Support Forum

I am attempting to call the /metadata endpoint in FortiClient EMS, but I am receiving a 404 Not Found error. According to the API documentation, this endpoint requires SAML to be configured.Is there any way to retrieve EMS metadata using the /metadata endpoint without enabling SAML configuration? 

Does any version of FortiOS support MOBIKE with IKEv2 dialup VPNs (using the built-in client on Windows 7/8/10)? I am able to successfully connect but the "status" as reported in Windows always shows a "no" for MOBIKE support.  I have spotted "processing notify type MOBIKE_SUPPORTED" (from the client-side) in the debug output of IKE on the Fortigate but no other messages indicating support on the Fortigate.  I have tried machine certificates as well as EAP for client-side authentication but the results are the same. The only reference I've found (so far) in the Fortigate documentation is from the following:https://help.fortinet.com...ng_Main_Aggressive.htmIt seems as if there should be an additional option for enabling MOBIKE (like the way EAP support is optionally enabled). Also, the built-in Windows client issues DHCPINFORM packets (once connected) as a method to discover additional details.  This can be extremely useful to pass subnets to the client whe

For some reason my last post got flagged as "spam" so here it is again. DPD Failures on IpSec VPNHi In summary between 45 Minutes to every 3 hours, every single IpSec VPN Tunnel gets torn down with a DPD-error. An example log I have included below. GeneralAbsolute Date/Time2026-01-04Last Access Time14:45:21VDOMrootLog DescriptionIPsec DPD failedSourceLocal IPXXXXFortiClient ID7D7A0CD5D9574D5AB509F5519F68B9F8UserXXXXGroupN/AXAUTH UserXXXXXXAUTH GroupFortiClient UsersActionActiondpdStatusdpd_failureSecurityLevel       ErrorEventAssigned IPXXXXXCookiesc7e291824a726956/c9f2b20f46158b9fLocal Port4500Outgoing Interfacewan1Remote IPXXXXXXRemote Port64917VPN TunnelForticlient VPN_0MessageIPsec DPD failureOtherLog event original timestamp (µs)1767537921187226000eventtime_raw_value1767537921187226120Log ID0101037136TypeeventSub TypevpnAlternate UserN/AADVPN Shortcut0 Below is the my current configuration for IpSec VPN Phase 1:config vpn

Hi ,We are facing a client network VPN issue.One of our clients is using Fortinet FortiClient SSL VPN to provide access to their internal network. Our employees connect to the client’s SSL VPN in order to run scripts on the client environment.The script runs automatically and can also be run manuallyWhen employees work from their home network, the script runs without any issuesWhen employees work from our office network, the script stops in the middle and does not completeOur office network uses a Fortinet FortiGate 100F firewall.To troubleshoot, we: Reduced the MTU size from 1500 to 1300Configured TCP MSS as shown below:config firewall policyedit 12set tcp-mss-sender 1300set tcp-mss-receiver 1300endHowever, the issue still occurs only in the office network.The same script works perfectly when run from the home network. can anyone help.

Hi,  Following this article I try to obtain a trial license: https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/441460I receive error as follows:  FortiGate-VM64-KVM # execute vm-license-options account-id FortiGate-VM64-KVM # execute vm-license-options account-password<string> Account password. FortiGate-VM64-KVM # execute vm-license-options account-password FortiGate-VM64-KVM # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)y Failed to download VM license.I have checked my account and master account of our organization, and there is no trial vm license activated. Fortigate can access internet. 

I bought two Lenovo Thinkpad X13 Gen 6 laptops two months ago. Neither of them can use VPN with Foticlient. Meanwhile, other company laptops like the Dell 3450, Acer P4/P6, and Thinkpad T14s can all use it. I'm certain the preshared key and username/password are correct. Please help me fix this error. Only these models are affected.

Hi everyone,I have the following scenario:Two Fortigate HA clusters (active/passive |100E v7.2.10) are currently in operation in the customer environment. The two clusters are currently connected by a fiber optic cable. A transfer network and an IPSec VPN have been configured between the links. If an HA failover occurs on one of the clusters, the other cluster must always switch over so that data traffic can continue, because there is only one link between the firewalls. Now the links between the firewalls will be expanded to four, as shown in the image below.Unfortunately, there is no switch in between, so the firewalls need to be connected directly to each other. My first thought would be to configure an additional IPSec tunnel on both clusters via port 15 and put both IPSec tunnels in an SD-WAN zone. Adjust routing and policies on the SD-WAN zone. Health checks via ping on peer tunnel IP and in SD-WAN rule tunnel via port 16 should be preferred and port 15 backup.Would tha

Hi FortiWeb adminsFortiWeb 7.2.x.What is the best method to achieve URL-based routing on FortiWeb in reverse proxy mode, when using a policy with HTTP Content Routing.E.g.:Client requests www.domain.com/app1 -> route to back-end server 1Client requests www.domain.com/app2 -> route to back-end server 2The method I know is to use HTTP Content Routing to route the traffic, then to use Rewrite policy to remove the URL /app1 or /app2. But I find this method complicated and I feel there should be a way to do it on FWB with less complexity.Any idea about the best way to do it?

