Fortinet Community

​Hello everyone,I am facing an issue with an HA Active-Passive setup using two FortiGate 120G devices (Firmware:7.6.6).The Setup:HA Mode: Active-PassivePriority: FG1 (128) - intended Primary, FG2 (120) - intended Secondary.HA Override: enableMonitored Interfaces: ATC-LACP (802.3ad Aggregate interface connected to a core switch).The Problem: When I reboot the Primary unit (FG1), failover happens correctly, and FG2 takes over. However, when FG1 finishes booting up, it does NOT preempt back to the Primary role. Running get system ha status shows that FG1 is stuck as Secondary with the following warning: WARNING: FG120GTKXXXXXXXX has mondev down;The LACP interface on FG1 stays down. The only way to fix this and trigger preemption is to manually log into FG1 (which is currently the secondary) and flap the interface:Plaintext config system interface    edit "ATC-LACP"        set status down        set status up    nextendImmediately after this manual flap, the LACP comes up, the mondev down

Hello everyone,I know that Fortinet previously removed the possibility to transfer FortiToken licenses from one FortiGate to another FortiGate.I would like to know if it is still possible to transfer FortiTokens from a FortiGate to FortiAuthenticator now. Has anyone done this recently ?Thanks in advance.BR,

Hi !  Hello everyone: Has anyone found such a situation? Is when the interface of FortiLink is generated, it can not do any firewall policy to other interface.cause FortiLink interface don't show in the firewall policy GUIDoes it mean that Fortigate does not allow any intranet data to communicate with the Fortilink interface, or is it just a bug? P.S. I have tried OS 5.4 , 5.6 , 6.0

hello allapologize in advance for my englishi'm trying to set up ltp2 vpn in my fortigate 60e 6.2, i followed this simple guide and windows connect successfully, i am assigned correct ip range and dns and i can access my internal stuff, but there's not connection to internet, even tho split tunnel is enabledi checked the policies and everything appear to be in order and i can see the user connected in fortigate ipsec monitorif i uncheck “Use default gateway on the remote network” on windows connection setting, navigation works normally but then i can't access internal stuff (what is the vpn even doing at this point?)everything works fine with regular ssl vpn connection with forticlientappreciate any help, thanks

Hello Fortinet Community,I have a question regarding FSSO and Active Directory user visibility in FortiGate logs.Currently, the customer has LDAP/FSSO configured, and user identification works correctly for a LAN segment directly connected to the FortiGate. In those logs, we can properly see the authenticated username along with source IP, destination, and bandwidth usage.However, there are additional user segments that are not directly connected to the firewall. These networks are learned through static/dynamic routing from other network devices. For traffic coming from those routed segments, the logs only show source/destination IPs and traffic usage, but no associated username.My main question is:Can FortiGate/FSSO associate users with IP addresses regardless of whether the network is directly connected or learned through routing protocols?From my understanding, FSSO performs User ↔ IP mapping based on authentication events from Active Directory, so theoretically it should not depen

Hi I try to configure firewall policy service select FTP_GET or FTP_PUTbut it doesn’t work

Hello all. Looking for anybody who has run into this issue and may be able to provide guidance.We have a pair of FGT 70Gs running 7.4.9 connected to a stack of 148F FSWs running 7.2.5. This is our standard stack and we run it at dozens of sites.We have NAC enabled via the built in managed FSW setting (not FortiNAC). We add devices via NAC policies individually and via wildcard filters such as Vendor name and device type (Example: IP Phone). Our switchports are configured in NAC mode and based on the device that plugs in, the dynamic VLAN will assign to what's configured in the NAC policy.Anywhere from a couple to a few times a day, users with devices plugged into these NAC-mode switchports say their devices are doing network hard down, and then coming back up moments to minutes later. I checked logs and am seeing that the entire NAC MAC address cache appears to be deleted out and then added back, all at once but separated by short periods of time. This aligns exactly with when the issu

Can we set lease time for SSL VPN IP range? I don’t want same user use different IP if the user disconnect for short period.

