Support Forum

I configured an IPsec Remote Access VPN. When I use local authentication, the VPN works fine. However, when I switch to SAML authentication, the SAML login completes successfully, but FortiClient returns to the main screen instead of establishing the VPN connection.Has anyone experienced this issue before or knows what could be causing it? 

Need help troubleshooting. Already did factory reset of APs, deauthorize and re-authorize as well as the following.Killed CAPWAP process  - diagnose sys kill 11 <PID_of_cw_acd>Ran command - diagnose wireless-controller wlac -d wtp [SN] [reset] to reset cached AP information and state Changed wireless-controller timersconfig wireless-controller timersset echo-interval 100set discovery-interval 15end Set set max-retransmit from 3 to 15config wireless-controller globalset max-retransmit 15nextend 

Hello Fortinet Support,We are looking for guidance on deploying and configuring the FortiClient VPN application on Android devices managed through SOTI MobiControl.Our goal is to deploy FortiClient with a predefined VPN configuration, including authentication settings, so that users do not need to configure the VPN manually.Specifically, we would appreciate your guidance on the following:Can FortiClient VPN be deployed and configured automatically on Android devices through SOTI MobiControl? Can VPN profiles and authentication settings be preconfigured using Managed App Configuration or another officially supported method? Does FortiClient support receiving VPN configurations from FortiClient EMS on Android devices, and can this be used in conjunction with SOTI MobiControl? Is there any official Fortinet documentation or recommended best practice for deploying and configuring FortiClient VPN on Android using SOTI MobiControl?Our environment:MDM: SOTI MobiControl Devices: Zebra MC9400 r

Hello,we currently use several FortiExtenders as WAN extensions in combination with 5G, SIM cards an IP passthrough. While this seems like the optimal solution we randomly encounter issues because the ISP assigns random CGNAT subnets through DHCP within 10.0.0.0/8. This seems completely random and may or may not conflict with our internal networks.I have thought about using the FEX in standalone NAT mode so I am able to use deterministic transit networks on the FortiGate. However in that case we lose the nice FortiGate integration & management.Has anyone an idea how this can be solved more elegant? Can NAT mode used while the extender is managed by FortiGate?

I have a FortiGate firewall with FortiGate switches all connected via Fortilink in the firewall.  I have a requirement to now connect 20 PLC devices that share the same ip addresses to our network.  I am not able to re-ip the PLC devices so need to figure out the correct NAT setup for this.  I have setup each PLC in its own vlan (Vlan 3001-3020). Each vlan its own unique subnet as the primary subnet (10.0.2.0/29…..10.0.2.210/29).  I then added the overlapping subnet (192.168.1.0/24) as a secondary subnet to each vlan.  Dnat and Snat ip pools have been setup for each device and firewall rules have been setup to allow the communication. The snat is working I am able to ping from each PLC device to the corp network.  The problem I have is the Dnat ping from the Corp network to each PLC device.  Because of the overlapping subnets the VIP is converting the traffic back to the 192.168.1.1 address and the firewall is routing all traffice back to one vlan not the correct vlan. I have searched

We are experiencing an issue where some client devices cannot connect to Wi-Fi after upgrading our FortiGate 101F and FortiAP 231F environment to FortiOS 7.4.13, what can I follow up

We created site to site ipsec vpn Between two fortigate firewall... One firewall OS 7.6.6 & another firewall OS 7.4.2..we entry the data exact the same to both firewall like Ike v number ,  DH,  Encryption protocol etc but tunnel not working. Please help is there any solution for it 

I'm looking to go from 7.4.x to 7.6,.xI already upgraded Fortimanager. We normally make a new ADOM and migrate.However I see people just update the existing one since 7.6 ADOMs can manage 7.4 devices.Any opinions on which is a better practice?

Hello, our organization recently obtained a few MacBook Neos and Airs to test, running on macOS 27 Golden Gate. However, after installing FortiClient and connected to the office network, at random times, the Wi-Fi and Bluetooth would switch off and cannot be turned back on manually. After 2-3 minutes of this, the MacBook will then freeze then immediately restart on it’s own. Following a restart, everything seems normal, but this issue can repeat multiple times in a day, but as the day goes on, it becomes stable. This happens the moment I disconnect and reconnect back to the office network. Especially after bringing home and returning to the office with the MacBook. This issue does not happen with a private home network or hotspot. Resetting the MacBook does not resolve the issue either. When FortiClient is not installed, the MacBook behaves normally. 2 older MacBooks obtained last year does not experience this issue. We have disabled / blocked Apple Account login, Mail, Calendar, iClou

fortigate FG201f running 7.4.12 b2902forticlient 7.4.8, managed by forticloudintune pki (CloudPKI)the payload (via sniff) appears to be sent, but fortigate ignores as the tunnel has been ignored.wanting to set up a device cert based TCP IPSEC tunnel.  end goal is for the device to connect without user involvement.from the ike debug logs:session started on tcp 8443proposal acceptedcert requestedcert sent (in 6 piecescert received and reassembledclient details sent, mostly correct except the OSVER.  this is a Win 11 devicepeer is matched“AUTH payload not received”tunnel is closed How do I diagnose why the tunnel was closed?  Why is the OSVER wrong? debug log:ike V=root:accepts ike tcp-transport(vd=0, vrf=0, intf=0:27, 162.252.yyy.yy:8443->142.167.xx.xx:58204 sock=42 refcnt=2 ph1=(nil)) (1).ike V=root:0: comes 142.167.xx.xx:58204->162.252.yyy.yy:8443,ifindex=27,vrf=0,len=606....ike V=root:0: IKEv2 exchange=SA_INIT id=225ee7034892962d/0000000000000000 len=606ike 0: in 225EE7034892962

