Support Forum

Hello,  My Firmware is 7.4.11 I managed to get SSO authentication working correctly via EntraID. The last thing I wanted to do was connect it to the FQDN and run it via my own SSL certificate. I have the certificate imported and it works correctly on the Fortigate login page. I can't get this certificate to work on the authentication port. The default certificate is still visible.FortiGate-60F # get vpn certificate local== [ Fortinet_Factory ]name: Fortinet_Factory   == [ Fortinet_Factory_Backup ]name: Fortinet_Factory_Backup   == [ Fortinet_CA_SSL ]name: Fortinet_CA_SSL   == [ Fortinet_CA_Untrusted ]name: Fortinet_CA_Untrusted   == [ Fortinet_SSL ]name: Fortinet_SSL   == [ Fortinet_GUI_Server ]name: Fortinet_GUI_Server   == [ Fortinet_SSL_RSA1024 ]name: Fortinet_SSL_RSA1024   == [ Fortinet_SSL_RSA2048 ]name: Fortinet_SSL_RSA2048   == [ Fortinet_SSL_RSA4096 ]name: Fortinet_SSL_RSA4096   == [ Fortinet_SSL_DSA1024 ]name: Fortinet_SSL_DSA1024   == [ Fortinet_SSL_DSA2048 ]name: Fortinet_SS

I create intune policy to push 802.1x wired configuration but after more than one week the policy not pushed any devices. Anyinw know why? 

Hello Fortinet Community,I would like to understand more about MFA implementation on FortiGate.When a customer purchases a FortiGate and the corresponding licenses, is any additional license required to enable MFA, or is MFA functionality already included?I would also appreciate clarification on the following points:What are the most common use cases for MFA in FortiGate environments? Is Active Directory integration required, or can MFA be deployed with local users as well? What authentication methods are typically used (FortiToken Mobile, email, third-party MFA, etc.)? Are there any limitations or best practices to consider when planning an MFA deployment?I am interested in hearing from community members who have already implemented MFA in production environments and can share their experience and recommendations.Thank you in advance for your insights.

I'm using a FortiGate device, but I can't make calls to others via Zalo. I can still send messages, upload files, and others can call me via Zalo. I've checked the logs and debugged, and everything seems to be allowed; there are no logs of rejected or blocked calls.The behavior: When I try to call someone, the call disconnects immediately.Can you give me some advice on this issue?

I have a Fortinet 101F firewall setup with VPN IPsec running. I have a FortiVoice 101, and I want to setup Fortiphone Softphone through the VPN. The Fortiphone Softphone runs fine with the LAN network, but when I try logging in through the VPN. I need some guidance to get it implemented please.

I am working on establishing vpn from android device using forticlient app with no avail. However, everything works fine with windows 11 machine.  Forticlient app version : 7.4.3VPN type : IKEV2 (EAP-MSCHAPv2 with Certificate as authmethod) Android Device: Honor MagicOS 8 (Android version 14) From the forticlient android, the error immediately shows "IKE authentication failed" where in fortigate debug last log says sent IKE msg (AUTH_RESPONSE). Appreciated any help on this, thanks

Hello everyone,I'm deploying 2 VPN configs in EMS to a group of devices, users have no control over Forticlient, I want to force connection to both VPNs automatically once connected to the network.It seems that only one VPN can connect automatically, while the user has to click on connect for the second VPN to come UP. Already enabled Multi VPN Auto connect option in Forticlient EMS but it has no effect (both VPNs are IKE v2)We are using Forticlient EMS 7.4.5 Any idea ? 

Hi All,Has anyone noticed issues with IPSec site to site tunnels on 7.4.9?We have one vendor who has been working fine before we upgraded a couple weeks back to version 7.4.9 in our Azure FG. Oddly enough our one firewall in HQ location which still is on 7.2.12 works fine.When comparing the 2 tunnels from Azure FG and HQ FG doing pings to the vendor I noticed the HQ doesn't lose pings at all. Whereas the one in Azure will intermittently lose the pings and then come back on its own.VPN settings for both FGs are the same along with vendor side.Has anyone run into this so far? Any workarounds?Happy Holidays All!

