My boss basically forced me to get the NSE4. Six months later I'm glad he did, for a reason he definitely didnt intend.

I do desktop support at a mid size logistics company. Ticket queue, printers, the occasional switch port. Fine job, not a career.

Management here worships certs. Not skills, not tickets closed, certs. There's an actual matrix on SharePoint mapping acronyms to pay bands. My manager told me straight up that my raise was blocked until I had "something networking". He wanted NSE4 because we run Fortinet everywhere.

I thought it was silly, I said I dont touch the firewalls, we have a network team for that, let me do the CCNA at least. He said the matrix says NSE4. So I studied for two months on my own time, and passed first try.

Got the raise. Four percent. no big deal.

Then in March they outsourced the entire network team to an MSP. Eleven people gone. And because I was the only person left in the building with a Fortinet cert, I wasnt just kept, they moved me into the role the MSP was supposed to be overseeing. New title and thirty percent bump, and I got the job i was working towards without even intending to do so.

TL;DR: got strong armed into a cert I didn't want, then it was the only reason I survived a layoff. The system is dumb, learn to play it anyway.

What's the best way to get back in? It's a Gateway, 7 switches, and 65 APs. I've asked the client who sold them the gear it's been through the hands of 2 MSPs and no one seems to know passwords. Transitional passwords between the last 2 MSPs (not ours) are not right.

I want to work veryhard to make sure we don't brick this stuff and get into a mess.

It's newer gear, so unlikely the maintainer account is still in place on this firmware.

How do we go about getting access back/proving ownership to Fortinet?

EDIT: We were able to track down credentials from MSP 2. Thanks for all the responses.

Managing FortiGate across 100+ sites and starting to think about automation. Curious what people are actually doing vs what's theoretically possible:

1. Are you using FortiGate's REST API, Ansible (fortinet.fortios collection), or something else for automation?
2. What's your most useful script or playbook — what problem does it actually solve day to day?
3. Is FortiManager's built-in API enough for most use cases or do you still need to write custom Python on top of it?
4. For someone learning — should they start with the REST API directly, or go straight to Ansible?
5. Has knowing FortiGate automation specifically made you more attractive to employers or is it still too niche?

****Resolved

Forticlient 7.4.3 1.8758

Just started happening, no configuration changes.

Edge opens, completed login and MFA Auth, hangs at https://login.microsoftonline.com/common/SAS/ProcessAuth and never sends the completed auth back to forticlient.

Checking if anyone else is experiencing this.

Failure reason on Entra side: The session has expired or is invalid due to re-authentication checks by conditional access.

CA policies same as they have ever been.

We have very few users so haven't gone EMS yet.

Thanks

Hello everyone,

If I have lets say a Hub and spokes with 2 ISPs. For the ADVPN I will have 4 tunnels between each sopke and hub 1-1, 1-2, 2-1, 2-2....right?

Anyways my question is how is asymmetrical routing handle here? Hub might think one overlay is better, spoke might chose a different one. Hows is this handled?

Hello everyone! I'm trying to configure RA IPSec VPN with IKEv2. My issue is, the gateway looks like thiks:

edit "Dialup_cert_2"

set type dynamic

set interface "VL1461"

set ike-version 2

set authmethod signature

set net-device disable

set mode-cfg enable

set ipv4-dns-server1 192.168.104.252

set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256

set dpd on-idle

set dhgrp 5 14 20

set eap enable

set eap-identity send-request

set eap-cert-auth enable

set cert-peer-username-validation cn

set certificate "wildcard"

set peer "IKE2_TEST"

set ipv4-start-ip 10.0.1.1

set ipv4-end-ip 10.0.1.254

set ipv4-netmask 255.255.255.0

set dpd-retryinterval 60

next

end

My peer looks like this:

sh user peer IKE2_TEST

config user peer

edit "IKE2_TEST"

set ca "CA_Cert_4"

set cn "O=A, C=B, OU=C"

next

end

And everytime I try to connect to the gateway on my iPhone, I get the following debug:

ike V=root:0:Dialup_cert_2:26319: peer identifier IPV4_ADDR 192.168.0.72
ike V=root:0:Dialup_cert_2:26319: re-validate gw ID
ike V=root:0:Dialup_cert_2:26319: gw validation failed

When I try to actually input certificate fields in the localid, I get the following:

ike V=root:0:Dialup_cert_2:26341: received peer identifier FQDN 'O=A,C=B,OU=C '
ike V=root:0:Dialup_cert_2:26341: re-validate gw ID
ike V=root:0:Dialup_cert_2:26341: gw validation failed

I do understand that the firewall reads it like a string, not like actual certificate fields. My question is: is there a way make FortiClient send it correctly? Perhaps some service characters or something like that. Otherwise I'll be rolling back to IKEv1.

