Forticlient versions
Author: f | 2025-04-24
Upgrading from previous FortiClient versions. FortiClient version supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient.
Product Download for FortiClient Android version
FortiClient always installs the Fortinet Security Fabric Agent (SFA) feature and enables the Vulnerability Scan feature by default. You can select to install one or more of the following options: Secure Remote Access: VPN components (IPsec and SSL) will be installed. Advanced Persistent Threat (APT) Components: FortiSandbox detection and quarantine features will be installed. Additional Security Features: Select one or more of the following to install them: AntiVirus, Web Filtering, Single Sign On, Application Firewall It is recommended to not install VPN components on Windows Server systems if not required. Upgrading from previous FortiClient versions FortiClient version 6.0.7 supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient. Downgrading to previous versions Downgrading FortiClient version 6.0.7 to previous FortiClient versions is not supported. Firmware image checksums The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support portal. After logging in, click on Download > Firmware Image Checksums, enter the image file name, including the extension, and select Get Checksum Code.
forticlient vpn version 6.2.6 - UpdateStar
Endpoint communication security improvement FortiClient Endpoint Management Server (EMS) and FortiClient 7.0.2 add an improvement to endpoint communication security. FortiClient connects to EMS using Telemetry to: Obtain license information Send endpoint and management information to EMS Receive endpoint configuration Receive endpoint commands, the results of which it can send to EMS Other similar tasks The connection from FortiClient to EMS uses TCP and TLS 1.3. During the SSL connection setup, EMS sends a server certificate to FortiClient. The certificate that EMS sends to FortiClient is the one configured in EMS Settings > Shared Settings > SSL certificate. See Adding an SSL certificate to FortiClient EMS. In 7.0.1 and earlier versions, FortiClient checks the certificate subject name received from EMS to confirm its validity. In 7.0.2, the certificate validation follows industry standards: Domain or fully qualified domain name (FQDN) that FortiClient is connecting to matches the domain to which the certificate is issued.Validation process correctly handles wildcards in the domain name in the certificate.Validation process considers both the common name (CN) in the subject or subject alternative name (SAN). The certificate expiry date is in the future. The certificate has not expired. The certificate issuer or the root certificate in the certificate chain is from a publicly trusted certificate authority (CA). Trusted CAs are read from the operating system. The new endpoint communication security feature allows the EMS administrator to configure endpoint profiles to take different actions based on the validity of the certificate that FortiClient receives from EMS. The EMS administrator configures this feature by enabling Use SSL certificate for Endpoint Control in EMS and configuring the desired Invalid Certificate Action for each endpoint profile. When Use SSL certificate for Endpoint Control is enabled, FortiClient 7.0.1 and earlier versions cannot connect to EMS. Following the recommended upgrade path as detailed in the following procedure is recommended to ensure that endpoints can connect to EMS. See Recommended upgrade path. The following describes the behavior when Use SSL certificate for Endpoint Control is enabled: If the EMS server certificate is valid, FortiClient silently connects without displaying a message. This is the same connection behavior from 7.0.1 and earlier versions. If the EMS server certificate is invalid: If the Invalid Certificate Action is configured as Warn, FortiClient displays a warning message to the end user. The message warns the user that the EMS to which FortiClient is attempting to connect to has provided an invalid server certificate. The message offers options to allow or deny the connection:If the user allows the connection, FortiClient connects to EMS and remembers the certificate for this EMS. FortiClient no longer prompts the user each time that it connects to this EMS.If the user denies the connection, FortiClient does not connect to EMS by canceling the connection. The next time that the user tries to connect to the same EMS and the server certificate is still invalid, FortiClient displays the same message again.If the Invalid Certificate Action is configured as Allow, FortiClient connects to EMS.If the Invalid CertificateFortiClient VPN version - Fortinet Community
