Support Forum

Initially, I attempted to upgrade the firmware from 7.0.15 to 7.2, but the process failed. Following this failure, I tried to roll back to version 7.0.15; however, the console is now stuck on "duplicate action=find-dup," and I am unable to perform a hard reset on the FortiGate unit. What should I do? Please help. 

Subject: FortiLink Through Standalone FortiSwitches in an MCLAG DesignHello Fortinet Community,I would like to get your advice on a planned network design involving FortiGate, standalone FortiSwitches, managed FortiSwitches, and FortiAPs.Proposed Network Topology          FortiGate                 | Standalone FortiSwitches      (MCLAG Peer Pair)                 | Managed FortiSwitches                 |           FortiAPs In this design, the FortiSwitches directly connected to the FortiGate will operate in standalone mode as an MCLAG peer pair. The downstream FortiSwitches will be managed by the FortiGate through FortiLink, and the FortiAPs will connect to the managed FortiSwitches.I would appreciate your advice on the following questions:Design feasibility: Is this topology supported by Fortinet, particularly when using standalone FortiSwitches as an intermediate layer between the FortiGate and the managed FortiSwitches? FortiLink connectivity: Can the FortiGate discover, authorize, a

My internet speed drops significantly when using SSL or IPsec VPNs. There are no speed limits or other restrictions in place; the speed simply started to decline—dropping from 300 Mbps to 50 Mbps. I haven’t performed any updates; the slowdown just began toward the end of August. The device model is a FortiGate 201G.

Backstory:We're a small MSP that has a client with existing Fortinet equipment, which means they use FortiClient VPN, we also use Pulseway to do 3rd party patching with a delay to make software update a few weeks after new patches.This Monday, April 14th, we got reports of pre-boot BSOD, specifically PAGE_FAULT_IN_NONPAGED_AREA and some driver related ones but in all cases the "what failed" was fortitransctrl_74.sys in c:\windows\system32\driversThe most annoying part is you couldn't boot in safe mode, no matter what you tried it would always BSOD before the advanced start menu would appear.To fix the issue we used Windows ToGo usb and renamed the misbehaving driver, computer would boot back up no problem.The other weirdest part is it only happened to computers with intel 10th gen (10500T/10210U/10505), the OS breakdown was 5 Windows 11 and 2 Windows 10 but all windows 11 were not fresh installs but upgraded from Windows 10. This is with a client that has ~100 computers operating on av

Installing 7.4.0.1658 on two different Windows 11 (Dell Vostro and Dell Inspiron) Laptops.  Both laptops were Wiped and Prepped with the same Windows 11 23H2 Pro OS and are set up using very basic Intune Profiles (Intune barely does anything). The VPN Client, when launched, only goes as far as "Connecting".  It never times out and appears as if its stuck.   Are there any Windows Settings I should be looking at which would impact the clients ability to establish a connection?  Logs dont appear to show anything indicating the VPN is even attempting to connect.

When we migrate from SSL VPN to IPsec VPN, we currently use different firewall policies based on user groups to separate access for each vendor. In that case, would the firewall policies be configured as follows?config firewall policy    edit 1        set name "vendor1"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER1"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor1"    nextedit 2        set name "vendor2"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER2"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor2"    nextend But if we use IPsec VPN, do we need to create

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

Hi,i had an working PPPoE IPv6 internet connection but now i noticed that this isn’t working. I don’t getting an IP address.I can’t say sice when and after what change this happen, perhaps it can also be an probem on the providers side.This is the WAN Interface config:config system interface edit "FTTH" set vdom "root" set mode pppoe set allowaccess ping set type redundant set member "port15" set lldp-reception disable set estimated-upstream-bandwidth 1000000 set estimated-downstream-bandwidth 1000000 set monitor-bandwidth enable set role wan set snmp-index 22 config ipv6 set ip6-mode pppoe set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 53 set prefix-hint xxxx:xxxx:0:200::/56 next end end set username user

Hello everyone,I’m glad to be part of the Fortinet Community. As a new member, I look forward to learning from experienced professionals, exchanging ideas, and participating in discussions about cybersecurity, network security, and IT infrastructure.I’m interested in learning more about Fortinet solutions, exploring security best practices, and understanding how other professionals approach network protection and troubleshoot security-related challenges. I believe that sharing knowledge and practical experiences can help everyone strengthen their skills and improve their understanding of cybersecurity.I’ll do my best to follow the community guidelines, respect other members’ perspectives, and contribute helpful and relevant information to discussions.Thank you, and I look forward to connecting with everyone and learning from this community!

