Support Forum

I have a firewall that has a few VLANs and physical interfaces that I have turned on the Multiple interface feature and creating those subsequent policies. Working through some oddities (or maybe I just have not dug deep enough into) that seem to choosing a “catch-all” at the bottom of my list before it processes the policy above it that’s specific to the traffic. Like said, still digging some into this. Just wanted to get some feedback on how or if people like this feature, caveats I might want to watch for, etc…  Thanks. 

I am new to FortiGate, i am trying to setup evaluation license on a VM for training purpose, im facing a problem in accessing the GUI, i have registered the license once and it was working good and then it did not work on the next day , i have reinstalled the VM and deleted the license from my fortiCloud account, after that i always receive this message when i try to register the license “Error in downloading license : Invalid serial number “   i’ve tried to register it manually on forticloud but not worked, any advise ? 

• FSSO- upgrade to 5.0.0330. whats the steps 

Fairly new to Forti and deployed a range of 50G models at branch sites 5-10 users and HA pair of 70Gs at HQ which has been fine however, have an on going VOIP issue and looking for some guidance.-Telephony platform is cloud hosted-Disabled SIP ALG-No VOIP profile applied to access rulesIssues raised:-Calls dropping-Audio being lost during calls-Poor call quality

both site with redundant WAN , i got it how to do , but with singel wan on 1 side i am in doubt, please advice? 

I’m using Forticlient 7.2.14 with EMS Cloud 7.4.5. All of a sudden some users are reporting that they cannon’t connect to anything (Web or corporate VPN). After investigation we found that the application firewall in our EMS profile is blocking DNS for some clients even though this same profile is working for others on the same hardware/forticlient versions. This happens off fabric and prevents even connection to EMS so users cannot then connect to the fabric (VPN). Our only path to fix was to disconnect from EMS (with password), disable the application firewall in the EMS profile and reconnect with an invitaion code. All works thereafter. What might cause this given nothing has changed in our configuration other than EMS cloud auto-updating to 7.4.5 in early April? 

Using Forticlient EMS Cloud 7.4 and Forticlient 7.2.8. We using an IPSEC remote access profile but need to split-tunnel MS teams audio/video/sharing traffic but no all MS teams traffic (chat etc.). As such we have excluded the cloud application (as defined by Forticlient EMS remote access profile application based split-tunnel) Microsft-teams.Published.Worldwide.Optimized.  Checking in our Foritgate ISDB view we see this object contains the IP ranges for MS teams optimize traffic listed here Microsoft 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn:  IDCategoryERAddressesPorts11OptimizeRequiredYes52.112.0.0/14, 52.122.0.0/15, 2603:1063::/38UDP: 3478, 3479, 3480, 3481 Now one some machines this generally works and on others is doesn't and this traffic is sent down our VPN. On inspection of the machine we see there is no route for the specific endpoint MS teams is using for the UDP audio stream in the ranges 52.112.0.0/1

I tried to get a copy of the macOS offline installer for the Forticlient (VPN only), but the last post leads to a dead link.

Hi,We deploy the FortiClient VPN Only app using the MSI installer, which the FortiClient Online Installer exe (7.4.3.4799) downloads into C:\ProgramData\Applications\Cache\GUID\7.4.3.4726\FortiClientVPN.msi.This MSI has the same product code {15C7B361-A0B2-4E79-93E0-868B5000BA3F} as our previously deployed install (7.4.3.1790), which prevents an in-place major upgrade, as the Windows Installer thinks it is already installed.Could you please rectify the latest MSI so it uses a unique product code? This was never a problem until now and is impacting our ability to deploy the newer client to machines running an older FortiClient version, leaving them susceptible to vulnerabilities.RegardsToji 

diag sys mount listFilesystem 1M-blocks Used Available Use% Mounted on/dev/ram0 768 656 112 85% /none 1778 2 1775 0% /tmpnone 5925 9 5916 0% /dev/shm/dev/sda2 362 313 29 91% /data/dev/sda3 91 0 86 0% /home/dev/sda4 184510 666 174400 0% /var/log

Hello,Last week, the VPN on my personal laptop connected normally. Now, when I try to connect to the network, I get two errors:Timeout - and I don't even see an attempt to log in to Forti Auth.No errors - the GUI just freezes while connecting and disconnects after a while.System Windows 11.I will add that with version 7.4.3 hotfix (I can't check the exact version right now), but on another computer - I connect to the VPN normally (unfortunately I don't have access to it at the moment to check) IKE:1Mode: Agressive|Adress Asig.: manualIPSECOn the company's side, everything looks fine - there are other connections via VPN.  

If i have ipsec tunnel for site to site connection listen on port1, then on same port i confgire ipsec tunnel for remote access then is there any miss connection?I mean is there any wrong connection when Remote Access VPN want connect then the connection will passing thru the site to site tunnel and vice versa?

I’m using Forticlient 7.2.14 with EMS Cloud 7.4.5. Our profile loggin settings are in debug mode as we have many issues over our time with this product. I see these debug logs are logged under %\ProgramFiles%\Fortinet\FortiClient\logs\trace. Is there any reference to what each log represents? I can’t seem to find one. Some of the log name inidcate the usage but they are verbose so I would like a reference as we are looking to build some Loki dashboards against them:  Log Usage Reference Transctrl.log     Sslvpnlibr.log     Sslvpndaemon.log     Sslvpndaemon_error.log     Ftsvnic.log     Fortiwf.log     FortiVPNGui.log     FortiVPN.log     FortiVPN_Error.log     fortivpn.exe_sslvpnlib.log     FortiVPN.exe_FortiAuth.log  

