Support Forum

Good day,Trying to install fortigate on ProxMox but unable to do so. I followed the install guide but when the VM is started it gets stuck on formatting disk screen. any help would be great.  

Hi, do you know if ther is a fortigate config that allows creating two VPN tunnels to the same peer id but one being IKEv1 and the other tunnel IKEv2 with differents hosts in phase 2? Without showing you the error on the remote gateway "Duplicate entry found"

How do I Configure server to reject HTTP/1.0 requests with "505 HTTP Version Not Supported" status and enforce minimum HTTP/1.1 protocol version?  I am using Fortigate 60f and I need to make necessary changes so that my Merchant Service PCI Compliance passes.  This is the last setup that I need and would like to make the fix with GUI, not CLI.  Any help would be great appreciated.

Hello,We are using a FortiGate device integrated with a Kubernetes Connector. The system was working properly on FortiOS 7.2.12, but after upgrading to 7.4.11, we started experiencing the following issues:SDN Connector errors The following errors are observed in the GUI: Invalid SDN filter: K8S label node.kubernetes.io/exclude-from-external-load-balancers Invalid SDN filter: K8S label node-role.kubernetes.io/control-planeWe are experiencing 504 Gateway Timeout errors on outbound traffic to servers running behind Kubernetes. Based on checks performed on the Kubernetes side: There is a noticeable latency/performance degradation in the environment However, after downgrading back to FortiOS 7.2.12, these issues are no longer observed. Therefore, we suspect that the 504 errors and performance degradation are related to FortiOS 7.4.11.Rollback result After downgrading back to 7.2.12: All issues are resolved Kubernetes services are reachable again SDN connector errors disappear.Additionally;D

Hey everyone,We’re getting ready to deploy a new site and I’m looking for some guidance on choosing the right FortiGate model.Environment details:~300 users8 FortiSwitches over FortiLinkPlanning to enable SSL Deep InspectionUsing full security profiles (IPS, AV, App Control, Web Filter, etc.)Average traffic mix: Office 365, web browsing, VPN, internal appsAverage of 25,000–30,000 concurrent sessionsI know deep inspection significantly reduces throughput, so I want to size the appliance properly to avoid bottlenecks once everything goes live.For anyone who has deployed FortiGate models in similar environments, which model would you recommend?Any real‑world performance insights or warnings are also appreciated!Thanks!

I started the upgrade from EMS 7.4.5 to EMS 7.4.6 and am now stuck for more than 24 hours in 50% loop.  And I am getting emails almost every 20 minutes, that the upgrade is scheduled. EMS is scheduled to be upgrade on 2026-March-23 06:01 (EMS server time). The current version 7.4.5.2111 will be upgrade to version 7.4.6.2170 (M). Any ideas how to exit the loop? 

Hello, We have 3 Management IPs configured for a Fortigate device. Only one is polling on Solarwinds, 2 are failing with SNMP. MGMT-01 is .227 and MGMT-02 is .226  Here are the trace results (omitted and edited some characters): id=65308 trace_id=21 func=print_pkt_detail line=5811 msg="vd-root:0 received a packet(proto=17, 10.x.x.88:62985->10.x.x.227:161) tun_id=10.0.0.2 from MGMT-02. "id=65308 trace_id=21 func=init_ip_session_common line=5995 msg="allocate a new session-08f7faa3"id=65308 trace_id=21 func=iprope_dnat_check line=5276 msg="in-[MGMT-02], out-[]"id=65308 trace_id=21 func=iprope_dnat_tree_check line=834 msg="len=0"id=65308 trace_id=21 func=iprope_dnat_check line=5288 msg="result: skb_flags-02000008, vid-0, ret-no-match, act-accept, flag-00000000"id=65308 trace_id=21 func=vf_ip_route_input_common line=2611 msg="find a route: flag=80000000 gw-10.x.x.227 via root"id=65308 trace_id=21 func=iprope_access_proxy_check line=439 msg="in-[MGMT-02], out-[],

I am using MDaemon as my Email host behind fortigate 100f. I am able to connect to my mdaemon server using webmail as well as outlook desktop however facing issues with outlook android. I am able to sync imap emails but unable to send email from outlook android. all recommended ports are open and accessible from outside. what could be the reason fortigate blocking outlook android traffic and how can I solve this step by step. urgent response will be appreciated. (Note: All ports are open, SSL configured and working, webmail and outlook desktop working fine even adding accounts in Gmail is working fine).Only outlook android not sending mail say "error sending mail please try again"