Unit’s reserved management interface if they are configured. If you have not configured reserved management interfaces you can use the execute ha manage command to log into each cluster unit CLI.From the web-based manager, view FortiClient License status from the License Information dashboard widget and select Details to display the list of active FortiClient users connecting through that cluster unit. You can also see active FortiClient users by going to User & Device > Monitor > FortiClient.From the CLI you can use the execute FortiClient {list | info} command to display FortiClient license status and active FortiClient users.For example, use the following command to display the FortiClient license status of the cluster unit that you are logged into:execute forticlient infoMaximum FortiClient connections: unlimited. Licensed connections: 114NAC: 114WANOPT: 0Test: 0Other connections: IPsec: 0SSLVPN: 0Use the following command to display the list of active FortiClient users connecting through the cluster unit. The output shows the time the connection was established, the type of FortiClient connection, the name of the device, the user name of the person connecting, the FortiClient ID, the host operating system, and the source IP address of the session.execute forticlient listTIMESTAMP TYPE CONNECT-NAME USER CLIENT-ID HOST-OS SRC-IP20141017 09:13:33 NAC Gordon-PC Gordon 11F76E902611484A942E31439E428C5C MicrosoftWindows 7 , 64-bit Service Pack 1 (build 7601) 172.20.120.1020141017 09:11:55 NAC Gordon-PC 11F76E902611484A942E31439E428C5C Microsoft Windows 7 ,64-bit Service Pack 1 (build 7601) 172.20.120.1020141017 07:27:11 NAC Desktop11 Richie 9451C0B8EE3740AEB7019E920BB3761B MicrosoftWindows 7, 64-bit Service Pack 1 (build 7601) 172.20.120.20. Upgrading from previous FortiClient versions. FortiClient version supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient. Upgrading from previous FortiClient versions. FortiClient version supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient.Older versions of FortiClient (Windows) - Uptodown
Minimum system requirements 2.0 GHz 64-bit processor, six virtual CPUs 8 GB RAM (10 GB RAM or more is recommended) 40 GB free hard disk Gigabit (10/100/1000baseT) Ethernet adapter Internet access is recommended, but optional, during installation. SQL Server may require some dependencies to be downloaded over the internet. EMS also tries to download information about FortiClient signature updates from FortiGuard. You should only install FortiClient EMS and the default services for the operating system on the server. You should not install additional services on the same server as FortiClient EMS. FortiAnalyzer 7.4.0 and later 7.2.0 and later 7.0.0 and later Although EMS supports the listed FortiAnalyzer versions, confirming the compatibility between your FortiAnalyzer and FortiClient versions is recommended. Otherwise, not all features may be available. See the FortiClient Release Notes. FortiAuthenticator 6.6.0 and later 6.5.0 and later 6.4.0 and later 6.3.0 and later 6.2.0 and later 6.1.0 and later 6.0.0 and later FortiClient (Linux) 7.2.0 and later 7.0.2 and later FortiClient (macOS) 7.2.0 and later 7.0.2 and later FortiClient (Windows) 7.2.0 and later 7.0.2 and later FortiManager 7.4.0 and later 7.2.0 and later 7.0.0 and later FortiOS 7.4.0 and later 7.2.0 and later 7.0.0 and later (for zero trust network access, 7.0.6 or later is recommended) 6.4.0 and later FortiSandbox 4.4.0 and later 4.2.0 and later 4.0.0 and later 3.2.0 and laterFortiClient (free) download Windows version
DescriptionThis article describes how, when creating a new VPN connection with FortiClient v7.4.1 or v7.4.2 that uses IKEv2 as the protocol with the default VPN settings, NAT-T is disabled.ScopeUsers connecting from the same public IP or sitting behind a NAT device can experience symptoms such as no network access and one-way traffic (zero bytes received shown in FortiClient VPN status) after connecting to VPN when using IPSec VPN with IKEv2 as the protocol.SolutionTo enable NAT-Traversal on a connection profile, the following actions can be taken:Unmanaged or unlicensed FortiClient: On the FortiClient GUI, edit the VPN connection and go ahead with one of the following two options:Option 1: Change the 'Encapsulation' from default - 'IKE UDP Port' to 'Auto':Option 2: Take a backup of the configuration and use a text editor to edit the configuration file, change the value for 'nat_traversal' from 0 to 1. Save the file and restore the configuration to FortiClient:EMS managed FortiClient:If the Remote Access (VPN) profile is created in previous versions of EMS and migrated to EMS v7.4.1+, it will have the old settings until the profile is changed, updated, and saved.Any new IKEv2 VPN profile created in