Hello,I am trying to activate the FortiGate-VM permanent trial (FortiOS 7.2.1+ model) on a lab VM, and the license request always fails.EnvironmentFortiGate-VM64-KVM v7.4.13 (build 2933) and v7.6.8 (build 3744), both downloaded from Support > Download > VM Images (FortiGate, KVM; FGT_ image, not FFW_). Running under QEMU/KVM inside a container (Containerlab/vrnetlab) in WSL2, with 1 vCPU and 2 GB RAM, so inside the trial limits. get system status shows "License Status: Invalid", "VM Resources: 1 CPU/1 allowed".What I doexecute vm-license-options account-id <my FortiCloud e-mail>execute vm-license-options account-password <password>execute vm-licenseResult"Requesting FortiCare Trial license, proxy:(null)" followed by "Failed to download VM license." No error code is displayed. The web GUI trial activation also fails ("Error downloading license: Invalid serial number" on one attempt).What I have verifiedDNS works (public resolvers 8.8.8.8 / 1.1.1.1; earlier "dns resolve

We are currently in the process of switching over to the FortiClient VPN (v7.0.0.0029) from the DrayTek Smart VPN Client and I notice that all of my traffic is now being piped through the VPN, instead of just the traffic that requires it. Our FortiClient is set up to use IPsec VPN. The DrayTek VPN has a setting named Use default gateway on remote network and I always have this switched off.  I'm trying to find a similar setting in the FortiClient VPN. Sorry.  I'm not overly familiar with all the network jargon, so please forgive me for that.  I see a bunch of settings under Advance Settings, but nothing that appears equivalent to the DrayTek setting. Thank you in advance for any assistance provided.

On the fortigate log result there is data transfer, example the 1st row have 598.2 MB / 85.64 MB and 2nd row 598.18 MB  / 85.63 MB.How we can read that? Is my under standing below is correct?598.2M B is data transfer from 12:41:07 - 12:43:10? and598.18 MB is data transfer from 12:38:57 - 12:41:07?  

Hello Everyone, I would like to test my knowledge in NSE 4 - 7 via the use of past exam papers. Is there a repository I can connect to? 

Hi All,I'm looking for guidance and best practices for implementing a resilient Layer 2 access network using a ring topology.Hardware Under ConsiderationFortiGate 121G (Firewall) FortiSwitch FS-1024E (Core/Distribution) FortiSwitch FS-224E (Access) FortiSwitch Rugged FSR-112F-POE (Rugged Access)Design ConsiderationsThe current access-layer design consists of up to five rings, with each ring supporting 15 hops in a dual-ring architecture (up to 30 switches per dual ring).End devices (1 NIC 2 IP ports) will be connecting to two separate access switches for redundancy. The expectation is that RSTP will provide both:Ring redundancy within the access network Redundancy for dual-homed endpoint connectionsThe attached diagram provides a high-level representation of the proposed architecture.Challenges RSTP convergence time RSTP convergence may be too slow for the application. The target recovery/convergence time is less than 1 second following a link or switch failure. MRP/PRP limitations

Hey everyone,We currently have a couple of FortiGate VM appliances running FortiOS 7.2.13 and are using FortiClient SSL VPN tunnel mode for client remote access.I understand Fortinet is sunsetting SSL VPN tunnel mode in FortiOS 7.6.3. the business is not ready to pivot off SSL VPN so in the meantime, they want to know whether upgrading to FortiOS 7.4.x is a reasonable short-term bridge (Fortinet’s lifecycl page says says it’ll be supported until March 31, 2028/November 11, 2028). Questions:1. For those who have upgraded, has FortiOS 7.4.x been stable for production SSL VPN tunnel mode?2. Is SSL VPN tunnel mode supported throughout the 7.4.x branch, including later releases such as 7.4.8 or newer, or is there a specific 7.4.x version we should target/avoid?3. Since SSL VPN is hidden from the GUI by default in 7.4, is it still considered fully supported in 7.4.x, or is it more of a transitional feature?4. Can I upgrade directly from 7.2.13 to a 7.4.x release, or should I follow a specifi

Hello Fortinet Team, Could you please change my community nickname to Gohan? If it is already used, you can change to GohanC or GohanFC. Thanks in advanced.

