Support Forum

Does anyone here know what causes this error and how to fix it.I check the certificate for SSL VPN, and it still shows as valid. So, I'm sure where the error is from.Also note a few weeks ago I upgraded from 7.2.11 to 7.4.11

I can successfully connect to forticlient using all three but when i use the hotspot and wifi dongle the forticlient connects but there is no packet receive, which means I can not access my resources. I tried upgrading my forticlient, disabled ipv6 on dongle adaptor still doesn't work. the hotspot is for every one of the staffs, but the dongle is different from each pc. varying win 10 and 11. It's not specific to windows. There are critical remote users who are having trouble. How can I fix it.FortiClient 

Hi all, We are building an automated pipeline to continuously collect SSL-VPN and IPSec debug logs from our FortiGate 90G devices, using:diagnose debug application sslvpn -1diagnose debug application fnbamd 8diagnose debug enable We specifically need the raw debug output (e.g. "SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384") which is not present in structured logs and therefore not available via FortiAnalyzer or syslog. We have already gone through the following KB articles:• Continuous debug monitoring with Bash and Crontab:https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Continuous-debug-monitoring-with-Bash-and-Crontab/ta-p/305973 • FortiGate remote monitoring and logging CLI command output into a file:https://community.fortinet.com/t5/FortiGate/Configuration-Example-FortiGate-remote-monitoring-and-logging/ta-p/189892 Based on our research, it appears that the debug subsystem and the structured logging pipeline are architecturally separate, th

Can two FortiGate clusters (each configured in Active-Passive HA with 2 units) be interconnected through a Core switch?

I have a number of domain joined PCs that are either deleted or disabled that are still showing up in EMS.  I have one in particular that keeps trying to push out a FortiClient upgrade but fails because it can't contact the computer.  Shouldn't EMS automatically be updating against AD and removing computers that are either disabled or no longer exist?  

I've got a strange issue with upstream HSRP Routers from the ISP. I've got a single /29 virtual IP configured on my Fortigate with HA set up.When I have Fortigate A connected to ISP router A, and Fortigate B connected to ISP router B the Internet dies.If I connect both Fortigate to ISP Router A everything works as normal including HA failover. The same is true for ISP Router B. Only when the Fortugates are connected to seaparte Routers does the Internet die.The ISP says they configured e0/1 and e0/2 on both Routers to be in the same L2 VLAN so in my mind this should work correctly.If I add a dumb switch into the mix with both fortigate then the Internet works fine.To me, the logical conclusion is that the ISP hasn't correctly configured their L2 VLAN but am I overlooking something in my config? The monitored interfaces don't trigger a failover so I know at least one thing is wrong somewhere.

FortiGate - 7.6.3FortiClient - 7.2.9 (Windows and Mac) I have been working with Support for weeks now with no success so hoping I can get help here.Fortigate config:config vpn ipsec phase1-interfaceedit "OpsIPSecVPN"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal des-sha512 aes256-sha512set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"set dhgrp 14set wizard-type dialup-forticlientset nattraversal disableset network-overlay enableset network-id 0set transport tcpset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsIPSecVPN_split"set ipv4-name "VPN_PCI_Operations_us2"set save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret ENC *** FortiClient config:<connection><name>us2-LOACAL2</name><type>manual</type><ike_settings><keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_c

Je viens de créer un tunnel VPN IPsec grâce à l'option VPN Wizard qui a automatiquement créé les politiques et les objets. Quand je lance mon FortiClient, je n'arrive pas à me connecter : un message d'erreur apparaît. J'ai récupéré les logs mais je ne trouve toujours pas ce qui bloque. C'est un Fortinet 101F avec la version v7.6.6 build3652voici quelque partie des logs ike 0:VPN:64: out B264FC333EFD2592341205A9F51C32110110020000000000000000C80D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0D0000144A131C8107035845 5C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF000000148299031757A36082C6A621DE00000000 ike V=root:0:VPN:64 : envoi d'un message IKE (ident_r1send) : , longueur=200, vrf=0, id=b264fc333efd2592/341205a9f51c3211 ike : réduction de la mémoire de 159 744 octets ike V=root:0 : réception de, ifin

