Fortinet Community

The FortiClient VPN-only version 7.4.3.4323 has been installed onto a MacBook running macOS 26. Full disk access has been given to fctservctl2 and the network extension FortiTray has been enabled although FortiClientProxy and FortiClientPacketFilter were not present to enable. The settings for this VPN use the public IP address of the FortiGate and various DH Group and encryption levels have been tried but all to no avail. The VPN connection is IPsec VPN and tries connecting for a while then comes back with a connection timeout error. The native IKEv2 client for macOS does not work either. I read somewhere that Fortinet added macOS Tahoe 26 support in FortiClient 7.4.5 but there is no VPN-only version later than 7.4.3. I have also read that SSL-VPN support is being stopped so surely there needs to a new VPN-only version where IPsec VPN can be used. Is there ever going to be a newer VPN-only version released? Or is the option available now FortiClient Standalone? This does not seem to b

Hi everyone,I'm new to the community and I'm preparing to take the NSE 4 exam soon.While reviewing the guide and testing some scenarios in the lab, I noticed what seems to be an inconsistency in the documentation.The guide states:"Administrative access options are also limited depending on the role that is set for the interface. For example, setting the interface role to 'WAN' would not display the 'Ping' option, mitigating the risk of responding to a DoS ICMP attack from the WAN."However, even when I set the interface role to WAN, the Ping option is still available.Has anyone experienced the same behavior or can explain why this happens? Is this a known behavior or perhaps a change in the latest version?Thanks in advance for any clarification!

have a FG 70G 7.4.12 and a windows client with free VPN 7.4.3.4726I have followed the doc:https://docs.fortinet.com/document/fortigate/7.4.12/administration-guide/785501 but when I try to connect, the client says “Timeout while connecting” I have diagnose sniffer packet wan1 "udp and port 500" running, and see 4 packets every time I try to connect like:19.844532 1.247.132.25.1012 -> 214.153.140.239.500: udp 668The odd part (to me) is that I do not see anything in the GUI System Events > VPN Logs >Memory.I’ve made sure the proposals match on both sides.I’ve done this before multiple times on 7.2 and older, and never had these kinds of problems.Any suggestions?

My WAN utilization is full (total 20Mbps), how we can easily which source is consume high bandwidth?I try to block the graph and click fortiview source and destination and if i compare with the Netflow from my NPM then the source is different. 

Hi, we use Transparent Proxy Policies for destination FQDN's only, but I can't really understand why would we do it if we can just stay with the IPv4 Firewall Policy and apply all security profiles there.Can someone explain the differences in behaviors? as traffic needs to match the IPv4 Policy first anyway and I can't see any real benefit just management overhead. 

Hi I am using ssl inspection on my lab.I have downloaded the certificate from fortigate and installed it on windows trusted store and on Firefox.but still have the certificate warning problem ! What do i miss?  

Hi FWB adminsFortiWeb 8.0.6, I set it up as SP.When I try run SAML debug as documented in admin guide and perform SAML authentication, I get redirection to SP but I get nothing in debug output.diagnose debug application samld -1  (or 7)diagnose debug enable<output empty>Is there something else to enable in order to make SAML debug work? Any help would be appreciated.

Hello, I have network of around 7 APs. FortiAP FAP431F. I manage them through forticloud. I have an SSID that I want all APs to broadcast it, except one. How can I do that? In the availability page in the SSID configuration, I have the option of “Available to all APs” or “Available to the APs with the following AP tags”. I could not find anywhere in forticloud anything about AP tags. How can I do this? Thank you.

I am looking to set up two separate SSL-VPN access connections, that would by used by two separate groups, both groups are using the same Fortinet device in one domain. (Example:) Group One: Bill is the admin of the Marketing group and supports 10 users.Group Two: Zach is the admin of the billing group and supports 10 users. I want to make sure that both groups can access the VPN through separate IP address and separate ports. Environment FortGate 101D, Firmware 7.2.10. Thank-you 

Hello Fortinet community,I am a Systems and Network Administration student working on my final-year thesis on"Implementing sandboxing technology for proactive security of incoming network flows."I need access to a FortiSandbox image for lab testing and practical research. I do not have a commercial serial number with support.Could anyone advise if there is an academic or evaluation image available, or guide me on how to obtain one for student research purposes?Thank you very much for any assistance.

We wanted enable auto backup of Fortigate firewalls from Fortimanager to FTP server.Please guide.

FortiEMS 8.0 managed FortiClient 7.4.7 using FortiTokken.after first time enter user and password details it don’t ask again user credential only fortiTokken.But as per compliance i have to configure like fortiClient ask everytime user password .i already disable the option save pasword and auto login. still same and in fortiClient (Save login) grayed.

HelloI completed the NSE 2 course successfully, but my NSE 2 certificate/badge is still not showing in my account.More than 48 hours have passed since I completed the course.Thank you.

Hello buddies,I’m new to the Fortinet community and would like to start learning how to properly configure and manage FortiGate.My goal is to set up a small hands-on lab where I can learn about firewall policies, VLANs, VPNs, web filtering, and basic network security without affecting the production environment.Could you recommend a learning path, course, documentation, or lab setup suitable for beginners? Would FortiGate-VM be suitable for this purpose? What networking knowledge should I have before getting started?Thanks for any guidance or recommendations here. 