I stepped away from Fortinet for a while and am coming back to find that there still seems to be no real solution to connecting the internal switch ports and external (FortiSwitch) switch ports on the same VLAN.  You'd think that once you setup FortiLink, attach a FortiSwitch, and start making FortiSwitch VLANs that those VLAN interfaces would be available to add to either a software switch or hardware (vlan) switch. It doesn't seem that is the case though... Instead, it seems the only way to share traffic between internal ports and external ports is to PHYSICALLY connect between them? Is this really the best (only?) solution:Create virtual VLAN switch with VLAN ID of zero on Fortigate.Add all the ports you are going to use as membersCreate sub-interfaces for each VLAN ID that you are using on the networkDesignate a physical port on the firewall as the trunkCreate a trunk port on the switch controller for the FortiSwitchesPhysically connect the internal (fw) switch trunk

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

We have Fortigate FW running on FortiOS 7.4.12M and FortiAnalyzer on 7.4.11.Are these affected by the PHP2Shell remote code execution vulnerabilities ??

i access FortiAP 231F through https with its ip managment but i can’t find options to configure ssids and make it in bridge mode but i can’t configure it ?how is it possible to do this? 

Just wanted to see with anyone running FMG 7.6.8 if their monitor screens (SD-wan, vpn monitor or asset identity center) are taking longer than usual to refresh/populate. It seems that mine takes ~1min for the asset identity center page to load.Just checking before I open a support case.

Since last week we experiencing a lot of problems with Windows updates (mostly Windows 11, but there was one Windows 10 among them as well), specifically KB5040442. On about 10% of our Windows clients the update would start and go until 96% and stay there for 10-60 minutes, and then after a restart Windows would tell us that something did go wrong and it would reverse the update. This would require multiple restarts and anything in the order of 2-10h. The usual information sources did not reveal anything unusual with this update round, so it had to be some uncommon conditions here. When Windows was back online, it would sometimes (!) show an error code 0x800f0922, oftenly nothing, and on next restart it would try to install it again (and our employees losing again 4-10h with a working computer). First remedy, as described in the error code was to increase the size of the recovery partition to at least 250MB, but that helped only on one computer. No other things related to the code

Has Fortinet issued any advisory regarding the recent PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619? Are any Fortinet products affected?

Hi all,I noticed a discrepancy between the PSIRT advisory FG-IR-26-182 and the CVE record for CVE-2026-106175 (published by Fortinet as CNA).The CVE record's "affected" section (also reflected in NVD, currently "Awaiting Analysis") lists:- FortiPAM 1.0.0 through 1.8.4- FortiSASE 25.4.c- FortiOS 7.0.0 through 7.0.19- FortiProxy 7.0.0 through 7.0.23However, none of these appear in the advisory table, the CVE description, or the CVE "solutions" field. The advisory only covers FortiOS / FortiProxy / FortiSwitch 7.2, 7.4, 7.6 (and 8.0 as not affected).In previous advisories (e.g. FG-IR-25-545, FG-IR-24-325), FortiPAM and FortiSASE were listed explicitly with their own affected versions and fixes, so this looks unusual.Questions:1. Are FortiPAM and FortiSASE actually affected by this vulnerability?2. If FortiPAM is affected, is a fixed version planned?3. Are FortiOS 7.0 / FortiProxy 7.0 affected, and is the omission from the advisory intentional (e.g. out of support)?4. FortiOS 7.6.8 is not

Hi, I do have HA Active Passive FortiGate - Active and Running. Recently, I added a new FortiManager. Kindly guide how I can add FortiGate as an HA to FortiManager. There is an option on FortiManager to add an HA Cluster. But that means that this is for a new deployment, and now I'm in production. I followed the normal way to add a node from FortiManager - Add Primary IP - Then I noted that the Secondary became out of sync. Kindly guide me to the correct way.