Hello Team, I have Fortinet firewall configure on Azure cloud as Active-passive with more than 400 Tunnels, Now i want to change mode from Active-passive to Active-Active. Any official documentation to achieve the same ?

Hi,I would like to ask if we can deploy SDWAN with one Internet line and MPLS?My topology:HUB and Spokes have one internet line and one MPLS. The MPLS connect directly between Hub and Spokes. The internet using for VPN between them.I dont want to config VPN via MPLS.Is it possible to deploy sdwan for both VPN and MPLS for steering or control traffic to Dc behind the HUB via both MPLS and VPN?Thank you

I upgraded my FAC from 6.6.4 > 8.0.3 and something has broken EAP-TLS,Users have a cert on their devices, and a profile pushed out to the laptops, that says , connect automatically using the device cert to the SSID,  before it connects seamlessly, but now they get a prompt that says “continue connecting?” if you expect to find THIS-SSID in this location, go ahead and connect”  then asks you to show certificate details.  This didnt happen before the upgrade, I think so far its WINDOWS 10 users only, cannot see anything in the release notes either? help appreciated.

Dear All, I am looking for help to build lab with Fortimanager & Fortigate as I am using permanent Free trail license. Have you ever been used trail license. I tried multiple times by downloading both (Fortimanager & Fortigate) to install & reinstall of  Fortimanager & Fortigate permanent Free trail license but did not work any more as expected. Anybody has performed LAB using free trail license so tell me which version. So that I can also build & learn,Grow. Also want to tell you while adding with Fortigate getting error like - unable to add the device with Forti manager.  Your response would be highly appreciated. Thank you.

Hello,I am looking for a NetScout Arbor parser for FortiSIEM.Could you please let me know if there is an official or community-supported parser available, or if you can provide guidance on how to obtain or develop one?Best regards,İsmail

Hello, I am using FortiAnalyzer 7.6.5. Under Log View > Logs, I can only see the Log Browse screen. Normal log categories like Forward Traffic, Event, Security Events, Web Filter, IPS, etc. are not visible. Logs are being received by the FortiAnalyzer, and under Log Browse I can see files such as tlog.log, elog.log, etc. The ADOM type looks correct, and there is no issue with admin privileges. In this case, what could be the reason for the normal log categories not being displayed? Could it be related to the Analytics/SQL database, log indexing, or any known issue with FortiAnalyzer 7.6.5? Thanks.

Hello Community, Would appreciate it if someone can point me to the right direction regarding the following. For example lets say there are 2 DoS policy with tcp_syn_flood configured like such (policy ID1 comes before policy ID2) Policy ID 1tcp_syn_flood, threshold 500, Action block Policy ID 2tcp_syn_flood, threshold 50, Action monitor The question isQ1  If policy ID 1 counter registers 400 therefore block was not triggered (below the threshold) will the packets get evaluated by policy ID 2? Regards.

I am creating a solution for a MSP where they intent to build a multi-tenant platform of Sovereign SDWAN and Unified SASE together. We have proposed a unified solution comprising the following:Unified Control and Management Plane:FortiManager, FortiAnalyzer, FortiAuthenticator, FortiNAC, FortiPAM, FortiClient EMS, FortiPortal, FortiGuard FDN (country specific mirror)!!!All the above components will be on-prem.At the Data plane apart from regular FortiGates at HUBs, PoPs and Branches, SASE specific appliances and VMs like FortiProxy, FortiSandBox, FortiDDoS, FortiADC was also considered,!!!At the same time, we are also aware and also customer got some input from Fortinet reseller SE that that Fortinet sell an SKU named FortiSASE Sovereign which is productized solution where FortiSASE Sovereign Orchestrator, FortiSASE Sovereign Web Portal resides in country specific FortiCloud SaaS and that is mandatory.So wanted some idea whether customer need to maintain split model or the original des