Trying to create IPSEC Dialup using device certificates.  The authentication is not succeeding.This is the ike debug log:ike V=root:0:EMS-TCP-VPN:179: received FCT-UID : 66FEE5B1BADB40A799FEAAD9D836EFF4ike V=root:0:EMS-TCP-VPN:179: received EMS SN : FCTEMS8825002268ike V=root:0:EMS-TCP-VPN:179: received EMS tenant ID : 00000000000000000000000000000000ike V=root:0:EMS-TCP-VPN:179: received peer identifier DER_ASN1_DN 'CN = xxxx-000000'ike V=root:0:EMS-TCP-VPN:179: match gw peer ID by FNBAMike V=root:0:EMS-TCP-VPN:179: AUTH payload not receivedike V=root:0:EMS-TCP-VPN:179: schedule delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:0:EMS-TCP-VPN:179: scheduled delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:destorys tcp-transport(vd=0, vrf=0, intf=27:27, 162.252.xxx.xx:8443->142.167.xx.xx:53461 sock=42 refcnt=0 ph1=(nil)) (0).ike V=root:0:EMS-TCP-VPN: connection expiring due to phase1 downike V=root:0:EMS-TCP-VPN: going to be deletedike V=root:0:EMS-TCP-VPN: res

I'm looking to go from 7.4.x to 7.6,.xI already upgraded Fortimanager. We normally make a new ADOM and migrate.However I see people just update the existing one since 7.6 ADOMs can manage 7.4 devices.Any opinions on which is a better practice? 

Restore Fortianalyzer logs from old to new via "execute restore logs-only all sftp ip of server user id and password / (or /home/logs" I get error diagnose log restore cancel

 Since the update to version 7.4.13 build2933, emails are no longer sent to users whose username exceeds 36 characters.I am referring to the emails containing the QR code for FortiToken Mobile. Version: FortiGate-901G v7.4.13,build2933,260929 (GA.M) 

 Hello community,I would like to know whether the newly available FortiOS v7.4.13 (Mature) release addresses and fixes the multiple CVEs (Common Vulnerabilities and Exposures) identified in previous versions.  Regards,Lengai 

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

Hi,I need the FortiGate 7.2.10 KVM image for my EVE-NG lab. However, it is not showing up on the Fortinet support/download page where I normally get the images from. Could you please guide me on where and how I can download this specific version? Thank you very much.

FortiClient VPN is failing to connect and gives "Timed out" when trying to connect. Connecting via mobile hotspot works fine which rules out config issue. On the Smart Hub I have disabled IPv6 and confirmed the LAN range does NOT clash with the target VPN site. "Port Clamping" is set to on. The VPN is using IKEv2 IPSec. 

Hi,I would like to understand whether FortiClientVPNInstaller 7.4.3.4726 requires version 7.4.3.8758 to be installed in order to fix vulnerabilities.I’m using ManageEngine Patch Manager, and it says that I need to upgrade to version 7.4.3.8758. However, I cannot find this version anywhere.

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Since about 2-3 hours some Website are not loading anymore when deep inspection is applied. Just timeout or connection reset after some time.We are using different Fortigate Models and different Firmware (7.6.8 / 7.4.13).Seems to be a global issue according to Reddit: https://www.reddit.com/r/fortinet/comments/1xgnrb3/some_websites_not_loading_webfiltering_enabled/ Changing the Policies (Flow Mode) from Deep inspection to Cert-Only works.EDIT: Disabling the Antivirus profile works also. Deep inspection still enabled, just AV disabled.

I am experiencing an interference problem inside a room where we have set up one access point inside the room and another outside it.In total, I have 9 Fortinet access points spread across our offices on the 5th and 6th floors.However, for some time now, my desktop computers with integrated external PCI Wi-Fi cards operating at 2.4 GHz have been automatically disconnecting from the network and reconnecting immediately; often they lose the connection completely and then reconnect straight away. Thank you for your support. 

Anyone run into this scenario?fortiems client 7.4.7 can connect to dialup tunnel on Fortigate running 7.4.13, but fortiems client 7.4.8 cannot.7.4.8 can connect to other fortigates we have on 7.4.11 with no issues, but once upgraded to 7.4.13 it breaks. 

Hi all,after upgrading FortiManager to 7.6.8, all installs to our FortiGate-50G devices (FortiOS 7.6.7) fail. FortiManager pushes an attribute to the default profile “custom-deep-inspection” that the 50G does not support:config firewall ssl-ssh-profile edit "custom-deep-inspection" config https set udp-not-quic allow end config dot set udp-not-quic allow end nextend---> generating verification report(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" https:udp-not-quic) remote original: to be installed: allow(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" dot:udp-not-quic) remote original: to be installed: allow<--- done generating verification report------- Start to retry --------[same result]install failedTask status: “verify state: install OK/verify FAIL” → “install and save finished status=FAILED”. No changes are applied.Running the command manually on the 50G:set udp-not-quic allowcom

Hello Fortinet Community,I am managing FortiGate firewalls in a healthcare environment, and I am facing a recurring challenge during network security inspections.The inspectors identify online file-sharing websites that are accessible through our network, and this has resulted in failed inspections.Some examples of these websites are:onetimedrop.app online-clipboard.online heave.ggThese websites provide online file-sharing or file-transfer functionality. However, they are categorized by FortiGuard under Information Technology rather than File Sharing and Storage.Current FortiGate Security ConfigurationI have already implemented the following controls:Web Filter: File Sharing and Storage is blocked. DNS Filter: File Sharing and Storage is blocked. Application Control: Cloud IT and Storage Backup applications are blocked.Despite these controls, the websites mentioned above remain accessible because their FortiGuard classification does not match the category I am blocking.My QuestionsIs t