Support Forum

 We recently upgrade our EMS server to 7.4.5 from our Windows 7.2.12 version. All went well and the FortiClients are being upgraded from 7.2.13 to 7.4.5...But we now have a swarm of complaints for the following issue with 7.4.5 and this specific routine makes it happen everytime.PC connected to the VPNPC going to sleepPC coming back from sleep with the VPN down (normal) but no internet browsing possible on the machine.all browsers display "Your Internet Access is Blocked" with ERR_NETWORK_ACCESS_DENIED. We can ping any internet IP and use DNS but browsing is completely blocked and not even visible in a Wireshark capture of our wifi connection.  If we close FortiClient browsing resumes and we can then launch it again and all works fine. A reboot also works obviously.  So there's an issue with Windows 11 going to Sleep with a FortiClient 7.4.5 connected (important) upon coming out of sleep.  We have more than 1000 PCs upgrade right now and the issues are pouring

Hello guys,I am currently configuring FortiNAC to authenticate users using LDAP accounts. This setup is intended for BYOD devices, primarily mobile phones and Windows laptops.I am using EAP-PEAP with MSCHAPv2 as the inner authentication method.The issue I am experiencing is as follows: FortiNAC correctly assigns profiles and policies to the devices upon authentication, but it does not assign the Access Value / VLAN configured in the SSID according to the Logical Network.For comparison, a very similar configuration is used for internal devices, which works correctly — the Access Value/VLAN is applied as expected.I have verified that:The SSID has the VLAN/Access Value properly configured.LDAP authentication succeeds, and users are correctly identified.Policies and profiles are applied as expected.Could anyone advise why the Access Value/VLAN is not being assigned for BYOD devices in this scenario and how to resolve it?There are some pictures and part of debug log:- AccessConfiguration&nb

Hello everyone, I am experiencing an issue with all my FortiGate 101F firewalls running FortiOS version 7.2.12. Since a few days ago, these devices have stopped sending logs to FortiGate Cloud. The problem is affecting my entire fleet of firewalls simultaneously

Hi everyone, after a lot of trial and error, I managed to set up a working IPSec VPN configuration based on certificates (server and client auth) that works for the FortiClient and also for strongswan (on Linux). Now I would like to extend our firewall policies, so that we can limit access for individual users to what services they actually need. Since user matching is already part of the IPSec authentication, I assumed that this would be fairly easy, but it doesn't work. As soon as I select the group containing the authenticated user for the policy, it doesn't match anymore and traffic is dropped. Here are the relevant excerpts of the configuration: # PKI user:config user peeredit "vpnphip"set ca "CA_Cert_2"set subject "CN = vpn-bup"nextend (I first tried with "set cn vpn-bup", with the same result) # PKI group:config user peergrpedit "vpnadmin"set member "vpnphip"nextend # Normal user group:config user groupedit "vpngroup"set member "vpnphip"nextend&nbsp

Hi, we are looking into the migration from SSLVPN to IPSEC, it mostly works with windows, but there doesn't seem to be any ipsec options for the VPNOnly client on linux (only in windows).It seems that the ZTNA Edition is capable of connecting under linux but it requires licensing.So the question would is, with the 7.6 versions disabling sslvpn, are there any free clients that can connect to VPN with IPSEC+SAML? Will fortinet provide them a any time? Regards

Hi Friends,I would like to know if there is a portal on the FortiGate website where we can check the recommended firmware versions for FortiGate firewalls. Coming from a Cisco background, I’m aware that we can verify the recommended firmware for specific Cisco devices on their website. Is there a similar portal available for FortiGate where we can check the recommended firmware for specific firewall models?

I am no longer able to log in to the AP GUI and am not proficient in CLI yet. If this is an issue, what should I be checking? Although the AP's have the DHCP server enabled when we connect to either of the two SSID's we receive an IPADDR from the pool set up for the DHCP on port 4. Be advised that the AP's are connected to port 4 but have a different DHCP range set up on the individual AP. Does the AP not distribute from its own DHCP range?

I work at a small non profit in New York City. Our network administrator was in a bad accident. I have been asked to help out until a replacement can be found. I have no experience with firewall administration. I need to add IP addresses to the whitelist of  a Fortigate 200D and a Fortigate 60D. Where on the interface do I add these IP addresses. Thank you very much.