good morning everyone, i have a fortinet 60F. unfortunately, a junior member did the upgrade from 6.4 to 7.15. when i try to log in console to fix it, i get this:▒▒▒▒▒▒▒▒ђ▒▒▒▒ѥ▒▒▒ɩ▒͕▒ѥ▒▒▒ɩ▒▒▒ѥ▒ѕ▒▒▒▒Ҫ▒▒▒▒▒▒▒▒▒▒▒ɂ▒▒▒▒▒▒▒▒▒ɥ▒▒յ▒▒▒ԕ▒▒ʥ▒▒▒▒▒▒х▒(▒ѥ▒▒▒饹▒▒▒ѕ٥▒▒▒▒a▒ѥ▒▒▒饹▒s▒L▒᱕▒͕▒▒▒▒▒ɢ▒▒▒▒ɂɕ▒͹▒墽▒▒▒▒▒˙▒▒▒Ʌѥ▒▒▒▒▒▒▒▒▒▒▒▒ѥ▒▒▒ɩ▒ʥѥ▒▒▒饹▒▒ɕ݅▒▒▒ɩ▒failed verification on /data/datafs.tar.gzfos_ima: System Integrity check failed....CPU5: stoppingCPU6: stoppingCPU1: stoppingCPU3: stoppingCPU7: stoppingCPU0: stoppingCPU2: stopping sadly, it keeps repeating this message and it doesnt let me type commands. any advice? i tried changing the speed and flow control of my console cable with no better result than this one. my current best settings are:speed 9600 - 8n1, no flow controls

Hi,according to this article: webpages blocked by DNS-Profile should be redirected to FortiGate DNS block IP 208.91.112.55 and display a warning like this:However in my config when I enter to category blocked on the DNS-Profile like “Games” then I have red certificate warning, the certificate isissued by Fortiguard SDNS Blocked Page:every clients PC have imported Fortigate_CA_SSL certificate in Trusted Root Certification Authorities store.How to restore this blocked page when webpage is blocked by DNS-profile?

I have a question, for NSE4 please.wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. Therequirement is that FortiGate sends DPD probes only when there is no inbound traffic.Which DPD mode on FortiGate meets this requirement?A. EnabledB. On IdleC. DisabledD. On Demand    

Does FortiNAC 7.4.3 support Fortigate 8.0.0

I try to push 802.1x profile for wired connection from intune with below configuration but the profile not yet pushed even after more than 3 days.Anyonw know why?and for the client authentication should i choose PKCS or SCEP? 

We are planning to migrate from SSL VPN to IPsec VPN using certificate-based (signature-only) authentication.Since the VPN will be used by both employees and contractors, we need to implement group-based policy controls similar to what we currently have with SSL VPN.I have configured the user peer with ldap-mode principal-name, which maps the certificate UPN to the LDAP user. This part is working as expected (if user is disabled, it won’t allow log in).However, I have not been able to get LDAP group-based matching working in firewall policies.I have 7.2.12 version at the moment, maybe newer version has this fixed?

Hi,is any way to configure failed user login notification for dialup ipsec connection?For the ssl vpn failed login there is dedicated trigger name “SSL VPN login fail, ID 39426” and this is working fine, but I don’t have any similar for dialup Ipsec.This notification should only notify about wrong user password entered no matter is it authenticated using remote radius or this is local account on fortigate.I'm not interested in a log that reports the status of the phase1 as “failure,” because I have many other site-to-site IPsec tunnels, and that would cause confusion.Thanks. 

How to implement of DNS and IP Address blocking in FortiGate?

Hello everyone,I'm working on a FortiGate device and need assistance with enabling communication between two interfaces on the same firewall. Here’s the network setup:Interface 1: Connected to the 192.168.1.0/24 network.Interface 2: Connected to the 172.16.0.0/24 network.Interface 2 also has an Access Point from Unifi connected to it, and I need this AP to communicate with the 192.168.1.0/24 network for remote management.I have already:Created firewall policies to allow traffic between the two networks. Both inbound and outbound rules are set to allow the communication.Set up static routes for both networks to ensure the traffic is routed correctly between the two interfaces:For the 192.168.1.0/24 network, I configured a route with gateway 192.168.1.1 and the interface set to Interface 2 (the one connected to the 172.16.0.0/24 network).For the 172.16.0.0/24 network, I configured the inverse: gateway 172.16.0.1 and the interface set to Interface 1.I also tested other variations, includi

