Support Forum

while i try to register my forti AP 221e device in forti cloud web portal & beliow mentioned error are comming. Please check & update the same. 

Hi team,We need your suggestion & support to configure the fortiAP 221E in standalone mode because i dont have the firewall & controller. we need public the one SSID through fortiAP 221E for create the wifi zone for laptop users. please suggest the best method to me. FortiAP 221E 

I am trying to set up IPSEC vpn from a fortigate to FortiClient for Windows and Mac. I have it working on FortiClient for Windows. On FortiClient Mac it says Connecting, then times out. I noticed that the Mac version is missing three options in the setup that are visible on Windows and I wonder if that is my problem.The options missing are:VPN Settings: EncapsulationPhase 1: NAT TransversalPhase 2: Enable Replay DetectionCan I get those options to show somehow?The fortigate side was set up using the wizard, and this is a full tunnel.

Ladies and Gents,I have 2 FortiSwitch 224D and would like to connect it to a FGT 40F, what is the recommended configuration for this setup?Thanks in advanced!Alfred

Hi everyone... I have confuse about vpn concentrator, anybody help me to describe what is vpn concentrator mean? Thanks

Hey everyone,We currently have a couple of FortiGate VM appliances running FortiOS 7.2.13 and are using FortiClient SSL VPN tunnel mode for client remote access.I understand Fortinet is sunsetting SSL VPN tunnel mode in FortiOS 7.6.3. the business is not ready to pivot off SSL VPN so in the meantime, they want to know whether upgrading to FortiOS 7.4.x is a reasonable short-term bridge (Fortinet’s lifecycl page says says it’ll be supported until March 31, 2028/November 11, 2028). Questions:1. For those who have upgraded, has FortiOS 7.4.x been stable for production SSL VPN tunnel mode?2. Is SSL VPN tunnel mode supported throughout the 7.4.x branch, including later releases such as 7.4.8 or newer, or is there a specific 7.4.x version we should target/avoid?3. Since SSL VPN is hidden from the GUI by default in 7.4, is it still considered fully supported in 7.4.x, or is it more of a transitional feature?4. Can I upgrade directly from 7.2.13 to a 7.4.x release, or should I follow a specifi

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

Hi everyone,Since upgrading my FortiGate 70G from 7.6.6 to 7.6.7, I can't access the admin GUI via my Nginx Proxy Manager. Direct local IP access works perfectly...The initial HTML loads, but all subsequent parallel requests for static chunks and API calls instantly fail after a login attempt. My NPM logs show: 104: Connection reset by peer in SSL handshake while SSL handshaking to upstream 2026/10/10 08:40:08 [error] 937#937: *53149 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 192.168.20.2, server: forti.local.net, request: "GET /favicon/favicon-16x16.png HTTP/2.0", upstream: "https://192.168.1.1:443/favicon/favicon-16x16.png", host: "forti.local.net", referrer: "https://forti.local.net/login?redir=%2Fprompt%3FviewOnly%3D" What I tried (without success):    Restarted the httpsd process.     Forced proxy_http_version 1.1 in Nginx to prevent HTTP/2 connection spikes.     Toggled SNI (proxy_ssl_server_name) and session reuse.     Tried SSL-offloading

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

My building will be shutting off power for electrical work this weekend and all our hardware has to be powered down ahead of time. We have two Fortigates in an HA configuration and several managed 424E and 448E FortiSwitches. Do we need to issue shutdown commands to the switches via the CLI or will shutting down the managing Fortigates shut the switches down too?

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

automatic failover between two different ipsecvpn remote gateway public IP addresses in FortiVPN Client

Hi all,I am currently encountering an issue with SSLVPN, and would would like to seek your advices. Thank you very much.Background:Fortigate 121G(7.4.12)Forticlient(7.4.11.0198)iPad OS(16.7.16)Issue:The SSL VPN connectivity is working successfully on iPad devices running iPadOS 17 and Android devices.However, the issue happen on the iPad device running iPadOS 16.7.16. The SSL VPN connection often gets stuck at the "Connecting" stage, and the login page does not appear.(Remark:iPadOS 16 and iPadOS17 in the same network, and same ssl vpn setting)We observed that when the issue occurs, the FortiGate firewall does not receive any SSL VPN traffic from the affected device.（Enabled SSL VPN application diagnostics, but no messages were generated）

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

Anyone seen a problem using FMG from Safari on MacOS where you occasionally (every few minutes) get a message saying connection to FMG was lost, usually counts down for a few seconds then reconnects. It's likely related to a tcp keep alive because it doesn't happen when I'm interacting, only when I'm idle for a few minutes. I'm just not sure if I should adjust Mac or FMG side. I only see this in FMG but it never happens on Windows machines, even using Safari.

