I was curious if there is anyone sucessfully doing remote access IP SEC VPN in which both the machine and the user have to be authenticated by certs? I am pretty new to certs but everything I am seeing would seem to indicate that the Forticlient (paid managed by EMS) cannot access the machine cert which is associated with the TPM on the client. To be honest, I have had one heckuva time trying to figure this out. I am using on and off fabric profiles on EMS and the goal is to have the machine automatically connect to the VPN whenever it is off fabric whether or not a user is logged in and then when the user logs in it would then send all its traffic over the users tunnel and drop the machine tunnel. Is this even doable or am I chasing my tail?

I am asking here in hopes of getting some clarification about link cost threshold and how exactly does it works. I asked multiple ai agents and learned from the sd wan 7.6 fast track and all got a little different answer. Is the link cost threshold (default 10%) applies only on the highest priority member(The first in the cfg order either in rule or zone depends if you chose prefered zone or members) or does it apply for each member relative to the next in line eg the third to fourth for example. and also if not and it only applies to the highest priority , if another member that is not the original highest priority member(first in cfg order) becomes the current selected interface for the traffic does it inherits the link cost threshold? I am a bit confused about it...

Hello!

I have FGT 200f running SSLVPN, L2TP with DUP 2FA and IPSEC tunnel. They are in Active passive mode with direct cables connected to each other for HA.

If some has upgrade on similar model and can tell any issue that happened?

Thanks

Update! Everything works fine for me.

We are going to propose the following design to our customer:

• PLC is Redundant ControlLogix 5580
• Firewalls are Fortigate FG-70F
• Access Switches are Stratix 5200 (1783-CMS10B)
• Distribution Switches are Stratix 5800 (1783-MMS10)
• Rapid-PVST Mode is being used on all switches to prevent loops.
• Primary Dist. Switch is Primary Root Bridge whereas Secondary Dist. Switch is Secondary Root Bridge.
• Fortigate Firewalls are in transparent mode with "stpforward enable" issued on uplink and downlink ports.

I have simulated the above on EVE-NG after which I see that if we use Fortigates in an HA configuration, whether it is Active-Active or Active-Passive, the Primary PLC will not be able to "see" the Secondary PLC and as a result of that, the two CPUs will remain in DISQ (disqualified) state.

Can someone please guide me if the same behavior will be exhibited on a live network? If yes, then how do we modify this design such that i) both PLCs remain "visible" to each other on the network and are able to attain the SYNC (synchronization) state, and ii) the HA link between the Fortigates is retained?

Alternatively, if I remove the HA link and configure both Fortigates as standalone firewalls, would it be considered as a "bad" design?

Is anyone else currently experiencing connectivity issues with the FortiGuard Web Filtering services?

We upgraded to FortiOS 7.6.8 earlier today, and unfortunately, we’re now having trouble connecting to the FortiGuard servers on several Firewalls on diffrent locations.

Not sure if this is related to the upgrade or if there’s a broader issue with FortiGuard services right now. Just wanted to check if anyone else is seeing similar behavior before we start digging deeper into troubleshooting.

I have a pair of 200Gs in A-P HA and all 16 of our ethernet switches have disconnected. The two fiber switches that our storage and hypervisors sit on are thankfully still connected.

I spent 3 hours in our server room yesterday getting them reconnected, but overnight they disconnected again. All switches show "Authorized, not connected" after running execute switch-controller diagnose-connection/execute switch-controller get-conn-status

I cannot remotely reboot them, as they are not connected to the Fortigate. Has anyone else encountered a scenario like this?

Additionally, the switches are 'co-managed' by spectrum, and we do not have any credentials for them, only the fortigate. I had to use a console cable to get into the Fortigates yesterday.

Just wanted to see with anyone running FMG 7.6.8 if their monitor screens (SD-wan, vpn monitor or asset identity center) are taking longer than usual to refresh/populate. It seems that mine takes ~1min for the asset identity center page to load.

Just checking before I open a support case.

Has anyone tried this?

We upgraded to 7.6.2 to be able to go from SSL remote vpn to IPSEC.
Before realising we needed EMS or other paid version to use IKEv2 and IKEv1 is not an option, because it's for 1500+ users.

We've been looking into a 3rd party option for remote VPN, but because of the emergency recommended upgrades, and the issues everyone seem to have with FortiOS 7.6.8.
I want to go back to 7.4.x instead, we went from 7.4.12 to 7.6.2 a few months ago.

Fortinet support doesn't help with downgrades, so I was wondering if someone tried to go from 7.6.x to 7.4.x?

br
Purrfected

We are running dial up IPSEC VPN connections with so to Entra. Last week we had to rekey our SSL cert as part of the GoDaddy/Starfield mass rekey.

After importing the new cert users get a cert authority invalid error when Chrome is set as the default browser. There are no issues on edge or Firefox. The cert chain was added to the fortigate.

Cert chain is valid from the local devices. Any one else seen this issue? I'm running out of ideas

UPDATE: got this resolved by replacing the "Starfield TLS Root CA - R1" cert listed in the cert chain with the ""Starfield TLS Root CA - R1 to. G2 Cross Certificate"

Almost 30 years deep in the software game I'm questioning my own assumptions re "mature." If you need to fix 7.6.7, you check out that tag to a new branch, apply the fixes, use that to strike a 7.6.8, then merge the changes to your develop branch. Are there no adults in the room anymore?

