FortiGate IKEv2 VPN with Microsoft NPS, Active Directory and FortiToken MFA
Build an AD-backed IKEv2 remote-access VPN with Microsoft NPS/RADIUS, mandatory FortiToken MFA, and least-privilege access policies based on AD group membership.
Knowledge Base
Search practical IT knowledge
Search titles, full article content, commands, error messages, vendors, products, versions and tags.
22 results
FortiGate IPsec IKEv2 VPN with FortiToken MFA and local users
Configure and verify a FortiGate dial-up IKEv2 VPN using local users, EAP-MSCHAPv2, FortiToken Mobile, and the free FortiClient VPN.
Recover a failed FortiOS upgrade using the backup firmware partition
Recover a FortiGate that loses LAN connectivity after a firmware jump by booting its working backup partition from the serial console and then following the verified upgrade path.
FortiToken activation email fails: FortiGate SMTP local-out source IP
Troubleshoot FortiToken enrollment emails that time out on SMTP TCP/465 when FortiGate local-out traffic uses an unsuitable WAN source address.
Configure FortiGate IKEv2 remote-access VPN with LDAP and EAP-TTLS
Configure a FortiGate IKEv2 dial-up VPN using LDAP-backed AD groups, FortiClient EAP-TTLS and least-privilege firewall access.
FortiClient IKEv2 VPN fails after partial XML import: missing PSK
Diagnose an IKEv2 connection failure after importing a sanitized FortiClient XML profile that omits the pre-shared key.
HPE MSA 2040: recover a forgotten administrator password using the local USB CLI
Recover management access to an HPE MSA 2040 when administrator credentials are unknown, using physical USB CLI access and the restoreusers recovery mechanism; distinguish user recovery from a factory reset.
Build a segmented small business network in Cisco Packet Tracer
Build and validate three VLANs, inter-VLAN routing, DHCP, internal and guest DNS, NAT/PAT and a minimum-access guest policy in a Cisco Packet Tracer lab.
Client receives a guest VLAN address after an access port is assigned to the wrong VLAN
Trace a client that loses access to an internal web service through its DHCP lease, switch access VLAN, trunk and router ACL, then validate the port correction.
Lenovo DE Series with VMware ESXi over SAS: fix single-path visibility, ALUA/NMP claiming and controller management
Troubleshoot Lenovo ThinkSystem DE Series storage connected directly to VMware ESXi over SAS when LUNs appear with only one path, devices show degraded status, volumes are not on the preferred controller, or ESXi reports HPP/NMP claim-rule conflicts.
ESXi Host Certificate Status shows Expiration imminent
Resolve the ESXi Host Certificate Status alarm when a VMCA-signed host certificate is approaching expiration in vCenter Server.
Meraki mesh repeater fails 802.1X because the gateway AP is missing from Windows NPS RADIUS Clients
Troubleshoot a Cisco Meraki MR mesh repeater where normal SSIDs work but an Enterprise/802.1X SSID fails with RADIUS timeouts because the gateway AP is not registered as a RADIUS Client in Windows Network Policy Server.
vCenter Certificate Status alarm caused by expired BACKUP_STORE certificates
Resolve a persistent vCenter Certificate Status alarm when active certificates are valid but expired historical certificates remain in the VECS BACKUP_STORE.
vCenter Server certificate stores and common certificate alarms
Reference guide to the main vCenter Server certificate stores, what each certificate is used for, and which alarm or troubleshooting path normally applies.
vCenter virtual disks show 0 GB or blank properties due to SSL trust mismatch
Troubleshoot vCenter Server when VM disk capacity or disk properties appear as 0 GB, blank, or unavailable while the same VMDKs display correctly in the ESXi Host Client.
FortiGate diagnose debug flow
Use FortiGate debug flow to trace how traffic is processed, routed, NATed, accepted, or denied by FortiOS.
FortiGate diagnose sniffer packet
Capture and inspect packets directly on a FortiGate to determine whether traffic enters, exits, or crosses expected interfaces.
FortiGate diagnose vpn tunnel list
Inspect FortiGate IPsec tunnel security associations, selectors, state, and packet counters from the CLI.
FortiGate execute ping and ping-options
Use FortiGate ping and ping-options to test IP reachability with controlled source, interface, timeout, packet size, and SD-WAN behaviour.
FortiGate get router info routing-table all
Display the active FortiGate routing table and interpret connected, static, dynamic, and default routes during connectivity troubleshooting.
FortiGate get system arp
Display the FortiGate ARP table to map IPv4 addresses to learned MAC addresses and interfaces during local-network troubleshooting.
FortiGate IPsec tunnel is up but traffic does not pass
Systematically troubleshoot a FortiGate IPsec tunnel that is established but does not carry the expected application or subnet traffic.