Hi there, I have configured Radius server in window server to authenticate Firewall user so that users can manage Firewall. Radius server is accessible from Fortigate Firewall and user is also reachable when I test from FortiGate test connectivity. But when I do ssh or access GUI to access the firewall by entering username and password showing incorrect password. Please need your suggest what I am missing.   Even after entering correct username & password which configured at Radius server is not able to login.  Thanks for your attention on this problem

Currently, two separate FortiMail VM instances are running in Server Mode for two different zones. Both zones use the same mail domain, and FortiMail is providing full mail server functionality (mailbox services) along with email security features.Now, there is a plan to migrate from 2 FortiMail VMs to 2 FortiMail bare-metal appliances (zone-to-zone replacement).I would like to get guidance from the community on the following:What is the recommended process for migrating FortiMail VM (Server Mode) to hardware appliances?Is configuration backup and restore between VM and hardware models fully supported, or are there limitations?What is the proper approach for migrating mailbox data, mail storage, and mail queues?Are there firmware compatibility requirements between VM and hardware before restoring configuration?What storage-related concerns should be considered (e.g., disk initialization, RAID configuration differences)?What are the key risk factors during this migration, especially whe

Last week, I upgraded the Forticlient EMS server to version 7.4.5. The workstations are still running 7.4.4.A few days later, I noticed that there were 3500 files in Quarantine.This wasn't the case before. Users can no longer find some of their files.For example, Spyder is a scripting app we use for data analysis, modeling, and reading/editing files.I've never had a problem with it.But now users are getting the following error:I also see, for example, .xlsx files from some users' OneDrive files incorrectly in Quarantine.These exclaimer files are also valid:When I click on the ransomware link, I get the FortiGuard Labs message below:UnavailableCould not retrieve this virus at this time. Please try again later.Any idea why there are suddenly so many false/positives?

Hi I'm having trouble connecting to the server of one of our customers. In the last 2 weeks it worked but now all I'm getting is Status: DisconnectedNotification: Error: Can not connect to VPN server. I'm using the Foriclient (VPN only client) 7.4.3.1736 für AMD64 linux on a freshly updated Debian 13. In 3 of 5 cases, I enter the password and immediately get this error messages. And even when it manages to connect to the server, it prompts me for the token. And the generated token does not work anymore (using latest FortiToken Mobile on android). This is the error message that I see in /var/log/forticlient/sslvpn.log 20260218 00:15:24.439 TZ=+0100 [sslvpn:DEBG] vpn_connection:446 https server '<REDACTED>' has this certificate, which looks good to me:/CN=<REDACTED>20260218 00:15:24.462 TZ=+0100 [sslvpn:DEBG] vpn_connection:669 http connection closed.20260218 00:15:24.463 TZ=+0100 [sslvpn:DEBG] vpn_connection:531 Response line: 200 OK2026021

Seeking a Fortinet solution to replace our Umbrella DNS Advantage for remote users. The goal is to enforce DNS filtering for all remote users, regardless of whether or not they are on/off VPN. Forticlient doesn't support the DNS filtering profile (only on Gates). My research comes up with the following potential solutions. Looking for any other comments or suggestions. User on prem = use DNS filter on the gateRemote user on FCT/EMS = force always-on vpn and make sure DNS traffic is routed over the tunnel and DNS Filter profile is applied to a FW policyRemote user on SASE = force always-on and apply the DNS Filter profile in the SASE POP. Thanks all,Don

Hi Team, I am unable to use FGT 7.6.6 in my EVE-NG it is asking me to update license but it is not taking that. can someone please help me on this. RegardsSantosh

Hello,I have a Site-to-Site IPsec VPN between a Fortinet FortiGate 80F and a MikroTik router.Phase1 and Phase2 parameters match on both sides. The tunnel shows status = up, but no traffic passes until I manually restart the tunnel on the FortiGate.After restart:Traffic works normallySA counters increaseBoth directions pass trafficAfter some time, traffic stops again while:Phase1 remains upDPD status is OKNo config changes are madeIn diagnose vpn tunnel list, sometimes I see:proxyid_num=0 / child_num=0orasymmetric counters (only enc or only dec increasing)Is it possible for Phase1 to stay up while Phase2 becomes unusable?Could this be related to NPU offloading or replay protection?FortiOS version: 7.4.11Any guidance would be appreciated.#FortiGate

FortiGate / FortiOS: Fortigate 81F / v7.6.2VPN: IPsec IKEv2 dial-up Client: FortiClient VPN-onlyAuth: Local users + EAP-MSCHAPv2 + FortiToken (2FA) Whats working so far : FortiClient connects successfullyFortiToken OTP is requested and validatedClient receives an IP from the IPsec poolTunnel is UP Issue : No access to LAN resources (can't ping my DCs from ipsec vpn but can from ssl vpn)All traffic is dropped by firewall with policy 0 Debug :  Flow debug shows:received packet from VPN_IPSEC_0 route found via LAN Denied by forward policy check (policy 0) Policies I tried so far : srcintf = VPN_IPSEC (not accepted)srcintf = VPN_IPSEC_0 (not a valid interface)srcintf = zone containing VPN_IPSECsrcintf = anyWith / without user groupsWith very permissive rules (ALL / ALL)Still always policy 0. Observations Interface VPN_IPSEC exists (169.254.x.x, type tunnel, UP)Traffic arrives as VPN_IPSEC_0, which cannot be referenced in policies

Hi, New to the forum and seeking assistance.  Since EOL has been set for the FortiGate 30E I am considering updating to the FortiGate 30G. The replacement product. The question is 'Can I download configuration for the FortiGate 30E and upload it to FortiGate 30G. Will uploading transfer the Policy and Object section? Any help appreciated.