I got problem.. I Deployment Web filter profile on Fortigate, my system already allowed & all runs well..But someday the license expired...then the Web Filter profile not running because license expired…and now i already renew, update & payment the license fortigate... Then Re-Deployment Web filter profile in rules firewall, but my system is blocking by Web filter profile without any changes on web filter profile.. i just replace / re-use Web filter after renew the license.Can you help explain what happen with this?FYI, Fortigate 101F with OS version :  v7.0.18 build0695 (Mature)This alert / alarm show in URL my system must be allowed, but blocking by Security Policies → Web Filter Profile : 

FortiClient IKEv2 IPsec VPN – Negotiation Timeout After 30 Seconds During RADIUS/EAP OTP AuthenticationHello everyone,I'm experiencing an issue with an IKEv2 IPsec remote-access VPN using RADIUS/EAP authentication with MFA/OTP, and I would appreciate your feedback or any similar experiences.Environment FortiGate: FortiOS 7.6.6 FortiAuthenticator: 6.6.8 FortiClient: 7.4.8 (ZTNA) VPN: IPsec IKEv2 Remote Access Authentication: RADIUS/EAP with MFA/OTP RADIUS server: FortiAuthenticator Issue descriptionThe issue occurs regardless of the OTP delivery method. We have reproduced it with: FortiToken Mobile SMS OTP Email OTP When the user enters the OTP within approximately 30 seconds, authentication succeeds and the VPN tunnel is established normally.However, if OTP entry takes longer than approximately 30 seconds, FortiClient remains in the "Connecting" state. The connection eventually fails with an IKE negotiation timeout, and the tunnel is not established.Important observation:

We need to block Microsoft Copilot for our users, but the M365 admin controls don’t give us a clean off switch. So I’m looking at doing it at the FortiGate level instead. I am specifically talking about the co-pilot that is embedded in all Office 365 apps, not the direct web interface.The catch is that Office 365 must keep working without any impact. Copilot is now embedded across the Office apps and shares a lot of Microsoft infrastructure, so I’m wary of blocking too broadly.Has anyone had success with this? Specifically interested in:Application Control signatures for Copilot and how reliable they areWeb Filter or FQDN based blocking, and which domains you targetedWhether deep inspection was needed to make it workAny side effects you hit with Teams, Outlook, or the desktop appsSuccess stories, gotchas, or configs that worked would be really appreciated.

Hi, I'm trying to improve FortiGate security profiles.What are the best threat feeds for Web Filtering and Antivirus?

I am writing to submit a critical product architectural improvement request regarding how FortiClient EMS 8.0.0 on Linux establishes secure directory integrations.During our recent deployment of FortiClient EMS 8.0.0 on Ubuntu 24, we encountered persistent authentication failures when connecting EMS to our Windows Server Domain Controllers via secure LDAPS (Port 636). Real-time debugging via the adconnector.log file revealed that the authentication loop continuously failed with the following explicit Windows SChannel error wrapper:LDAP Result Code 49 "Invalid Credentials": 80090302: LdapErr: DSID-0C09089D, comment: AcceptSecurityContext error, data 1In the Windows security subsystem, Windows Error Code 80090302 translates directly to SEC_E_UNSUPPORTED_FUNCTION. This protocol violation occurs because the FortiClient EMS backend engine is compiled to automatically encapsulate its Active Directory GUI bind traffic using an NTLM/SPNEGO negotiated token handshake.The Troubleshooting Barrier

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

Hi there, I have few expectation with Ipsec version 2 which might support. If user is setting idle it means neither sending traffic nor receiving  user must be disconnected as per the set timeout , what is the default time out and how I set as per my need. Same user cannot be login in multiple device. how can I achieve it only single user can login in one device. I have two ISPs, I want if one ISP goes down users must not be experiencing any issue and users must be shifted to another link automatically. (do we need to create two separate tunnel and policy and all configuration must be same - like policy,routing,access) or any other way I can achive. I have observed in remote IPsec version 2  if MFA is configured for users until user enter OTP till then internet gets disconnected, however tunnel is configured in split mode. Anyone has faced this issue, please share your experience can I achieve in Foritgate Remote Ipsec version 2

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

Hello Fortinet Community,We are facing a persistent issue with a FortiAP 231K that fails to come online on our FortiGate 60E. Interestingly, the same behavior has also been observed on the replacement FortiAP received through RMA.We would appreciate guidance from the community or Fortinet engineers who may have encountered similar symptoms.EnvironmentFortiGate: FortiGate 60E FortiOS: 7.4.12 Access Point: FortiAP 231K AP management: FortiGate wireless controller Original testing topology: FortiGate -> PoE switch -> FortiAP 231K Replacement AP testing setup: PoE injector -> FortiAP 231K, with a laptop connected for testing and a serial console connection through PuTTYWe have checked the official FortiAP and FortiOS Compatibility Matrix and are investigating the issue using the supported firmware combination listed for the FortiAP 231K and FortiOS 7.4.12.Issue ObservedThe FortiAP boots successfully but does not come online or establish a stable CAPWAP connection with the FortiGat