EMS v7.4.1+ with Encapsulation set as 'IKE UDP Port' will always have NAT-T=0 0 will automatically always set 0The solution is to set encapsulation to Auto (XML tag 2), which allows control of .FortiGate Configuration:If FortiGate is always behind NAT for dial-up IPSec tunnels, it is recommended to force-enable NAT on FortiOS IKEv2 tunnel settings.config vpn ipsec phase1-interface edit set nattraversal forced nextendNote: For the issue described in this document, the above configuration change (nattraversal set to forced) will not be helpful.macOS FortiClient:A related issue may affect macOS FortiClient v7.4.2, which will be resolved in FortiClient v7.4.3+. The issue is related to using a UDP port less thanFortiClient (free) download Mac version
Fortinet product support for FortiClient The following Fortinet products work together to support FortiClient: FortiClient EMS FortiManager FortiGate FortiAnalyzer FortiSandbox FortiClient EMS FortiClient EMS runs on a Windows server. EMS manages FortiClient endpoints by deploying FortiClient (Windows) and endpoint policies to endpoints, and the endpoints can connect FortiClient Telemetry to EMS. FortiClient endpoints can connect to EMS to participate in the Fortinet Security Fabric. FortiClient endpoints connect to EMS for real-time management. For information on EMS, see the FortiClient EMS Administration Guide. FortiManager FortiManager provides central FortiClient management for FortiGates that FortiManager manages. When endpoints are connected to managed FortiGates, you can use FortiManager to monitor endpoints from multiple FortiGates. For information on FortiManager, see the FortiManager Administration Guide. FortiGate FortiGate provides network security. EMS defines compliance verification rules for connected endpoints and communicates the rules to endpoints and the FortiGate. The FortiGate uses the rules and endpoint information from EMS to dynamically adjust security policies. When using FortiManager, FortiGates communicate between EMS and FortiManager. For information on FortiGate, see the FortiOS documentation. FortiAnalyzer FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports. FortiAnalyzer receives other FortiClient data from EMS. For information on FortiAnalyzer, see the FortiAnalyzer Administration Guide. FortiSandbox FortiSandbox offers capabilities to analyze new, previously unknown, and undetected virus samples in real time. Files sent to it are scanned first, using similar antivirus (AV) engine and signatures as are available on FortiOS and FortiClient. If the file is not detected but is an executable file, it is run in a Microsoft Windows virtual machine (VM) and monitored. The file is given a rating or score based on its activities and behavior in the VM. As FortiSandbox receives files for scanning from various sources, it collects and generates AV signatures for such samples. FortiClient periodically downloads the latest AV signatures from FortiSandbox, and applies them locally to all realtime and on-demand AV scanning. FortiClient supports connection to an on-premise FortiSandbox appliance or FortiClient Cloud Sandbox (PaaS). For more information, see the FortiSandbox. Upgrading from previous FortiClient versions. FortiClient version supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient. Upgrading from previous FortiClient versions. FortiClient version supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient.Comments
FortiClient always installs the Fortinet Security Fabric Agent (SFA) feature and enables the Vulnerability Scan feature by default. You can select to install one or more of the following options: Secure Remote Access: VPN components (IPsec and SSL) will be installed. Advanced Persistent Threat (APT) Components: FortiSandbox detection and quarantine features will be installed. Additional Security Features: Select one or more of the following to install them: AntiVirus, Web Filtering, Single Sign On, Application Firewall It is recommended to not install VPN components on Windows Server systems if not required. Upgrading from previous FortiClient versions FortiClient version 6.0.7 supports upgrade from FortiClient versions 5.4 and later. If you are deploying an upgrade from FortiClient 5.6.2 or earlier versions via FortiClient EMS and the upgrade fails, uninstall FortiClient on the endpoints, then deploy the latest version of FortiClient. Downgrading to previous versions Downgrading FortiClient version 6.0.7 to previous FortiClient versions is not supported. Firmware image checksums The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support portal. After logging in, click on Download > Firmware Image Checksums, enter the image file name, including the extension, and select Get Checksum Code.