Hi, I'm trying to install Forticlient VPN on my system (Fedora 43) but  I'm getting this error:package forticlient-7.4.3.1736-1.el7.x86_64 does not verify: no digestI've tried adding the forntinet repo and installing with yum, and using the .rpm file, but I always get the same result. Is there any solution to this problem? Thanks in advance.

Hi  Is there a way to implement session based authentication for users instead of IP Based Authentication ,as I have  The below scenario:1. FortiGate Firewall running version 7.4.3, is the Gateway & DHCP Server configured with a Captive Portal ,it authenticates users against LDAP .2. The wireless network has 1 SSID, with different Access point vendors, when users move-in between the different access points ,they obtain different  IP address`s ,they are prompted to re-authenticate on the portal.3. The previous gateway was a Meraki firewall ,it was able to authenticate users based on sessions, whereby you only logged in once on the portal and re-AUTH happened when the account duration had ended .It was not based on IP address`s hence users didn`t get the portal to re-authentication as they moved around. Edit 1 : Most of the users use tablets /laptops not joined to the domain Is there a way to do this ? Thanks 

I login to the fortigate web admin using my LDAP User and here my config. Everything is working fine, i able to log on to the Firewall. But when i upgrade the firmware on primary firewall then when secondary firewall take over then i can't login using LDAP users. If i remove set source-ip then both firewall able to login. Anyone know why?IP 10.202.151.1 is interface on Fortigate which connected to the LAN (Core Switch) FW01 (AD) # showconfig user ldapedit "AD"set server "10.203.248.31"set source-ip "10.202.151.1"set cnid "sAMAccountName"set dn "dc=mydomain,dc=id"set type regularset username "mydomain\\admin.forti"set password ENC xxxxxxxxxxxxxnextend

Hello, we would like to set up LAN authentication via Windows Radius. This would allow sales employees, for example, to log in anywhere and access the sales VLAN with their registered AD account. We have already set up a lot, but the failed VLAN always pops up on the Fortiswitch port. And on the Windows 11 PC, the login does not work in the Ethernet settings. Has anyone set this up before and can help? FortiGate #Radius 

Hi All,I am facing an issue in getting the NFR for my VM fortinet firewall. This NFR is used only by me for the LAB purposes.

Hello everyone, I would like to know, can the isolation interface port2 and isolation scope be in the same network, example : Isolation interface :192.168.10.2Gateway : 192.168.10.1Isolation scope : Gateway : 192.168.10.1lease pool : 192.168.10.3 - 192.168.10.100 I've seen the majority of articles use seperate subnets and some articles use them in the same subnet. Can anyone explain pls ? Thanks in advance.BR,

I have a requirement to use ZTNA (Zero Trust Network Access) on Android devices. The devices need to communicate with some printers on the corporate network. We have already set up the ZTNA Destinations, policies, and groups, but communication doesn't work on Android devices. However, when we test it on Windows, the communication functions properly. Could you let me know if ZTNA has any compatibility issues with the Android system?

Hi all, I have a Fortigate doing an IPSEC to an offsite server, and SNAT is required. Policies from dial-in IPSEC and LAN work OK (sending HTTPS traffic to the server over the IPSEC with SNAT translating the source to an IP pool) but when I try to provide external access to this via a VIP, traffic matches the policy and passes but connectivity fails.LAN to IPSEC policy (working)config firewall policyedit 52set name "LAN to IPSec SNAT"set srcintf "lan"set dstintf "IPSEC-P1"set action acceptset srcaddr "10.0.10.0/24" "192.168.1.0/24"set dstaddr "10.200.201.1/32"set schedule "always"set service "ALL"set logtraffic allset nat enableset ippool enableset poolname "IPSEC_SNAT"set comments "LAN to IPSec SNAT"nextendWAN to IPSEC policy (not working) config firewall policyedit 23set name "ipsec-tk-test"set uuid 46350196-0707-51f1-1c80-8146215ecbefset srcintf "wan1"set dstintf "IPSEC-P1"set action acceptset srcaddr "Australia"set dstaddr "IPSEC-VIP"set schedule "always"set service "ALL"