I'm trying to set up a dial-up IKEv2 IPsec VPN using the Windows Native VPN client for a "user-based" certificate authentication setup. Specifically, there is no RADIUS or third-party client involved in this setup. The authentication should be handled locally on the FortiGate using the certificate handshake between the client and the firewall. Are there any official or community-validated docs that show this specific configuration? I am specifically interested in the requirements for: The FortiGate Server Certificate: Are there specific SAN or EKU requirements for Windows Native to trust the gateway?The User Certificate: What is the correct way to present these to the FortiGate when using the Windows Native client?Local Authentication: How to properly map the user certificate to a PKI User or User Peer on the FortiGate side to avoid needing an external authentication server.Any CLI snippets or pointers to specific technical tips for the "Mutual Trust" between these two d

Hi,Anyone have any news around arm64 windows collector support?Best Regards,/R.FortiEDR 

Azure Virtual FortiGate dropped SR-IOV Accelerated Networking interfaces Port1, Port2, Port3, Port4.More than 50 IPsec tunnels down & came up after restart.  System Events logs device port1 loses a SR-IOV slave device sriovslv2.Hyper-V SR-IOV VF secondary is hot unpluggedI raised a ticket with Microsoft & Fortinet for RCA.  Can someone helps me to understand root cause & prevent this issue for future.

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.I didn't encounter any issues during the migration.I want to start the console now, but I'm getting the error below.I think it has something to do with the certificate, among other things.How can I remove it and/or configure/import a new certificate?

Configuration detailsMode :Transparent Mode Interface setting: Port x1 (internal), Port x2 (External). All traffic from the inside network passes through port x1 to port x2 to reach the internet. I upgraded the FortiOS version on a FortiGate 401F from 7.4.9 to 7.4.11. After the upgrade, users were unable to access services properly. Specifically: -Internal users were unable to access the Internet.-External users were unable to access the web server located behind the FortiGate. From initial traffic log analysis, I observed that packets were being sent out to the external network, but no return packets were received. Due to limited maintenance time and business impact, I rolled back the FortiOS version to 7.4.9. After the rollback, all services returned to normal operation. Has anyone experienced this issue with FortiOS 7.4.11? Currently, I have opened a ticket with Fortinet Support, but there has been no update yet. Thank you.

Hello everyone, In a Fortinet FortiAnalyzer VM environment, we are frequently seeing the alert:[Your daily logs GB/day limit is exceeded within the last 7 days]I would like to hear from the community about real-world impacts when the daily log ingestion limit is exceeded.Have you experienced log loss, delayed indexing, or incomplete reports?Any noticeable performance impact or issues with analytics and event correlation?  Note: I am fully aware that the daily gigabyte allowance is quite low and I am willing to upgrade the license, I just wanted to know what I might be compromising on my analyzer. 

Hello, I am looking for a solution how to use firewall objects from one ADOM in another one.Is there a possibility to share objects?Or is it possible to export the objects database and import it in the other ADOM? regardsRainer

I love how easy it is to create «advanced» address objects like fqdn, GeoIP and even wildcard fqdn (actually usually works). And I’m a heavy user of either fqdn or GeoIp as source address on all inbound policies.However I wish there was an easy way of creating ASN ad a address object.There is a possibility to create ASN textfiles and host yourself with python script, using them with a fabric connector.But I wish there was an easier way.Do you know of a easy way of getting ASN as a address object? What other address objects do you miss as a daily runner of a FortiOs device?

I'm spinning up a new pair of FortiGate 901G's to replace some Cisco FTD's (yuck!). I'm very used to and appreciative of Palo's way of doing security policy, centralized NAT, and a separate decryption policy. I like being able to make security policy directly based on app or URL category, rather than making profiles for everything. I don't see how profile mode is as flexible as policy mode. If I want to make a policy for a single app to be let through, I can't do that with profile mode, as an app control profile allows and denies all apps. For example, say I want to allow the "Quickbooks" app. I can't make a policy that has an app control profile of just allowing Quickbooks.. The app control policy would either end up blocking or allowing all apps. This is where i see the biggest downside to profile mode.I've spoken to a few people I respect in the Fortinet world, and they recommended staying with Profile mode for varying reasons...- I heard there is less support for Policy-based mode-