2025-03-29Endpoint communication security improvement FortiClient Endpoint Management Server (EMS) and FortiClient 7.0.2 add an improvement to endpoint communication security. FortiClient connects to EMS using Telemetry to: Obtain license information Send endpoint and management information to EMS Receive endpoint configuration Receive endpoint commands, the results of which it can send to EMS Other similar tasks The connection from FortiClient to EMS uses TCP and TLS 1.3. During the SSL connection setup, EMS sends a server certificate to FortiClient. The certificate that EMS sends to FortiClient is the one configured in EMS Settings > Shared Settings > SSL certificate. See Adding an SSL certificate to FortiClient EMS. In 7.0.1 and earlier versions, FortiClient checks the certificate subject name received from EMS to confirm its validity. In 7.0.2, the certificate validation follows industry standards: Domain or fully qualified domain name (FQDN) that FortiClient is connecting to matches the domain to which the certificate is issued.Validation process correctly handles wildcards in the domain name in the certificate.Validation process considers both the common name (CN) in the subject or subject alternative name (SAN). The certificate expiry date is in the future. The certificate has not expired. The certificate issuer or the root certificate in the certificate chain is from a publicly trusted certificate authority (CA). Trusted CAs are read from the operating system. The new endpoint communication security feature allows the EMS administrator to configure endpoint profiles to take different actions based on the validity of the certificate that FortiClient receives from EMS. The EMS administrator configures this feature by enabling Use SSL certificate for Endpoint Control in EMS and configuring the desired Invalid Certificate Action for each endpoint profile. When Use SSL certificate for Endpoint Control is enabled, FortiClient 7.0.1 and earlier versions cannot connect to EMS. Following the recommended upgrade path as detailed in the following procedure is recommended to ensure that endpoints can connect to EMS. See Recommended upgrade path. The following describes the behavior when Use SSL certificate for Endpoint Control is enabled: If the EMS server certificate is valid, FortiClient silently connects without displaying a message. This is the same connection behavior from 7.0.1 and earlier versions. If the EMS server certificate is invalid: If the Invalid Certificate Action is configured as Warn, FortiClient displays a warning message to the end user. The message warns the user that the EMS to which FortiClient is attempting to connect to has provided an invalid server certificate. The message offers options to allow or deny the connection:If the user allows the connection, FortiClient connects to EMS and remembers the certificate for this EMS. FortiClient no longer prompts the user each time that it connects to this EMS.If the user denies the connection, FortiClient does not connect to EMS by canceling the connection. The next time that the user tries to connect to the same EMS and the server certificate is still invalid, FortiClient displays the same message again.If the Invalid Certificate Action is configured as Allow, FortiClient connects to EMS.If the Invalid Certificate