Any help is appreciated! Thanks in advance!

Tried to setup a 90G for the first time like many other models thought it would be straight froward , was welcome with a mandatory fortigate registration for forticare. I wouldn't mind this infact I prefer it to link it straight away except I tried two methods to give it internet on the WAN port (even a phone ethernet tethering) and neither worked to find the reseller and YOU CAN'T SKIP IT THIS SCREEN UNLESS YOU USE CONSOLE CONNECTION.

So you are stuck unless you have a console cable to turn off enforcement but of course this does not come in the box, is this a joke? Did this really get signed off without considering a bypass method for the customer?

It's idiotic, heres my constructive feedback. Either give the option to skip it via Web GUI or stop being cheap and supply the cable for console connection. You already charge a handling fee I'm sure that can be included in the cost.

Has anyone else had it fail to get a WAN connection from the start and had this annoying issue?

Hi All

Hope anyone here is able to assist as logging issues with forti is more frustrating than dealing with this issue.

Layout.
Client VPN (EMS and free)
Firewall to FAC to AD

I created a new IPSec with IKEv2, I tested and got it all working then after a bit I had to VPN in again and it didn't work.
I logged on to the AD and checked the account password was not expired and the account was not locked out.
Tried VPN again and it times out.
I then reset the AD account password to the same as it was and the VPN worked.

The next day the same thing happened.
I checked the FAC and the Firewall logs and all logs show that the authentication was successful but the FortiClient timed out.

Timeout it set to 60.

This is happening on the free client and EMS. And I cant find any logs showing anything real in terms of there being an issue.

Anyone ever experience anything similar?

Im happy to share redacted configs if anyone needs.

Hi, we use Transparent Proxy Policies for destination FQDN's only, but I can't really understand why would we do it if we can just stay with the IPv4 Firewall Policy and apply all security profiles there.

Can someone explain the differences in behaviors? as traffic needs to match the IPv4 Policy first anyway and I can't see any real benefit just management overhead.

Hi everyone,

I recently stepped into managing a live, deployed FortiWeb environment as my first time ever working with the appliance. I've completed a couple of official courses, but honestly, they only covered about 30% to 40% of what I'm dealing with day-to-day. I don't have a formal development or heavy AppSec background, and some colleagues mentioned that dev experience is needed, which has me feeling a bit overwhelmed and clueless about what's actually happening under the hood.

Right now, I'm diving heavily into the official administration documentation because it seems like the only place that covers the device end-to-end. Specifically, I'm currently facing practical operational tasks like onboarding new websites into production.

Could the community share some guidance and best practices on how to bridge this gap and get truly proficient? I'm looking for:

• Reading & Resource Roadmap: Beyond the official admin guide, what documentation sections, admin guides, or troubleshooting references are absolute must-reads to cover almost everything comprehensively?
• Handling False Positives: What are the most common beginner mistakes when tuning false positives, and how do you handle them safely without accidentally lowering your security posture?
• Essential Skills: For someone without a software development background, what specific concepts (HTTP protocols, regular expressions, JSON/XML structures) do I need to master to feel confident managing WAF rules?

Any advice, recommended workflows, or "lessons learned" from seasoned FortiWeb admins would be hugely appreciated. Thanks!

I would try to deploy some Fortigate SSL vpn with forticlient. But I wanna have some extra confirmation from you guys whether they are still free as to date.

I’m working on a Hub‑Spoke IPVPN design across 5 offices, all connected to a central FortiGate hub using IPVPN + BGP (Tunnel‑A). Everything has been stable for years.

Recently I added a second ISP at the hub, and I’m trying to introduce redundancy for the Hub‑Spoke IPVPN topology.

What I built

• At each spoke, I created a second IPVPN tunnel (Tunnel‑B) pointing to the hub’s second ISP.
• Both tunnels (A and B) come up fine on both sides.
• At the hub, both ISP links are in SD‑WAN interface.
• At the spokes, both IPVPN tunnels are in an SD‑WAN zone called IPVPN, with SLA monitoring pointing at servers inside the hub LAN.
• The idea is: Tunnel‑A active → Tunnel‑B standby → automatic failover if Tunnel‑A or ISP‑A goes down.

The problem

Even though both tunnels are up:

• SLA shows Tunnel‑A = alive, Tunnel‑B = dead (but up).
• Tunnel‑B cannot reach the hub LAN for SLA probes.
• If I manually take Tunnel‑A down, traffic does NOT fail over to Tunnel‑B. Instead, the spoke sends traffic out wan1 (Internet) because SD‑WAN marks the IPVPN zone unhealthy.

What I’ve verified

• Both tunnels establish Phase1/Phase2 correctly.
• Hub has separate dial‑in configs for both tunnels.
• Hub firewall policies include both tunnel interfaces.
• Spokes have both tunnels in the IPVPN SD‑WAN zone.
• Static routes exist for the hub LAN.

