version 7.4.5. The workstations are still running 7.4.4.A few days later, I noticed that there were 3500 files in Quarantine.This wasn't the case before. Users can no longer find some of their files.For example, Spyder is a scripting app we use for data analysis, modeling, and reading/editing files.I've never had a problem with it.But now users are getting the following error:I also see, for example, .xlsx files from some users' OneDrive files incorrectly in Quarantine.These exclaimer files are also valid:When I click on the ransomware link, I get the FortiGuard Labs message below:UnavailableCould not retrieve this virus at this time. Please try again later.Any idea why there are suddenly so many false/positives?

Hi I'm having trouble connecting to the server of one of our customers. In the last 2 weeks it worked but now all I'm getting is Status: DisconnectedNotification: Error: Can not connect to VPN server. I'm using the Foriclient (VPN only client) 7.4.3.1736 für AMD64 linux on a freshly updated Debian 13. In 3 of 5 cases, I enter the password and immediately get this error messages. And even when it manages to connect to the server, it prompts me for the token. And the generated token does not work anymore (using latest FortiToken Mobile on android). This is the error message that I see in /var/log/forticlient/sslvpn.log 20260218 00:15:24.439 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:/CN=<REDACTED>20260218 00:15:24.462 TZ=+0100 [sslvpn:DEBG] vpn_connection:669 http connection closed.20260218 00:15:24.463 TZ=+0100 [sslvpn:DEBG] vpn_connection:531 Response line: 200 OK2026021

Seeking a Fortinet solution to replace our Umbrella DNS Advantage for remote users. The goal is to enforce DNS filtering for all remote users, regardless of whether or not they are on/off VPN. Forticlient doesn't support the DNS filtering profile (only on Gates). My research comes up with the following potential solutions. Looking for any other comments or suggestions. User on prem = use DNS filter on the gateRemote user on FCT/EMS = force always-on vpn and make sure DNS traffic is routed over the tunnel and DNS Filter profile is applied to a FW policyRemote user on SASE = force always-on and apply the DNS Filter profile in the SASE POP. Thanks all,Don

Hi Team, I am unable to use FGT 7.6.6 in my EVE-NG it is asking me to update license but it is not taking that. can someone please help me on this. RegardsSantosh

Hello,I have a Site-to-Site IPsec VPN between a Fortinet FortiGate 80F and a MikroTik router.Phase1 and Phase2 parameters match on both sides. The tunnel shows status = up, but no traffic passes until I manually restart the tunnel on the FortiGate.After restart:Traffic works normallySA counters increaseBoth directions pass trafficAfter some time, traffic stops again while:Phase1 remains upDPD status is OKNo config changes are madeIn diagnose vpn tunnel list, sometimes I see:proxyid_num=0 / child_num=0orasymmetric counters (only enc or only dec increasing)Is it possible for Phase1 to stay up while Phase2 becomes unusable?Could this be related to NPU offloading or replay protection?FortiOS version: 7.4.11Any guidance would be appreciated.#FortiGate

FortiGate / FortiOS: Fortigate 81F / v7.6.2VPN: IPsec IKEv2 dial-up Client: FortiClient VPN-onlyAuth: Local users + EAP-MSCHAPv2 + FortiToken (2FA) Whats working so far : FortiClient connects successfullyFortiToken OTP is requested and validatedClient receives an IP from the IPsec poolTunnel is UP Issue : No access to LAN resources (can't ping my DCs from ipsec vpn but can from ssl vpn)All traffic is dropped by firewall with policy 0 Debug :  Flow debug shows:received packet from VPN_IPSEC_0 route found via LAN Denied by forward policy check (policy 0) Policies I tried so far : srcintf = VPN_IPSEC (not accepted)srcintf = VPN_IPSEC_0 (not a valid interface)srcintf = zone containing VPN_IPSECsrcintf = anyWith / without user groupsWith very permissive rules (ALL / ALL)Still always policy 0. Observations Interface VPN_IPSEC exists (169.254.x.x, type tunnel, UP)Traffic arrives as VPN_IPSEC_0, which cannot be referenced in policies

Hi, New to the forum and seeking assistance.  Since EOL has been set for the FortiGate 30E I am considering updating to the FortiGate 30G. The replacement product. The question is 'Can I download configuration for the FortiGate 30E and upload it to FortiGate 30G. Will uploading transfer the Policy and Object section? Any help appreciated.

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I login to the fortigate web admin using my LDAP User and here my config. Everything is working fine, i able to log on to the Firewall. But when i upgrade the firmware on primary firewall then when secondary firewall take over then i can't login using LDAP users. If i remove set source-ip then both firewall able to login. Anyone know why?IP 10.202.151.1 is interface on Fortigate which connected to the LAN (Core Switch) FW01 (AD) # showconfig user ldapedit "AD"set server "10.203.248.31"set source-ip "10.202.151.1"set cnid "sAMAccountName"set dn "dc=mydomain,dc=id"set type regularset username "mydomain\\admin.forti"set password ENC xxxxxxxxxxxxxnextend

Hello, we would like to set up LAN authentication via Windows Radius. This would allow sales employees, for example, to log in anywhere and access the sales VLAN with their registered AD account. We have already set up a lot, but the failed VLAN always pops up on the Fortiswitch port. And on the Windows 11 PC, the login does not work in the Ethernet settings. Has anyone set this up before and can help? FortiGate #Radius 

Hi All,I am facing an issue in getting the NFR for my VM fortinet firewall. This NFR is used only by me for the LAB purposes.