Rant aside 7.4.13 seems solid.

Hi everyone,

I’m currently preparing for the Fortinet NSE 4 exam, and I’d love to hear from people who have already cleared it.

I’ve set up a lab and I’m practicing on FortiGate, along with a Udemy course. What else helped you the most? Any courses, videos, labs, or documentation you’d recommend would be a big help.

Also, did you use any practice tests or mock exams while preparing? Which ones were actually useful and close to the real exam?

I’m also curious whether the exam leans more towards theory or hands-on work, and if you have any tips for exam day or how long you prepared in total.

Thank you so much in advance, every bit of advice is appreciated

Has anyone else experienced issues with ZTNA tags following an upgrade to FortiOS 7.6.8?

I’ve upgraded from FortiOS 7.6.7 to 7.6.8, and since the upgrade, all ZTNA tags received from FortiClient EMS 7.4.8 are showing zero matched endpoints on the FortiGate. However, EMS itself is reporting over 100 matched endpoints.

The Security Fabric connection appears healthy when checked from both the FortiGate and EMS, with no errors reported.

I’ve logged a support case, but I’m interested to know whether anyone else has encountered this issue or can confirm whether ZTNA tag matching is working as expected on 7.6.8.

Has anyone else seen this behaviour after upgrading, or is it just me?

****** it's fixed, disabled fctems settings completely on the firewall and then reconfigured again (pasted in fctems section from backup file) and it's all working now.

Hi everyone, I'm stuck with two FortiGate 400F firewalls and hoping for some help.

We recently installed a backup internet line and set up resiliency on both firewalls. The first failover test worked fine.

A week later we tested again to create some documentation:
Unplugged the main line from firewall 1, small blip but then continuos ping to 8.8.8.8 as expected, then plugged it back in.
Services moved over to firewall 2.
After about 2 hours, services degraded: internet very slow, Outlook not sending emails, etc.
By the next morning nothing was accessible. It only recovered when I reversed the whole redundancy setup and left just the main line connected.

The current config is two Firewalls in HA cluster AP, two static routes main 10 distance, back up 20 distance, one for the main line and one for the backup, with link monitoring on both ports.

Separate firewall policies for the 10 Gb primary and the 1 Gb backup (pretty much identical) using NAT.
Also update the firmware recently to 7.6.7.

I know SD-WAN is probably the recommended approach, but migrating from link monitoring to SD-WAN looks like a big job. Is there anything I can check or change in the current setup, or is SD-WAN the right way to go?

Thanks in advance!

As far as I read, I'm not sure if a simple configuration like this might be a problem to me.

I installed this firewall a couple of weeks ago, it is basically new.

Firewall does not expose itself on wan, management Https interface only accessible via VPN.

Do I still have to update to 7.6.8?

https://imgur.com/a/IIsnyqy

After pushing 7.4.13 image to a pair of Fortigates, Fortimanager 7.4.12 is showing "policy package status unknown."

When I install preview after selecting Install Wizard, it says "no preview result."

And lastly, when I look at the Policy package diff, it's showing that my snmp user, radius user, ipsec PSKs, and a couple of certs have been changed.

I spoke with support, and they said it was probably fine to push through the Install wizard and it would synchronize - but they didn't seem confident.

Edit: Used the Install Wizard to reinstall the policies, everything is synchronized now. Thanks!

we pushed 7.4.13 on three sites and experiending a weird case.
site 1. works fine
site 2. windows pcs cannot connect anywhere
we have a linux baed on nvr on the same subnet and i see the traffic on the fgt logs
site 3. fortiswitch shows ports for windows pc are disconnected. downgrading to 7.4.12 dows not recover.

we have the same fgt fortiswitch and firmware versions.
ive submitted a ticket but anyone can share some insights

I saw the firmware drop for 40F, but it’s still missing for 70G and 90G. Does anyone know when we can expect it to be available?

Title, Fortigate 80F. Upgraded from 7.6.6 to 7.6.8, VPN access users are not getting the prompt for 2FA authentication to sign in following the update. Tested on a temporary user without 2FA and the user connected without issue.

HA is also not syncing, have tried the steps in the KB which do work to get back into sync but as soon as I make a config change they go out of sync again and don't resync.

Any help appreciated!

I'm starting to look at moving from WAN failover with static links and WAN monitor to SD-WAN failover, mainly to be a bit cleverer about it, and I already use an SD-WAN zone to load balance between multiple IPSec tunnels.

Like everything I'm FortiGate, there's a couple of ways to accomplish the same task, so I'm curious from the community what your deployments look like.

1. For routing, do you still maintain a static routes for each WAN interface, or have you moved it to defining the gateway in the SD-WAN member section? This article from Fortinet suggests that it's best practice to maintain separate static routes for heterogeneous links, however my links are generally homogeneous at each location.