What I’m trying to achieve

A clean failover design:

Tunnel‑A → Tunnel‑B → Internet (only if both tunnels fail)

Has anyone successfully built dual‑IPVPN failover on FortiGate using SD‑WAN?
Did you run into SLA issues where the second tunnel can’t reach the hub LAN even though the tunnel is up?

Any guidance or examples would be appreciated.

Thanks!

EDIT: On the Hub side, the IPVPN tunnels are Dialup-User and are separated (not members of SDWAN interface) while on the spoke side, the IPVPN tunnels are members of SDWAN interface.

My company is going through a merger and we have Ayaka SDWAN and firewalls on one side and FortiNet FortiGate on the other side for SDWAN and Internet points of presence.

I’m currently reviewing both sides and meeting with vendors, but I’m interested to see real world applications on if one is better than the other. Or is one more preferred where a major enterprise with closer to 100 sites.

We don’t use either one of them for client VPN access. This is strictly just for facility and site Internet, and SDWAN

I'm just looking at setting up a web-filter only. Not doing anything more than blocking certain built in web-filtering groups. Pretty easy.

This is just doing standard certificate-inspection. On regular PC's when a page is blocked you get the Fortinet blocked page. Looks good.

On mobiles however if a page is blocked you get an error page instead. You can click 'ignore' or 'proceed anyway' and it then get's the Fortinet blocked page but is there a way around this so it instead displays the Fortinet blocked page by default?

I've tried changing web-filtering to proxy-mode as suggested by Fortinet help pages but no luck. same issue.

Its not a huge issue as it's only blocked pages it displays the error for but it's still a bit anoying :)

Install the certificate is an obvious answer but I don't want to have to do this on every device as this will be for a guest type network.

thanks!

Dear all

I am trying to use the (yes, limited) ACME client on Fortigate to get a TLS cert for a specific domain.

Unfortunately, tls-alpn-01 doesn't work (see below) as tcp/443 is already in use and http-01 isn't kicking in. And I am wondering why.

Running FortiOS 7.4.12 on a 200F active/passive cluster.

Configuration:

• The FQDN is sub.sub.domain.com and resolves on public IP B.
• Public IP B is configured as secondary IP on the WAN interface of the Fortigate.
• The secondary IP has only PING activated, no other administrative access
• The public IP A (same subnet) is the primary IP on the WAN interface
• Public IP A has https as administrative access (trusted hosts and local-in-policies, and not running on tcp/443)
• Both tcp/443 and tcp/80 are not available for public IP A
• tcp/80 is available for public IP B, but tcp/443 is not (IPSec Dialup is listening to it).

Problem:

• According to the acme logs, fortigate tries to get the cert chain and fails - using tls-alpn-01, but never http-01.
• The IP used according to logs is the correct one (public IP B).
• According to the documentation (https://docs.fortinet.com/document/fortigate/7.4.12/administration-guide/822087), http-01 should be used, at least at some point.

Do I really need to use another port for IPsec DialUp over TCP when I want to use ACME? Anyone ever managed to get it running using http-01 instead of tls-alpn-01?

(Using acme.sh and then API might be an option later on, but that is still in discussion and might never be implemented)

Thanks a lot

We recently migrated to FortiClient (Managed by FortiClient EMS) with IPSec VPN, overall it's been successful for 90% of our users. However, we have a few users where either the VPN will drop completely or it will stay connected, but traffic will stop flowing so office apps for example stop working.

We are on 7.4.7 for Forticlient as the Fortigate is on 7.4.11, which sits behind another Fortigate that's on 7.4.8, we just port forward the required ports for the VPN to work. I know we could've done local in to due security policies and not need two set's of Fortigates, but we have a requirement for the remote access VPN to not reside on the primary firewall.

Anyways, I've made a new policy in FortiClient EMS that drops the MTU from 1280(default) to 1250 and that has fixed the VPN drops for a few users. I was just curious if anyone else has had similar issues on the IPSec VPN.

I'm absolutely frustrated with myself and fortinet test... Been working on Fortinet Gates for well over 15 years back when it was release 4.

back in January 2026, failed the NSE7 Enterprise 6.4 twice.

Today, failed NSE4 Admin 7.6

WTF am I doing wrong? I went through the online self training, yesterday, spent 11 hours to go through the whole training (accelerated).

No I haven't used test preps as with my past experience, they are shit !

what else could I do? I haven't done the labs but maybe I should? out of the 5 sections, the 3 worst are content inspection, routing and VPN.

Should I do the labs? will this help at all?

I build full fortinet infrastructure for customers including Gates, FortiSwitches, Analyzer and Manager, and then sometimes will setup SASE, FortiAuth and FortiNAC.

depressed ....