FortiGate IKEv2 VPN with Microsoft NPS, Active Directory and FortiToken MFA
Build an AD-backed IKEv2 remote-access VPN with Microsoft NPS/RADIUS, mandatory FortiToken MFA, and least-privilege access policies based on AD group membership.
Configuration & best practices
3FortiGate IPsec IKEv2 VPN with FortiToken MFA and local users
Configure and verify a FortiGate dial-up IKEv2 VPN using local users, EAP-MSCHAPv2, FortiToken Mobile, and the free FortiClient VPN.
Configure FortiGate IKEv2 remote-access VPN with LDAP and EAP-TTLS
Configure a FortiGate IKEv2 dial-up VPN using LDAP-backed AD groups, FortiClient EAP-TTLS and least-privilege firewall access.
Troubleshooting
4Recover a failed FortiOS upgrade using the backup firmware partition
Recover a FortiGate that loses LAN connectivity after a firmware jump by booting its working backup partition from the serial console and then following the verified upgrade path.
FortiToken activation email fails: FortiGate SMTP local-out source IP
Troubleshoot FortiToken enrollment emails that time out on SMTP TCP/465 when FortiGate local-out traffic uses an unsuitable WAN source address.
FortiClient IKEv2 VPN fails after partial XML import: missing PSK
Diagnose an IKEv2 connection failure after importing a sanitized FortiClient XML profile that omits the pre-shared key.
FortiGate IPsec tunnel is up but traffic does not pass
Systematically troubleshoot a FortiGate IPsec tunnel that is established but does not carry the expected application or subnet traffic.
Commands & references
6FortiGate diagnose debug flow
Use FortiGate debug flow to trace how traffic is processed, routed, NATed, accepted, or denied by FortiOS.
FortiGate diagnose sniffer packet
Capture and inspect packets directly on a FortiGate to determine whether traffic enters, exits, or crosses expected interfaces.
FortiGate diagnose vpn tunnel list
Inspect FortiGate IPsec tunnel security associations, selectors, state, and packet counters from the CLI.
FortiGate execute ping and ping-options
Use FortiGate ping and ping-options to test IP reachability with controlled source, interface, timeout, packet size, and SD-WAN behaviour.
FortiGate get router info routing-table all
Display the active FortiGate routing table and interpret connected, static, dynamic, and default routes during connectivity troubleshooting.
FortiGate get system arp
Display the FortiGate ARP table to map IPv4 addresses to learned MAC addresses and interfaces during local-network troubleshooting.
Guided learning
View all →