2025-04-22Minimum system requirements 2.0 GHz 64-bit processor, six virtual CPUs 8 GB RAM (10 GB RAM or more is recommended) 40 GB free hard disk Gigabit (10/100/1000baseT) Ethernet adapter Internet access is recommended, but optional, during installation. SQL Server may require some dependencies to be downloaded over the internet. EMS also tries to download information about FortiClient signature updates from FortiGuard. You should only install FortiClient EMS and the default services for the operating system on the server. You should not install additional services on the same server as FortiClient EMS. FortiAnalyzer 7.4.0 and later 7.2.0 and later 7.0.0 and later Although EMS supports the listed FortiAnalyzer versions, confirming the compatibility between your FortiAnalyzer and FortiClient versions is recommended. Otherwise, not all features may be available. See the FortiClient Release Notes. FortiAuthenticator 6.6.0 and later 6.5.0 and later 6.4.0 and later 6.3.0 and later 6.2.0 and later 6.1.0 and later 6.0.0 and later FortiClient (Linux) 7.2.0 and later 7.0.2 and later FortiClient (macOS) 7.2.0 and later 7.0.2 and later FortiClient (Windows) 7.2.0 and later 7.0.2 and later FortiManager 7.4.0 and later 7.2.0 and later 7.0.0 and later FortiOS 7.4.0 and later 7.2.0 and later 7.0.0 and later (for zero trust network access, 7.0.6 or later is recommended) 6.4.0 and later FortiSandbox 4.4.0 and later 4.2.0 and later 4.0.0 and later 3.2.0 and later
2025-04-22DescriptionThis article describes how, when creating a new VPN connection with FortiClient v7.4.1 or v7.4.2 that uses IKEv2 as the protocol with the default VPN settings, NAT-T is disabled.ScopeUsers connecting from the same public IP or sitting behind a NAT device can experience symptoms such as no network access and one-way traffic (zero bytes received shown in FortiClient VPN status) after connecting to VPN when using IPSec VPN with IKEv2 as the protocol.SolutionTo enable NAT-Traversal on a connection profile, the following actions can be taken:Unmanaged or unlicensed FortiClient: On the FortiClient GUI, edit the VPN connection and go ahead with one of the following two options:Option 1: Change the 'Encapsulation' from default - 'IKE UDP Port' to 'Auto':Option 2: Take a backup of the configuration and use a text editor to edit the configuration file, change the value for 'nat_traversal' from 0 to 1. Save the file and restore the configuration to FortiClient:EMS managed FortiClient:If the Remote Access (VPN) profile is created in previous versions of EMS and migrated to EMS v7.4.1+, it will have the old settings until the profile is changed, updated, and saved.Any new IKEv2 VPN profile created in EMS v7.4.1+ with Encapsulation set as 'IKE UDP Port' will always have NAT-T=0 0 will automatically always set 0The solution is to set encapsulation to Auto (XML tag 2), which allows control of .FortiGate Configuration:If FortiGate is always behind NAT for dial-up IPSec tunnels, it is recommended to force-enable NAT on FortiOS IKEv2 tunnel settings.config vpn ipsec phase1-interface edit set nattraversal forced nextendNote: For the issue described in this document, the above configuration change (nattraversal set to forced) will not be helpful.macOS FortiClient:A related issue may affect macOS FortiClient v7.4.2, which will be resolved in FortiClient v7.4.3+. The issue is related to using a UDP port less than
2025-03-26FortiClient Évaluations FortiConverter FortiExplorer FortiFone FortiPAM FortiRecorder FortiClient 7.4 FortiClient propose différents niveaux de capacités avec des niveaux de protection croissants. Il s’intègre à de nombreux composants clés de la Fortinet Security Fabric et est géré de manière centralisée par le serveur de gestion des endpoints (EMS) Édition ZTNA Connexion centrale & ReportingConnecteur Dynamic Security FabricAgent de vulnérabilité & RemédiationVPN SSL avec authentification multifactorielle (MFA)VPN IPSEC avec authentification multifactorielle (MFA)FortiGuard Web & Filtrage vidéoContrôle d’accès aux applications ZTNA Édition EPP/APT AV en ligne & Anti-logiciel malveillantPrévention des intrusions (IPS)FortiGuard Web & Filtrage vidéoContrôle des dispositifs USB FortiClient Endpoint Management Server (EMS) FortiClient EMS permet de centraliser la gestion, la surveillance, le provisioning, le patching, la mise en quarantaine, la catégorisation dynamique et la visibilité en temps réel des endpoints.Pour évaluer FortiClient