I have configured a FortiSwitch Dynamic Port Policy (DPP) to allow only 3 specific MAC addresses on a switch port. When one of the legitimate MAC addresses is connected, the DPP identifies the device and assigns the configured dynamic VLAN successfully.However, I am experiencing an issue when the legitimate device is disconnected and an unauthorized device is connected to the same port shortly afterward.My test scenario is:Connect legitimate device (Test_MAC1). DPP identifies Test_MAC1 and assigns the dynamic VLAN. Test_MAC1 is disconnected from the switch port. Within a few seconds, connect an unauthorized device (Test_MAC4). Test_MAC4 is not included in the DPP allowed MAC list. However, Test_MAC4 still receives an IP address from the previously assigned dynamic VLAN and can access the network.It appears that the dynamic VLAN assignment/state is not being flushed immediately when the legitimate device is removed from the port.Is there any way to Fix this?Dynamic port policy Configura

Some users need to access Tor, so I created a rule and set the destination to the Fortinet Internet Service Database (ISDB) associated with Tor. We tested it and saw that they could access Tor pages via the web. However, when the user tries to access the "tor.browser" application, it doesn't load. These users have internet access, but only through HTTP and HTTPS ports. Wasn't the TOR.BROWSER application part of the Fortinet Internet Service Database (ISDB)? Or is it necessary to add the ports used by TOR.BROWSER to the internet access policy? Do you know which ports that application uses, tor.browser?

Hi I'm trying to collect Palo Alto logs into FAZ.If I want to view the normalized logs, do I have to use the log parser?cause I use Log View -->  Log Browse, it only showing raw log.  

I would like to understand whether the following design is possible and, if so, how it can be configured on a FortiGate 200F or 600F.Current Topology:FortiSwitch 124F ── FLINK_INET_1 ────┐                                                               FortiGate 200FFortiSwitch 548D ── fortilink ───────┘FortiSwitch 124F-POEVLAN 700 configured with IP address 11.11.11.1/30Connected to FortiGate 200F via a FortiLink-enabled interface i.e FLINK_INET_1.FortiGate 200FConnected to both FortiSwitches using separate FortiLink-enabled interfaces.Requirement is to configure VLAN 700 as a Layer 2 bridge only, without Layer 3 routing on the FortiGate.FortiSwitch 548D-FPOEVLAN 700 configured with IP address 11.11.11.2/30Connected to FortiGate 200F via another FortiLink-enabled interface i.e fortilink.RequirementI need VLAN 700 traffic to pass transparently through the FortiGate 200F, effectively allowing the two FortiSwitches to communicate as if they were on the same Layer 2 VLAN.QuestionHow can VLA

Hello,is there any way to get prepared for NSE1 other then Fortinet Learning Center ? Thanks

We are using the free version of FortiClient VPN, and I have found that with both an older version of FortiClient, both 7.4.3.1790, and the latest version, 7.4.3.4726, I am getting the error in the attachment occasionally when fortiauth,exe loads to prompt for credentials to connect. It even does this after I removed and re-added Net 4.8 as a windows feature. Any thoughts? That I know of it is just my machine, but I work fully remote, so I really need to get this resolved.

Dear Security Review Team, I am writing on behalf of IASC Ltd. (Indian Applied Science Corporation) regarding the security classification and/or blocking of our institutional domain: https://newiasc.com IASC Ltd. is an independent institution operating in the maritime security, competency, technology, research and engineering domain. Our website provides institutional information, professional publications, maritime research, technical material and related professional services. We have been informed that newiasc.com is currently subject to an adverse security or reputation classification within external security and website reputation systems. We respectfully dispute any such classification and request an immediate formal false-positive review of our domain. The domain is operated and controlled by IASC Ltd. and is not operated for phishing, fraud, malware distribution, scams, spam, gambling, adult content or other malicious activity. We have conducted server-side verification of our

Hi,I’m using fortimanager provisionning template to manager my IPSec VPN.I’m create a template.In this template I create a IPSec tunnel (Phase 1 and phase 2) with a name like myipsec_model.To create a second Ipsec tunnel, I’m click on clone option. A new tunnel it created with this name : clone_myipsec_model.I can’t rename the new IPSec configuration. I cleck on rename button change the name but this one is not change.I’m use fortimanager 7.6.7.Thanks you for your helpRegardsStéphane 

Hi,For one of our customer, I have got the FortiGate 200G firewall as rented device as we are yet to receive our own new firewalls due to lead time. Meanwhile after changing the device password, firewall is asking for Forti care registration which I don't have as this been rental device, is there any way forward for this, I tried skipping the registration from bios but firewall does not boot further with error - Failed to boot the system.

I have two 5G modem with same IP ranges 192.168.0.1/24. When i change modem IP ranges, internet speed 1 out of 100 and very poor. I need solution to connect both modems to use as 50/50 weight. kindly guide me the steps. really i am fresher for network setup.