Special notices
FortiGuard Anycast Certificate Expiration
FortiClient (macOS) 7.4.5 fails to recognize the newly issued April 16, 2026 Digicert CA used by FortiGuard Anycast servers, which results in failed communication for the following updates:
- Web Filter rating
- Video Filter rating
- Split VPN using ISDB
- Signature and engine updates
See CSB-260303-1 for more information.
No IPv6 support for IPsec VPN
FortiClient (macOS) 7.4.5 does not support IPv6 for IPsec VPN due to dual VPN changes. Support may be added in future releases.
IPsec VPN support limitation
Due to a macOS limitation, macOS Guest VMs using bridged network connections do not support IPsec VPN tunnels.
Using the same default MTU size for VPN interfaces across all platforms
FortiClient (macOS) 7.4.5 now uses the same default MTU size for SSL and IPsec VPN interfaces as Windows and Linux, which improves connection efficiency. You can modify the MTU size using the <mtu_size> XML option. See the XML Reference Guide.
No support for concurrent third-party tunneling or proxy clients
Using third-party tunneling or proxy clients (including VPN, DNS, HTTP(s), SOCKS, ZTNA or PAC files) in parallel or nested combination with FortiClient's VPN, ZTNA or Web Filter is not recommended nor supported.
Enabling full disk access for FortiClient process
To use the following features, you must grant full disk access permission for the fctservctl2 process (located in /Library/Application Support/Fortinet/FortiClient/bin/):
- AV scan
- Sandbox scan
- Importing VPN profile
To do so, go to the Security & Privacy pane and toggle on the fctservctl2 option under Full Disk Access.
|
On macOS Tahoe (26.1/26.2), the fctservctl2 option does not appear in the Full Disk Access list due to an OS bug. You can drag the process to the list or click the Add icon to manually add the process. While the process still does not show up in the list after being added (due to the OS bug), the necessary permission has been granted. |
If any of these features are used while full disk access is not enabled for fctservctl2, FortiClient (macOS) prompts the user to enable full disk access permission.
Activating system extensions
After you initially install FortiClient (macOS), the device prompts you to allow some settings and disk access for FortiClient (macOS) processes. You must have administrator credentials for the macOS machine to configure this change.
VPN works properly only when you allow FortiTray to load in Network Extensions settings. You must enable the FortiClientProxy and FortiClientPacketFilter extensions for Web Filter and Application Firewall, respectively, to work properly. The FortiClient (macOS) team ID is AH4XFXJ7DK.
|
|
The following provides instructions for macOS Sequoia (version 15). For macOS Sonoma (version 14) and older, there is no Network Extensions section. You must click Some system software requires your attention before it can be used. You can then activate the extensions in Privacy & Security settings after the FortiClient prompts redirect you there. |
To activate system extensions:
- Go to System Settings > General > Login Items & Extensions > Network Extensions.
- Toggle on the following to enable the extensions:
- FortiTray
- FortiClientProxy
FortiClientPacketFilter
-
Click Done.
Enabling notifications
After initial installation, macOS prompts the user to enable FortiClient (macOS) notifications.
To enable notifications:
- Go to System Settings > Notifications > FortiGuardAgent.
- Toggle Allow Notifications on.
DHCP over IPsec VPN not supported
FortiClient (macOS) does not support an external DHCP server to assign IP addresses to IPsec VPN clients.
Running multiple FortiClient instances
FortiClient (macOS) does not support running multiple FortiClient instances for different users simultaneously.
FortiGuard Web Filtering Category v10 Update
Fortinet has updated its web filtering categories to v10, which includes two new URL categories for AI chat and cryptocurrency websites. To use the new categories, customers must upgrade their Fortinet products to one of the following versions:
- FortiManager - Fixed in 6.0.12, 6.2.9, 6.4.7, 7.0.2, 7.2.0, 7.4.0.
- FortiOS - Fixed in 7.2.8 and 7.4.1.
- FortiClient - Fixed in Windows 7.2.3, macOS 7.2.3, Linux 7.2.3.
- FortiClient EMS - Fixed in 7.2.1.
- FortiMail - Fixed in 7.0.7, 7.2.5, 7.4.1.
- FortiProxy - Fixed in 7.4.1.
Please read the following CSB for more information to caveats on the usage in FortiManager and FortiOS: https://support.fortinet.com/Information/Bulletin.aspx