I am now planning to deploy IPSec VPN to laptops and I have the application packaged and the IPSec configuration deployed to the registry. The problem I am having now is with the Preshared Key.... I cannot deploy that via GPO and I can't enter that manually on every computer. How you guys handling this?

Howdy! We're beginning a merger at my org and I need to re-IP my dual hub BGP on loopback schema. My first and biggest question would be, is it even possible to change the BGP and HC loopback as well as the IPsec tunnel IP's, add the new networks to BGP on one hub; say the secondary, update the spokes with the new config, and then once that is successful, repeat the process for the primary hub with little to no downtime? I've been attempting to do this in a partial lab environment and I'm having issues with the spoke not loading the changed tunnel into the sdwan rule as a selected route even though from the hub, the new loop back and IPSec interface IPs are pingable to and from the spoke and hub. What I do find interesting is that if I keep the changes in place on the spoke but revert the actual tunnel interface IP back to the original address, it gets loaded into the sdwan rule even though the secondary hub head end tunnel is still the changed address which would be a comple

Hello everyone.We have two FortiGate 100F devices configured in active/passive mode.We are using six site-to-site IPsec tunnels, as well as remote users (Windows/Linux) who connect via FortiClient VPN.In addition, there are users who connect from Android phones using FortiClient VPN for Android.About a month ago, the FortiGate devices were automatically updated overnight to FORTIOS v7.6.5 build 3651.After the update, external users lost the ability to connect via FortiClient VPN on Windows laptops.After reconfiguring the VPN settings and switching back to DH group 5, Windows laptops were able to connect again.However, FortiClient VPN on Android still cannot connect and returns an error.On FortiClient for Android, only the following DH groups are available: 1, 2, 5, and 14.I tried all of these DH groups one by one, but there was no improvement.I tested this on multiple Android devices, and also tried the full FortiClient VPN version.In all cases, I receive the same error in a loop (the

I have problem when i connecitng my forticlient to the ipsec vpn tunnel.The issue is when i configure the forti client using ip address of fortigate then the vpn connected and can reach to the LAN.But if i use dns name on the forticlient then the vpn is connected bt can't rach to anywhere.Trying ping the dns name from the client and the ip is resolved.Anyone know why?

The following config requires the Fortigate "Web Application Firewall" feature to be enabled underSystem > Feature Visibility > Security Features > Web Application FirewallOnce the feature is enabled, you should find "Web Application Firewall" available under Security Profiles Creating a custom signature helps in blocking/allowing a specific URL address, or URL path that could be related to a "false positive" you have identified. These custom-signatures can also act as your exception list rather than disabling a specific signature ID using the command  "set disabled-signature" The default config values would look like thisconfig custom-signature Description: Custom signature. edit <name> set status [enable|disable] set action [allow|block|...] set log [enable|disable] set severity [high|medium|...] set direction [request|respo

Hi all. I have Fortigate 600E with 7.4.9 FortIOS. I have an HA cluster active pasive:Unit 1 has 100 Priority.Unit 2 has 50 Priority.I have too, override disable. If I put down a monitored interface in Unit 1, cluster converges and Unit 2 becomes active. But, if I turn UP again disconnected interface in Unit 1, Unit 1 becomes active again. Why  doesn't unit2 stay Active, if I have configured the cluster with HA Override disable? If it is not properly configured, what should I do? Thanks

Hi,Running FortiWiFi-60F (7.4.5) in my home lab, I have downloaded 7.6.5 and but found couldn't be able to update if no license.May I know any alternative to perform update without a license?Thanks

I have created 2 x vdoms, each vdom has a vlan assigned to a single physical port (set interface "port#"). If I create a security zone named "Zone1," the only option is to assign a VLAN from that specific VDOM. Both physical ports are connected to a switch, which will be trunked wth both vlans. Ideally, I would like to use the same 2 physical interfaces in each vdom with the same VLAN interface IP address in Security Zone1,  for failover redundancy (each vdom will have a zone named "Zone1") How is this possible? Not wanting inter-vdom links, is there another option, as you can only set 1 physical port per VLAN interface?  Would this be switch mode on the fortigate? Example - if I lose a port, no traffic will be pass to a specific vdom