Hello all, I have configured Remote IPsec VPN to access internal network, am using FortiClient.For User authentication I am using Radius server which is configured at Windows Server (NPS).Also users are authenticating & getting IP address from Radius Server. (without 2FA Email based) When I use 2FA with email based - What problem I am facing while accessing the VPN--------->---> Getting token twiceRefer to the config:-config user localedit testtype Radiusset two-factor emailset email-to abc@gmail.comAt that time I am getting email token twice. FYI - I am using IKE version 2 ... ( For Fortigate IPsec tunnel)config vpn ipsec phase1-interfaceset type dynamicset interface "port1"set ip-version 4set ike-version 2set authmethod pskset mode-cfg enableset eap enableset eap-identity send-requestset authusrgrp (Test Group)set assign-ip enableset assign-ip-from group ( test)  Anyone has any Idea why I am getting token twice over email. I have put effort a lot bu

I have a few branch offices running FG100s, and I set up DHCP on them since they are small. I point DNS back at the AD servers at the main office. Everything seems to be working, but there are not PTR records in the reverse lookup.Some googling has led me to try a few things that didn't work. So I turn here for guidance. Am I missing something?

Hi all,  What would be the best way to migrate fortiswitch/AP management to Fortilink from FortiEdge/FortiLAN? I was thinking of resetting the configurations on the switch and turning on the security fabric connection on the uplink interface -- when I set up the switches, I changed the LLDP settings and turned off fortilink discovery off.   Thank you! C 

We are currently using a Next-Generation Firewall 201G running on FortiOS 7.4.11. The firewall is connected to the ISP LAN port, and the ISP firewall has a DMZ configured towards our firewall, with all required ports forwarded to it. We attempted to configure both SSL VPN and IPsec Dial-up VPN; however, neither of them is working. We have thoroughly verified the configuration, and all required policies are correctly in place. I have also followed the official Fortinet documentation step by step to troubleshoot the issue, but the problem still persists. Administrative access via HTTPS is enabled on the WAN interface, and Dynamic DNS is correctly resolving to the ISP public IP address. However, the firewall is not accessible from the public internet. Since the firewall itself is not reachable externally, SSL VPN communication is also failing. This situation is extremely frustrating. Even Fortinet support has not been helpful so far—they are repeatedly requesting logs, but

Hello everyone,We are currently running several Windows Server 2016 systems (Extended Support until January 12, 2027) using FortiClient 7.2.9.1185. Since this version contains known vulnerabilities, we would like to update to a newer release. Unfortunately, newer FortiClient versions no longer support Windows Server 2016.We are looking for advice and would love to hear from the community:- How are you securing Windows Server 2016 systems with FortiClient?- Are there specific workarounds, additional hardening steps, or complementary security solutions you use?- Do you continue to run FortiClient on Server 2016 despite the lack of official support, or have you adopted alternative approaches?Any experiences, best practices, or recommendations would be highly appreciated! Thank you in advance for your input.

I try to connect Fortigate-VM (v7.4.11 build2878) to Fortimanager VM (v7.6.6 build3654) both of them have trial licenses in the same account. If I try to connect from Fortigate side I get error "The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager. Could not connect to the FortiManager to retrieve its serial number."  If I try to connect from Fortimanager as discover online device I get error "Probe failed" after Fortigates login and password entering. Both VMs placed in the same subnet and have fresh installation and only one configured interface and have internet access. FMG-Access enabled on Fortigate's interface.On FortiManager side I configure the follow:"FMG-VM64 # config system global(global)# showconfig system globalset adom-rev-auto-delete disableset enc-algorithm lowset fgfm-allow-vm enableset fgfm-ssl

Is there any good courses for FCP – Network Security (FortiGate Admin) that’s hands on out there? I’m not studying for the certification, I just want to learn it. I passed the CCNA Exam certification like 1 month ago, been doing a lot of labs, and I’m comfortable working on EVE NG. So, I want to challenge myself and start working with firewall instead ACL

We recently introduced iOS clients to our fleet, unfortunately FortiVPN with sslvpn seems to not set DNS server on iOS since our internal stuff won't resolve. Works fine on Android though.