Hello, I am having difficulty to understanding how the captive portal works with LDAP authentication with FortiNAC, as I could not find any clear documentation for this.Could anyone help me understand the workflow and the steps involved in user authentication using LDAP?So far, I have completed the following steps, but it is not working:Configured LDAP integration — it appears to be workingChanged the standard user login method to LDAP.I am not sure if there are any additional steps required. later testing I was able to resolve the issue with help from the community.What I did:I initially added LDAP to FortiNAC and configured the standard user login type to use LDAP. However, that alone was not sufficient. Winbind is also required—without it, the setup does not function properly.Key Notes:Ensure FortiNAC is added as a computer object in Active Directory.If you are using an LDAP group for GUI administrator access, delete and recreate the LDAP user group with administrator priv

I have installed FortiClient EMS version 7.4.4 (trial). I deployed this instance as a VM. I am trying to perform an automatic upgrade from the GUI to version 7.4.6. Unfortunately, it keeps showing an update error. In the logs, I see errors and warnings:Err:5 https://dl.winehq.org/wine-builds/ubuntu jammy InReleaseThe following signatures couldn't be verified because the public key is not available: NO_PUBKEY 76F1A20FF987672FWARNING: apt does not have a stable CLI interface. Use with caution in scripts.E: Conflicting values set for option Signed-By regarding source https://apt.postgresql.org/pub/repos/apt/ noble-pgdg: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc != /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpgE: The list of sources could not be read.Warning: The unit file, source configuration file or drop-ins of redis.service changed on disk. Run 'systemctl daemon-reload' to reload units.___________Please help me resolve this issue.

Dear Team,One of our customer upgraded the FortiClient version from 7.4.3 to 7.4.5 which is managed by EMS.After that most of the users facing to connect the VPN.By default, the FortiClient installer contains 9 VPN URLs or Gateway defined in EMS.When the user tried to connect any of the VPN gateway by clicking 'connect' button it does not react anything.For some users, the issue resolved by reinstalling the FortiClient, Re-register the zero trust telemetry with invitation code, restarting the laptop and connecting to different Wifi or network.For few users, did not helped any of the above workaround.From the user machine we collected the FortiClient log and found below logs.Could any one help with below logs to sort out the issue.sslvpndaemon_1.log[2026-04-07 08:36:49.9130356 UTC+02:00] [10616:6788] [sslvpndaemon 285 debug] TunnelInitiator::StartConnection() called.[2026-04-07 08:36:49.9134374 UTC+02:00] [10616:6788] [sslvpndaemon 287 debug] TunnelInitiator::StartConnection() tunnel: &

I am automatically updating FortiClient for Windows from version 7.4.5 to 7.4.6. On about 50% of the test computers, the installation process stops at: “Stop services.” I also tried doing it manually by running the installer file, but in that case it also gets stuck at “Stop services.” How can I work around this issue?I have updated versions 7.0.x and 7.2.x many times before and never had this problem. Now I’m updating to version 7.4.x for the first time. Has anyone had a similar issue?   

HiIm trying to connect two core switches to out Fortigates that running in HAThe Fortigates have been running for 3 years together with some old Alcatel Lucent switches, and now I want to upgrade to FortiSwitchThis is my setup.  Best RegardsThomas

I work for a school that is requesting us to block the Fornite game from being played. However it appears using the Web Filter and reclassifying the Epicgames.com URL only solves users from browsing to that website. I am trying to block the Fortnite game from connecting to the EpicGames servers, It appears they use Amazon Web services which seems to be tricky when blocking applications. I do see that Fortinet has Epic.Games listed as an Application finally. I have blocked this under application control, now half of the students that try to play cant and the other half still can. I'm new to this stuff so this has been a fun experience. Any one have any luck blocking this? If so what did you do to achieve this? 

Hello, I am trying to convert incoming port 22 to 2222 with a VIP rule. However I want to keep the same external and internal IP address. The VIP will not accept this.Is there any way to only convert incoming ports with the same address ?

Hi everyone,I’m currently trying to connect to an older FortiGate device (FortiOS 5.4), so I need to use an older version of FortiClient (6.0 or 6.2).Since the device is EOL, I’m unable to download the installer from the official Fortinet support portal. I managed to get the 6.2 online installer, but it fails during installation with errors related to an invalid digital signature and MSI error code 2711.Would anyone be able to share a FortiClient VPN 6.0 or 6.2 offline installer (full package) or point me to a reliable source?I would really appreciate your help.Thanks in advance!