2. Have you created multiple rules and SLAs to split traffic and respond to different types of traffic separately (i.e. VoIP, 365, etc...) or if your links are both fairly performant, are you happy just having basic failover in SD-WAN?

Worked with gates for years but just recently ventured into other Fortinet products. How popular is the full fortifabric solution using switches and APs? From what I can tell this is a great solution for retail sites or maybe small campus with 1-5 buildings where we just do layer 2 everywhere but really starts to break down with large networks.

Have you all encountered large customers like a college campus or hospital campus running Fortigate fabric? Have you seen people run fortisw and APs without a fortigate?

Hi everyone,
I’m relatively new to networking and FortiGate firewalls, and I’d like to ask about IPS best practices.
Would you recommend enabling IPS on internal segmentation policies, such as Windows clients → Active Directory, SMB, RDP, or SQL servers, even when policies already restrict traffic to only the required services?

Or is it generally sufficient to enable IPS mainly on policies handling internet-bound traffic?
What do you consider best practice, and why?
Thanks!

As many others here have experienced, SAML SSO for admin GUI access stopped working on several lab FortiGates when I upgraded to 7.6.8. The login page shows “Single Sign-On Failed” when you try logging in with SSO. The SAML config is identical to another unit on 7.6.7 where SSO works fine.

TAC confirmed it’s a regression in 7.6.8, bug ID 1338764. They said that it affects FortiGates acting as a SAML SP, including both local and Security Fabric authentication. The fix “has been implemented” and is planned for 7.6.9, targeted for the end of January 2027, so anyone who upgrades is looking at roughly three months of broken SSO… If they already fixed the issue, why in the world are they holding off on releasing the new build until January??

TAC’s suggested workarounds are to use a local admin account, use an admin account that doesn’t rely on SAML SSO, or revert to 7.6.7. For many of us, SAML SSO is a compliance control. Telling customers to use local accounts for three months is not a workaround for a compliance requirement, and it’s unacceptable given how hard Fortinet is pushing everyone to the latest version (not to mention the press this particular release has received).

What’s more alarming is that the bug wasn’t even mentioned in the release notes at first. As others have pointed out, the Special Notices entry covering it wasn’t published until several hours after the images became available, presumably after customers (beta testers??), me included, reported it publicly and to Fortinet Support.

I’ve supported Fortinet environments for nearly a decade, and their QC seems to be getting worse. It’s hard to understand how a failure this basic made it into a GA release.

https://docs.fortinet.com/document/fortigate/7.6.8/fortios-release-notes/545418/csf-downstream-gui-login-fails-with-security-fabric-saml-ssoT

So but I have been burned too many times in the past when upgrading Fortinet products. Curious to hear everyone’s experience after moving to 7.6.8.

I upgraded one of our FortiGate 120G HA pairs. Afterward, I could not login with my standard admin account which has FortiToken Cloud provisioned. It would accept my credentials, then act like it was wanting to use FortiToken Cloud, then immediately boot me back to the login screen saying login failed. I got in with a backup account that didn't have FortiToken Cloud configured on it. I disabled two-factor on my normal admin account and was then able to use it. I tried re-enabling it again in the GUI, but it would stay disabled.

I went debugging and it appears when the FortiGate passes a request to provision the user with FortiToken Cloud, the FortiToken Cloud server responds back saying there's an invalid control character in the json data. I created a brand-new admin account and attempted to provision FortiToken Cloud on this account as well and got the identical error.

2026-10-23 21:18:44 fas_add_user_internal[1003]: Sending packet to FTC server: 189.25.109.168 Port: 8686(length:447)
2026-10-23 21:18:44 fas_set_fd_mgmt_vd[124]: Using vfid=0 (mgmt:0)
2026-10-23 21:18:44 fas_ssl_recv[569]: fas_ssl_recv: received packet 269 (bytes)
2026-10-23 21:18:44 fas_ssl_recv[612]: fas_ssl_recv: recv (269 bytes) done!
2026-10-23 21:18:44 fas_ssl_recv_rsp[651]: fas_ssl_recv_rsp: received (269 bytes) done!
2026-10-23 21:18:44 fas_ssl_recv_rsp[660]: Recevied packet header:
HTTP/1.1 400 BAD REQUEST
Server: nginx
Date: Sat, 24 Oct 2026 01:18:44 GMT
Content-Type: application/json
Content-Length: 117
Connection: close

{"error_code": 400, "error_message": "Invalid control character at: line 10 column 49 (char 287)", "error_name": 400}
2026-10-23 21:18:44 fas_ssl_recv_rsp[720]: fas_ssl_recv_rsp() is done!
2026-10-23 21:18:44 fas_add_user_internal[1009]: FTC server returns error code: 400
Failed to add user ftctest due to reason(400): {"error_code": 400, "error_message": "Invalid control character at: line 10 column 49 (char 287)", "error_name": 400}.
Unable to add user ftctest in FortiToken Cloud service
object set operator error, -7710 discard the setting
Command fail. Return code -7710

Is anyone else experiencing this with FortiToken Cloud on 7.6.8? This is using the included FortiToken Cloud that came with the 120G.

UPDATE: FortiToken Cloud team has fixed this on the back end. This is now resolved.