Hello FNAC admins,Is it necessary to configure the Winbind part for RADIUS authentication to work properly? Or can RADIUS function normally without integrating Winbind.Thanks in advance,BR, 

Two to three months ago, we migrated to the EMS Forticlient VMware appliance 7.4.4.Today, I tested the upgrade from 7.4.4 to 7.4.5 via the GUI. I tested two times with the same result.See the log below:As you can see, I started the upgrade around 3:54 PM.The upgrade apparently finished about 30 minutes later, 4:24 PM, but I got stuck at 50% and suddenly saw a client and network error.I logged in to the EMS console via a different workstation and received the message that the EMS Ugrade completed!Only after refreshing the browser with the 50% message, did I get the message "EMS upgrade complete!"I don't see any errors in the logs, so I assume the upgrade most likely completed successfully.The (7.4.4) Forticlient on the Windows 11 workstations didn't generate any errors and could also establish an SSL VPN connection. I could also create a FortiClient installer in the EMS console1) Any idea why the upgrade dialog box is stuck at 50%?2) And I'm missing the SSLVPN option in the screenshot b

I know there are a million of these topics in here, but i dont have a support account with a product licence attached and I cant find the installer on my old laptop, I’m just moving device so i’ve lifted the config off my old laptop but it’s not working with 7.4 and I can’t access legacy downloads in support, does anyone have 7.0.8.0427 installer I can have?

I’m trying to setup a DNS service on the network interface.  I followed the instructions on this link.  However, it doesn’t resolve anything on the public domain.  It resolves interface domain name.  It looks like Fortigate doesn’t forward the query to system DNS servers.  Anything I need to check?  I used the following link to create DNS service.  Technical Note: DNS resolution not working when DNS Server configured to 'Same as Interface IP' | CommunityBasically, I want a user to use Fortigate interface as a DNS server IP and have Fortigate to resolve internal domain relying on the local dns database but forward to system dns servers to resolve anything outside domain names.

With IPSEC being removed from the new Forticlient and SSL-VPN being removed from the Fortigates themselves, I've been migrating everyone to IKEV2 using EMS.For around 100 users I would say 80 of them are connecting fine using IKEV2, LDAP and 2FA (Fortitokens) however around 20% are consistently having issues and end up reverting back to SSL-VPN.I've created both an UDP and TCP (443) IKEV2 profile for people to try. The TCP did solve some issues but a lot of people just cannot use IKEV2. I'm pretty sure it's likely their ISP/Router blocking it but I'm just wondering if there are any other tips I could check for when setting up the client on the Fortigate?I've forced NAT Traversal and setup IKE fragmention. Any one else had issues which changing any settings helped at all?Thanks! 

Hi! I tried to do an A-P 100F HA Setup where I have assigned the IP to ha1 interface. But there is no switch in between yet. Direct connection only.Everything is the same in Active and Standby firewall. But when I try to check the routing entry for the ha1 ip address, they aren’t the same. The output should show “via LAG1.16”You may refer to the images attached. The secondary firewall outputs the expected route. But on the primary, it says directly connected. It’s actually correct because I configured ha1 in primary and it just cascaded the config to secondary.One thing that confuses me is that , why different routes when they are just configured the same routing entries? 

Hi, We’ve been using the On/Off Fabric feature for our FortiClient users without any issues. However, since updating the FortiClient app to version 7.2.12.1269, the app no longer correctly identifies devices that are on fabric—it now shows all devices as off fabric as. We’re using Public IP as the detection rule. Please advise if there’s a known issue with this version or if any configuration changes are required. 

When sending logs to FortiSIEM using json over HTTP.if the sender can send with more than one IP, What I should use as reptIP in the API?also if I put for example one IP, if the sender send again with diff IP does the CMDB got affected?

I have 2 Fortigate 600F in a HA Cluster that needs to connect to 1 ONU. Currently, both Fortigate is connected to a L2 switch that is then connected to the ONU. However, when the ONU is rebooted, Fortigate is no longer able to obtain an ip address on the port used to connect to the ONU. If I configure link monitor, would Fortigate be able to obtain ip address after rebooting ONU?What is the recommended network configuration when using HA Cluster with ONU?

A MacOS device running FortiClient 7.2.12 is showing this in the EMS:FortiGuard Outbreak DetectionsIran-linked Cyber Attacks(compromised)The EMS is very hard to use to get any more details than that. I eventually found the "FortiGuard Outbreak Detection Rule" called "Iran-linked Cyber Attacks" and found only one MacOS CVE: https://www.cve.org/CVERecord?id=CVE-2025-13223The CVE states that the vulnerability is in "Google Chrome prior to 142.0.7444.175". The device is running 147.0.7727.138.Why is FortiClientEMS showing this false alarm?(At this point I am not trusting the EMS "FortiGuard Outbreak Detections" since it is not accurate.)

Second-hand devices - Does it actually matter if the device you are running is not registered to your forticloud account?This is assuming fortigate cloud is disabled on the unit and there’s no EMS so it cannot be remotely managed.Or should I just create a support ticket, send pictures of the labels to support and wait two weeks and hope fortinet decides to add these to my account?My plan was to test active-active HA pair so automatic updates aren’t what I want to happen.

We have setup a point to point wireless bridge using 2 FAP234's as the parent and leaf AP's. The wireless bridge is intended as a backup route to a fibre connection should it go down. A diagram below shows the setup;Network DIagramWe are however having issues in that the wireless bridge does not pass traffic when the fibre link goes down, and although I do have a TAC case open, I'm hoping a member of the community could review the setup and point out anything that could be causing the problem.One thing to highlight is that spanning tree is enabled on the switches that the AP's are connected to. Should spanning tree also be enabled on the AP's themselves, or is that managed by the switches? Any help is welcome.