How do i find the status of All VPNs in FortiAnalyzer ?

Hello Fortinet Community, I would like to inquire whether it is possible to implement a VPN chaining (nested VPN) scenario using FortiClient. Use case:We have a requirement where access to a client VPN is restricted to a specific public IP address (e.g., 193.40.X.X). When connecting from our office network, we are able to access the client VPN successfully because our traffic originates from this whitelisted IP. However, we would like to achieve the following setup: Connect from a remote location (home) to our office VPN using FortiClient.Once connected, establish a second VPN connection (also via FortiClient) to the client environment.Ensure that the second VPN connection is seen as originating from the office public IP (193.40.X.X). Questions: Does FortiClient support running multiple VPN tunnels simultaneously (VPN over VPN / nested VPN)?Are there any supported configurations or best practices to achieve this setup?Are there specific requirements (e.g.,

Hello all. Looking for anybody who has run into this issue and may be able to provide guidance.We have a pair of FGT 70Gs running 7.4.9 connected to a stack of 148F FSWs running 7.2.5. This is our standard stack and we run it at dozens of sites.We have NAC enabled via the built in managed FSW setting (not FortiNAC). We add devices via NAC policies individually and via wildcard filters such as Vendor name and device type (Example: IP Phone). Our switchports are configured in NAC mode and based on the device that plugs in, the dynamic VLAN will assign to what's configured in the NAC policy.Anywhere from a couple to a few times a day, users with devices plugged into these NAC-mode switchports say their devices are doing network hard down, and then coming back up moments to minutes later. I checked logs and am seeing that the entire NAC MAC address cache appears to be deleted out and then added back, all at once but separated by short periods of time. This aligns exactly with when the issu

When using the ACME client in FortiWeb v8, does it automatically re-use the same private/public key for renewals? or does it issue a new key on each renewal? 

In FortiAnalyzer, I have one ADOM with 200 firewalls and another ADOM with 5 firewalls, but on all the firewalls regardless of the ADOM, I can't see the logs in security events > WebFilter, for example, only from memory.Also, in FortiAnalyzer, in FortiView the tabs Traffic, Shadow IT, Applications and Websites, VPN, and System are grayed out, making it impossible to select them.Could this be a license issue or some configuration parameter?

I have just acquired a fg60e, i realise it's end of life but i plan on using it just for learning firewalls, vlans etc so don't need full licence for extras, i plan on doing cisco & fortinet free courses to understand more about networking & security.Tonight i have got it setup & connected to the internet & noticed it's running fw v 6.0.3, i realise it's old but in your opinions would this be adequate for learning the basics of fortinet OS or can you suggest a more up to date stable fw version.

I have just acquired a fg60e, i realise it's end of life but i plan on using it just for learning firewalls, vlans etc so don't need full licence for extras, i plan on doing cisco & fortinet free courses to understand more about networking & security.Tonight i have got it setup & connected to the internet & noticed it's running fw v 6.0.3, i realise it's old but in your opinions would this be adequate for learning the basics of fortinet OS or can you suggest a more up to date stable fw version.

HelloWe are using a FortiWeb cluster as a VM for our customer. The backend servers of our customer's customers are gradually being migrated to this FortiWeb cluster from a Sophos UTM 9. We also operate the Sophos UTM 9. The first backend servers are already running on the FortiWeb VM and access is successful. The challenge now is to migrate the backend servers that use SSO login via KeyCloak with Azure to the FortiWeb cluster. We have configured a test backend server for this purpose. Our customer  has configured KeyCloak (plain vanilla without any special configuartions) on his environment. We have configured the Azure parameters on our side in Azure. When accessing the test backend server via Sophos UTM 9, everything works without any problems. When accessing via FortiWeb,  I can authenticate and then it's pending. After round about 20 seconds comes '404 Not Found'. What did we overlook or configure incorrectly in the FortiWeb cluster configuration?Thank you in advance for

We have just migrated to FortiClient EMS 7.4.5 LinuxVM from FortiClient 7.2.12 WindowsVM. In that process we are trying to move from Active Directory to Microsoft Entra for controlling Manage Deployments. While deployments are working fine from the Active Directory side, the issue we are seeing is that Windows devices from the Entra side are not and showing "Unsupported Operating System"All these devices are Windows and have been onboard from Intune and as this is a hybrid environment. The same device works fine on the Active Directory side.I am sure I am missing something, but I have been through it a few times and I can see nothing wrong from the setup documents.Anyone have any idea what I am missing?