Hii have fortigate 60f and fortiap 231k ios on fortigate 7.6.6i faced problem  on ssid tunnel just lost connection and browsing   But have ip on ios such as 7.4.11 no problem just 7.6.6thanks

Hi guys,Recently, i came across a technique called underminr which is a technique involved after domain fronting have been largely mitigated by several CDN provider. Reference - ADAMnetworks’ Research Uncovers Vulnerability in Internet Infrastructure, Affecting 88 Million Domains | MorningstarTLDR of the technique is as follows; exploiting the gap between the layers of a connection where different names live:DNS lookup / TLS SNI — uses an allowlisted front domain (e.g. a legitimate domain on a big CDN). This is typically what DNS filtering, proxy allowlists, and SNI-based inspection see and approve. HTTP Host header (inside the encrypted tunnel) — once TLS is established, the request is actually routed to a different backend on the same shared infrastructure — the attacker's real C2 endpointAnd the detection seems to require checking the DNS query and ensuring the thereafter TLS host header in the same session is the same as the DNS query which i believe FPX by right should have the ab

Hi,  Does anyone experience based on this article?https://community.fortinet.com/t5/FortiGate/Technical-Tip-Understanding-the-log-message-User-shutdown-the/ta-p/301290 Scope is for 7.2.5 and above. The current version is 7.0.12 May I know if this is false positive?  Thanks!

Hello,I am trying to assign a FortiToken Mobile to a local user via REST API on FortiOS v7.4.11 and getting error -651 "FortiToken is invalid".Environment:- FortiOS version: 7.4.11- Multiple VDOMs configured- Users are in VDOM "PO"- API admin profile scope: Global- API admin has User & Device: Read/WriteImportant note:We do not have direct access to the FortiGate GUI – only the customer does. Therefore we can only work via REST API and cannot verify the exact request that GUI sends when assigning a token.What works:- GET monitor/user/fortitoken?status=available → returns available tokens- GET cmdb/user/fortitoken/{serial} → works WITHOUT vdom parameter (root context)- GET cmdb/user/fortitoken?vdom=PO → returns empty / token not found- PUT cmdb/user/local/{login}?vdom=PO with two-factor: email → works fineWhat fails:- PUT cmdb/user/local/{login}?vdom=PO with fortitoken serial → error -651- PUT cmdb/user/local/{login} without vdom → HTTP 404 user not foundThe token exists in CMDB, st

Hi all, I am installing FortiNAC in a large environment and I added the Aruba WLC to FortiNAC without any issues. 3 days later, FortiNAC performed L2 pooling and discovered over 400,000 rogue hosts. After that, I disabled L2 pooling for the WLC, which stopped it from discovering.I use FortiNAC version 7.6.6 and have increased the VM to 16 CPUs and 32 GB of RAM.After that, I set the aging period to 1 day for the rogue hosts, but it did not work. I found this command, but it returned an error;> execute enter-shell# client -rog -op delete errorDuring this time, the FortiNAC RAM usage was at 92%, and the server was extremely slow.I could not find a way to get rid of these rogue hosts. While I was working, it did not affect the appliance, but when I configured PA for endpoint compliance checks, it did. While testing, I saw that many hosts were at risk, so I tried to mark them all as safe, but FortiNAC got stuck, so we had to restart the appliance.After that, I listed all the risky hosts

When using ipsec-vpn user IKEv1 dial-up VPN. Did all things still same issue also change wan interface still same issue. attached picture of the error. urgent support needed. forticlient version 7.4.3.4726    

Hello,I would like to know if FortiClient EMS allows SQL queries using Windows authentication.I have created the policy to grant the endpoints the necessary access, but when a user logs in through the EMS administration interface, they receive the following error: If you've experienced something similar or encountered this same error, I would appreciate your help.Thank you very much.

Have a project to convert Meraki APs and Switches to FortiAP FAP-431F and 432F and FortiSwitch 100 managed by FortiEdge Cloud. Discovered Meraki have some filtering features like Wireless L7 rules and Content Filtering. Are these supported on the FortiLAN Cloud side? If so where will these filtering be happening? Does it require tunneling the traffic to the cloud? Thanks for the answer in advance!