Hi guys, I am trying to push LDAP settings to two firewalls that are using same LDAP server but with different service account. I use per-device mapping to add two FortiGate with different username and password for LDAP binding account but when I push it to firewall, although it get the right username but password is not being pushed right and as a result account get locked in AD. Anyone can guide how can i do this? Do i need to have same password for both account? My understanding is that FMG should push the settings in per-device mapping.  

Hi all, Do Fortigate Firewalls support "BGP peer groups" by sharing the same outbound policies and setting instead of configuring each BGP neighbor individually and updates replicated to all peer group members. I can't seem to find any docs or commands that support BGP peer group config on a Fortigate like a Cisco or Arista Switch.  

I am attempting to call the /api/v1/vulnerabilities/index endpoint in FortiClient EMS to retrieve vulnerability details. However, I do not see this endpoint listed in the official API documentation(https://fndn.fortinet.net/index.php?/fortiapi/48-forticlient-ems/5282/48/Endpoints/).Is there a specific reason why this endpoint is not exposed in the API documentation? Additionally, could you please confirm whether it is safe to use this endpoint, and whether there are any risks or compatibility concerns with future releases?

Despite VLAN switching being active for some reason FortiNAC is not sending 3799 CoA requests on any of my wired switches (I have no issues with access points, 3799 requests are being sent there). If I connect the same device wirelessly, it will do this. For example, when a host connects to switch X, it assigns to the registered VLAN and 5-10 seconds later recognizes by the DPR. However unless I manually disable and enable the port, the host doesn't switch to the appropriate VLAN. Even when I manually change the role of host X, it doesn't detect this as a new activity and doesn't send a 3799 request. As I mentioned, this issue only occurs with the switches, specifically Aruba switches (both old and new generation). When I check the logs, I can see that FortiNAC isn’t even sending the 3799 CoA request. What could be the issue?   

The customer currently has approximately 50k concurrent explicit proxy users, and we are trying to identify a suitable FortiGate/FortiProxy model or scalable architecture to support this requirement.Unfortunately, we haven’t been able to find publicly available documentation that clearly states the maximum supported value for “Concurrent Explicit Proxy Users” on most FortiGate models.So far, we have confirmed the following:FortiProxy 4000G – 60k users (from published specifications)FortiGate 901G – 32k users (observed from device login)FortiGate 1001F – 32k users (observed from device login)Could anyone please confirm the supported values for the following models?FortiGate 1800FFortiGate 2600FFortiGate 3000FIf you have access to the device, the value can be found under:System → Global Resources → User & Device → Default Maximum Any insights or confirmations would be greatly appreciated. Thank you.

Hello , My NSE7 enterprise firewall is scheduled for tomorrow, any advices or ideas that could help meThanks in advance

Friends, I have a question. I have a FortiGate 7.4.9. I need to enable two-factor authentication for a new SSL VPN user. This user is from Active Directory. However, when I go to the Authentication Type settings, the "email-based two-factor authentication" option isn't displayed. This is strange because I have several existing Active Directory users with this option enabled. I've searched online and it seems I can only enable it for local users, but I can't find a way to enable it for Active Directory users. Could you please help me? 

 Hello Team, as per my admin team, I needed to install VPN only package, which I installed. Below is my output, in first you can see beginig of output, where is saying some file is missing.At my current company, we are using Forti vpn-only client, I don't have any experience with Forti, as I am working as DevOps engineer, in past I used local created user in forti device, but now they are removed and I need to use SSO, which is NOT working for me. I am using xUbuntu 24.04.Please assist. forticlient gui ERROR: Failed to add module "FortiClient ZTNA". Probable cause : "/opt/forticlient/libcertd.so: cannot open shared object file: No such file or directory". 15:25:23.076 › Failed to add libcertd.so: Error: Command failed: /usr/bin/modutil -add "FortiClient ZTNA" -dbdir sql:/home/nedeljko-scepanovic/.pki/nssdb -libfile /opt/forticlient/libcertd.so -force ERROR: Failed to add module "FortiClient ZTNA". Probable cause : "/opt/forticlient/libcertd.so: cannot open shared object file:

Hello , My NSE7 enterprise firewall is scheduled for tomorrow, any advices or ideas that could help meThanks in advance