Hi everyone,I’m encountering a very specific and unusual issue with a web application login that only occurs within one of our corporate networks. I’m hoping someone has encountered something similar. The Problem:Users at "Site A" can load the website perfectly. However, when attempting to log in, the application returns a "Wrong Credentials" error. The Conflict:Using the exact same credentials from "Site B" (which has an identical FortiGate setup and security policies), the login is successful.Using the same credentials from home networks or mobile hotspots, the login is successful.The issue persists at "Site A" even with FortiClient disconnected. Troubleshooting Performed at Site A (Problematic Site):Security Profiles: Created a top-level "Full Access" policy with zero UTM/Security Profiles (No SSL inspection, no Web Filter, no App Control). The issue persists.SD-WAN & Routing: Forced traffic through a single ISP member using a specific SD-WAN rule to ensure no asymmetric routing

Hi all, I hope you're well.  I'm currently investigating some connectivity issues users are reporting on AVD displaying 'Paused Connection'. At this site, we're running FortiSwitch 448E-FPOE's and in the system events I am seeing many 'port has come up' and 'port has come down' logs.  I've reviewed the spanning-tree instance and confirmed that it is stable, root bridge is correct, no recent TCN's and no high usage of system resources (CPU/Memory) noted. There are no FCS errors or any other stats on the physical ports that would suggest faulty cables.  All ports connect to Cisco IP phones and from the logs it looks like the physical port flaps first which then triggered STP port status changes. I'm going to test bypassing the phone and connecting the PC directly to our FortiSwitch to rule out the phone causing the issue but wanted to know if there are any other troubleshooting steps I can take to identify the route cause.  Many thanks,&n

Hello, I understand that the max possible throughput supported by the FG-200G with no inspection is 39 Gbps, IPsec VPN is 36 Gbps, and max Threat protection throughput is 6 Gbps.Does that mean that when enabling the IPSec VPN would consume 36 Gbps out of the total 39 Gbps max possible throughput with no inspection?   https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/pdf/fortigate-200g-series.pdf#page=7 Thanks in advance. \Best, ~sK 

We have a FortiGate + FortiAuthenticator(bought and registered through a Fortigat partner). We are using the free forticlient vpn, but because it is not getting updates we are looking at fortiems. I downloaded the installer and installed it on Ubuntu. On opening EMS I get a hardware ID which I need to connect to FortiCloud and get the 3 free trial licenses. But I don't see any possibility on FortiCloud to do this.Please point me to the right place to do this.

I have installed FortiClient EMS version 7.4.4 (trial). I deployed this instance as a VM. I am trying to perform an automatic upgrade from the GUI to version 7.4.6. Unfortunately, it keeps showing an update error. In the logs, I see errors and warnings:Err:5 https://dl.winehq.org/wine-builds/ubuntu jammy InReleaseThe following signatures couldn't be verified because the public key is not available: NO_PUBKEY 76F1A20FF987672FWARNING: apt does not have a stable CLI interface. Use with caution in scripts.E: Conflicting values set for option Signed-By regarding source https://apt.postgresql.org/pub/repos/apt/ noble-pgdg: /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc != /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpgE: The list of sources could not be read.Warning: The unit file, source configuration file or drop-ins of redis.service changed on disk. Run 'systemctl daemon-reload' to reload units.___________Please help me resolve this issue.

Forticlient local logs in C:\Program Files\Fortinet\FortiClient\logs go back to installation of client. Is there anyway to set log retention in EMS that doesn’t involve uploading logs to FAZ?

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Hi ti all, Our FortiGate 50G is protecting 2 different routers from 2 different ISPs. One is plugged to Wan and the other to Lan1 (=Wan2). Domestic use network. Only ethernet. No WiFi. A few days ago, I tried to protect a TV decoder with the FortiGate. Creating the multicast policies, I have surely changed something I should not have to. The TV decoder was plugged into lan 2 which belongs to a Vlan switch (called "lan". Members: lan 2 + lan 3). This Vlan provides internet from only one of the routers Now I have the following symptoms: - When using this routers's internet and plugging the ethernet cable to my computer, my Airbook gets an auto-assigned IP first (yellow led) and, after 30 seconds, it switches to a normal IP (green led): Internet is available then. This symptom happens only with one of the routers (plugged to lan2 or lan3... Where the TV decoder was plugged to). I tried to disconnect "STP". then the symptom disappears. But comparing with the old configuration file, I notic