 Hello everyone, Recently I’ve encountered issues with FortiOS 7.6.5 and 7.6.6.We are running an on‑premises Exchange Server with access via OWA/ECP.Instead of a regular VIP, we publish this using a Virtual Server (load balancer) on the FortiGate.No ZTNA, FortiProxy, Endpoint Management, just a FortiGate with access to Exchange.The setup is straightforward: HTTPS on port 443, a public record, a wildcard certificate, and a mapping to the real server.With FortiOS 7.6.4 everything works correctly and OWA/ECP loads as expected. However, after upgrading to 7.6.5 or 7.6.6, opening the OWA page immediately results in:504 Gateway Timeout: remote server did not respond to the proxy.No changes have been made to the Exchange Server configuration — only the FortiGate firmware upgrade.Rolling back to 7.6.4 resolves the issue, but we would prefer to stay on the latest version.Has anyone experienced this, or does someone have an idea what might cause it? Best regards,Tim

Hello everyone, I would like to know, can the isolation interface port2 and isolation scope be in the same network, example : Isolation interface :192.168.10.2Gateway : 192.168.10.1Isolation scope : Gateway : 192.168.10.1lease pool : 192.168.10.3 - 192.168.10.100 I've seen the majority of articles use seperate subnets and some articles use them in the same subnet. Can anyone explain pls ? Thanks in advance.BR,

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hi all, I have a Fortigate doing an IPSEC to an offsite server, and SNAT is required. Policies from dial-in IPSEC and LAN work OK (sending HTTPS traffic to the server over the IPSEC with SNAT translating the source to an IP pool) but when I try to provide external access to this via a VIP, traffic matches the policy and passes but connectivity fails.LAN to IPSEC policy (working)config firewall policyedit 52set name "LAN to IPSec SNAT"set srcintf "lan"set dstintf "IPSEC-P1"set action acceptset srcaddr "10.0.10.0/24" "192.168.1.0/24"set dstaddr "10.200.201.1/32"set schedule "always"set service "ALL"set logtraffic allset nat enableset ippool enableset poolname "IPSEC_SNAT"set comments "LAN to IPSec SNAT"nextendWAN to IPSEC policy (not working) config firewall policyedit 23set name "ipsec-tk-test"set uuid 46350196-0707-51f1-1c80-8146215ecbefset srcintf "wan1"set dstintf "IPSEC-P1"set action acceptset srcaddr "Australia"set dstaddr "IPSEC-VIP"set schedule "always"set service "ALL"

Hello to everybody, Two days ago, the following system events appeared:  I haven't activated this and I do not know how this could happen. My FortiGate does not support WiFi (or this is what I thought...). Please, what do I have to do to turn off the Wireless Controller? Thank you for your help. 

Hey everyone,In some FortiSwitch models, certain ports are indicated as FortiLink ports. My question is: if, for some reason, I want to connect port 1 to a FortiGate firewall, is that label just for indication purposes, or is there some configuration that needs to be done with console cable on the switch to make FortiLink work through port 1?Also, some models, like the FortiSwitch 424E-FIBER, don’t have any FortiLink port indication at all. Does that mean that every port on these models can be used as a FortiLink port?

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hi, I have two single VM FortiGates in Azure.Each FortiGate is in a different region. They were both configured with the default three subnets within a vNetI have peering between the local vNets and each local FortiGates vNet So traffic between each regions vNets and the local FortiGate routes correctly.The FortiGates also have a IPsec P2P to on-premise FortiGates and traffic also routes correctly. What I'm trying to achieve is routing from either Azure FortiGates SSL-VPN to the other regions FortiGate and local vNets. I have the SSL-VPN configured with its own subnet and all the required policies to allow the traffic. I have setup peering between the two Azure FortiGates vNets and even set a UDR routing it to the remote FortiGates internal ip x.x.x.68 I've set these two options on the peering.Allow 'Region1_FTG' to access 'Region2_FTG"Allow 'Region1_FTG' to receive forwarded traffic from 'Region2_FTG'Allow 'Region2_FTG' to access 'Region1_FTG"Allow 'Regio

FortiGate appears offline in Forti Manager. Both Internet connections are online, but if I disconnect and reconnect the LAN cable between the FortiGate and Forti Switch, it shows as online in Forti Manager. However, after a few hours, it goes offline again.

Hello! I just got this firewall used.I am wondering if it is possible to get the WAN1 port to give internet to the internal LAN ports.Is this possible? I haven’t been able to get it after hours of trying. Thanks!

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?