Technical Tip: Cannot remotely access a managed FortiGate through FortiManager after upgrading FortiGate to versions 7.4.9 or 7.6.4

[tpatel]

Description	This article describes how to resolve a remote access issue with a managed FortiGate through FortiManager or FortiGate Cloud after upgrading the FortiGate to v7.4.9 or v7.6.4 when a trusted host is configured.
Scope	FortiGate v7.4.9, v7.6.4.
Solution	The FortiGate is connected to Central Management for FortiManager or FortiGate Cloud. Remote GUI access is also enabled on the FortiManager admin profile. Consult the link below to learn how to enable remote GUI access for FortiGate GUI access for a FortiManager administrator: Remotely access a managed FortiGate. On FortiManager, go to Device Manager -> Device & Groups, 'right-click' on a managed FortiGate, and select the Remote Access option that appears in the context menu. It will redirect to the FortiGate's login page using the following: <FortiManager IP>:<port no>. After entering the correct FortiGate admin credentials, it shows an authentication failure.  FortiGate admin configuration: config system admin     edit "admin"         set trusthost1 172.25.188.101 255.255.255.255         set accprofile "super_admin"         set vdom "root"         set password ENC PB2ppeBKl00DyXVppwcXlygRcRTeJsZcelqaI1Nrw+Q/FL+     next end  FortiGate System event logs show 'Administrator admin login failed from https (169.254.0.1) because of blocked IP'. To check system event logs, go to Log & Report -> System Events. date=2025-10-20 time=22:05:26 eventtime=1761023126690920065 tz="-0700" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="https(169.254.0.1)" method="https" srcip=169.254.0.1 dstip=169.254.0.2 action="login" status="failed" reason="ip_blocked" msg="Administrator admin login failed from https(169.254.0.1) because of blocked IP" In the case of FortiGate Cloud remote access, the blocked IP address is 169.254.1.1. This issue has been resolved in FortiOS v7.4.10 (scheduled to be released in January 2026), v8.0.0 (scheduled to be released in March 2026), and v7.6.6 (scheduled for release in April 2026). Note that these timelines for firmware release are estimates only and may be subject to change. Workaround for FortiManager remote access: Add the FGFM management tunnel IP address to the trusted host list for the FortiGate admin, which is used to secure communications between the FortiManager and FortiGates. FortiGate admin configuration: config system admin     edit "admin"         set trusthost1 172.25.188.101 255.255.255.255               set trusthost2 169.254.0.1 255.255.255.255         set accprofile "super_admin"         set vdom "root"         set password ENC PB2ppeBKl00DyXVppwcXlygRcRTeJsZcelqaI1Nrw+Q/FL+     next end  Workaround for FortiGate Cloud remote access: config system admin     edit "admin"         set trusthost1 172.25.188.101 255.255.255.255         set trusthost2 169.254.1.1 255.255.255.255         set accprofile "super_admin"         set vdom "root"         set password ENC PB2ppeBKl00DyXVppwcXlygRcRTeJsZcelqaI1Nrw+Q/FL+      next end  Related article: Technical Note: Understanding secure SSL connections between FortiManager and managed FortiGate devi...