EMS sous licence, veuillez cliquer sur "Try Now" (Essayer maintenant). FortiClient VPNLa version VPN seul de FortiClient offre le VPN SSL et le VPN IPSec, mais n'inclut aucun support. Téléchargez le meilleur logiciel VPN pour plusieurs appareils. Accès distantVPN SSL avec authentification multifactorielle (MFA)VPN IPSEC avec authentification multifactorielle (MFA) Essais gratuits Fortinet propose des essais gratuits sur certains produits via les marketplaces de fournisseurs cloud Pare-feu nouvelle-génération FortiGate-VM Le FortiGate-VM offre des fonctionnalités de pare-feu de nouvelle génération (NGFW) aux organisations de toutes tailles, avec la flexibilité d'être déployé en tant que NGFW et/ou passerelle VPN.AWS Marketplace | Azure Marketplace | Google Cloud Marketplace Outil de migration FortiConverter La transition vers les plateformes de sécurité de nouvelle génération doit être aussi fluide que possible. FortiConverter facilite la migration des configurations complexes de pare-feu vers les solutions Fortinet. La version d'essai de FortiConverter vous permet d'évaluer la précision de la conversion. FortiConverter permet de réaliser des économies substantielles en termes de temps, de coûts et de main-d'œuvre. CaractéristiquesSupport multi-fournisseurs – Conversion à partir de Check Point, Cisco, Juniper, Alcatel-Lucent, Palo Alto Networks et SonicWall. Un seul outil convertit les configurations de tous les fournisseurs compatibles.FortiOS configuration viewer – Aide les administrateurs FortiGate à migrer manuellement les configurations à partir d'un fichier de configuration FortiGate en fournissant une interface graphique pour visualiser les règles et les objets, et copier le CLI.Conversion standardisée – La conversion de la configuration est effectuée conformément aux règles de conversion. L'examen et la modification des règles sont effectués après la conversion, avant de générer le résultat final. Le risque d’erreur humaine dans le processus de conversion est réduit au minimum.Support complet – Une licence FortiConverter valide permet aux utilisateurs de bénéficier d'un support technique direct et de versions privées pour faciliter leurs projets de conversion complexes. FortiExplorer FortiExplorer est une application de gestion des appareils Fortinet simple à utiliser, qui vous permet d’assurer le provisionning, le
2025-04-09What's New in FortiClient (Windows) 6.0.0 This section identifies the new features and enhancements in FortiClient (Windows) 6.0.0. For more information, see the FortiClient Administration Guide. EMS quarantine file management FortiClient 6.0 file quarantine functionality has been enhanced to support FortiClient EMS-based central quarantine management. This feature requires EMS 6.0.0. User data security improvement FortiClient user data security has been improved so user-specific saved information including the username, saved password, avatar, social ID and VPN information is not accessible to other users using the same device. New FortiClient GUI FortiClient 6.0.0 introduces a new UI that improves user experience and provides a refreshed look and feel. The new navigation bar provides up-to-date status information of all features while making them more accessible. Improved Sandbox Detection techniques Sandbox Detection has been enhanced in FortiClient 6.0 for better detection and interception of file transfers so files can be sent to FortiSandbox for behavior analysis. Installed Software Inventory FortiClient now sends all installed software application information to EMS so it displays under Software Inventory. This feature requires EMS 6.0.0. Customize system quarantine message FortiClient can now display a customized quarantine message. This feature requires EMS 6.0.0. FortiClient installs and runs as a 64-bit process on 64-bit platforms FortiClient 6.0.0 now supports 64-bit installation.
2025-04-14