Fortinet Community

Olá boa noite! Estou com problema de conexão VPN já tem alguns dias, já fez todo o procedimento de reinstalar e feito a configuração mas sem sucesso até o momento minha via está dando TIMEout e não estou conseguindo acessa-lá alguém poderia me informar o que pode está ser a causa disso, desde já agradeço.

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

firewall Remote-IPsecVPN not able to get ping WAN ip,rest of the all services is okay including router IP.which is same series. 

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

Hello Everyone, I would like to test my knowledge in NSE 4 - 7 via the use of past exam papers. Is there a repository I can connect to? 

Currently we have a Microsoft Server 2016 server as our radius server.We intent to upgrade to Server 2025.is there anything for us to take note when we upgrade to Server 2025 ?

Am final year in college I already have CCNA.My next goal is Security fundamental for Network Security, What about NSE4 and Sec+?, What i should focus on and worth for Entry level in Network security ? 

Anyone else suddenly having issues seeing Chatgpt prompts and files uploaded? Application Control | FortiGuard Labs Was working last week and i can still see claude file uploads and prompts just not ChatGPT so not sure if the application signature has changed? Fortigate is 7.4.12

I’m on a FortiGate 61F version 7.4.11 and FortiClient Windows version 7.4.3.I am trying to set up IPSec VPN for my remote users so that I can upgrade the FortiGate (knowing that SSL is no longer supported).  I’m running into trouble with Authentication when it comes to PSK vs Peer ID from dialup group.  What I want is for the tunnel to accept users from a specific local user group on the FortiGate.  My problem is that if I change the Peer Options to Peer ID from dialup group, the Pre-shared Key box goes away.  That’s then a problem on FortiClient since I can't leave the PSK box blank.  Any help on how to solve this?  Thank you! Side Note: I have an IPSec VPN for remote users set up on a different box running 7.6.6 doing exactly what I want.  There are more options for Authentication on that version and I can have a PSK and the tell it to use user group I want.

we are using forticlient v7.4.7, today our users brought down their latest updates. Our VPN users are coming back down the VPN tunnel to download their updates, this maxed out our 1GB line. We have Windows updates set in the forticlient to go direct instead of using the tunnel. We also have the .exe and microsoft domain set to got direct. We are still seeing all this traffic coming down the VPN tunnel and then using our web filtering policies on the Fortigate to go out. Can anyone help with this?

Can anyone provide any guidelines for remote ipsec VPN with fortigate 7.6.6 os & its integrate with LDAP local user many more members ? 

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

Hi All,I'm looking for guidance and best practices for implementing a resilient Layer 2 access network using a ring topology.Hardware Under ConsiderationFortiGate 121G (Firewall) FortiSwitch FS-1024E (Core/Distribution) FortiSwitch FS-224E (Access) FortiSwitch Rugged FSR-112F-POE (Rugged Access)Design ConsiderationsThe current access-layer design consists of up to five rings, with each ring supporting 15 hops in a dual-ring architecture (up to 30 switches per dual ring).End devices (1 NIC 2 IP ports) will be connecting to two separate access switches for redundancy. The expectation is that RSTP will provide both:Ring redundancy within the access network Redundancy for dual-homed endpoint connectionsThe attached diagram provides a high-level representation of the proposed architecture.Challenges RSTP convergence time RSTP convergence may be too slow for the application. The target recovery/convergence time is less than 1 second following a link or switch failure. MRP/PRP limitations

Hello Fortinet Community,We are facing a persistent issue with a FortiAP 231K that fails to come online on our FortiGate 60E. Interestingly, the same behavior has also been observed on the replacement FortiAP received through RMA.We would appreciate guidance from the community or Fortinet engineers who may have encountered similar symptoms.EnvironmentFortiGate: FortiGate 60E FortiOS: 7.4.12 Access Point: FortiAP 231K AP management: FortiGate wireless controller Original testing topology: FortiGate -> PoE switch -> FortiAP 231K Replacement AP testing setup: PoE injector -> FortiAP 231K, with a laptop connected for testing and a serial console connection through PuTTYWe have checked the official FortiAP and FortiOS Compatibility Matrix and are investigating the issue using the supported firmware combination listed for the FortiAP 231K and FortiOS 7.4.12.Issue ObservedThe FortiAP boots successfully but does not come online or establish a stable CAPWAP connection with the FortiGat

I have problem with my NAC where sometime the endpoint is loss connectivity both for wired and wifi. Previously i post error from client side here and now after i enable authentication log from FNAC then we can see for same endpoint the authentication can be success and sometime is fail.The fail message is ‘No EAP session macthing state’ View from authentication step then i got message ‘outer-method failed to authenticate Switch_IP → FNAC IP’The issue is from FNAC?

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

Where we can find supported device by FortiNAC?

I have a fortigate 70G (v7.4.12 build2902) setup as the wireless controller of a mesh network. A fortiap 421E (FP421E-v6.4-build0492) is the root, and then the two leaf ap's are another 421E (v6.4.0 build0492) and a 221E (v7.4.4 build0644). When I first configured this several months ago, everything worked great. Then recently my daughter started mentioning that the internet seemed slow.I looked into it and although I hadn't changed anything, the leaf ap's were no longer connected to the mesh network, so all traffic was routing through the root ap.Through some reboots I was able to get the entire mesh up again. However, no clients will connect to either of the leaf ap's.This configuration was previously working with no changes made and then stopped working. What should I do?I don't believe any of the ap's auto updated nor did the FG. None of the devices are registered for support, but that has been true for quite a while, definitely while the mesh was up and working.Any help and advice

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

How to fix analytic and archive( actual days)if i set the fortiananlyzer system time after 2 weeks from the time the logs sent to fortianalyzer

How can we prevent a single workstation from causing an organization-wide DNS outage through FortiGate IPS quarantine?We recently experienced an incident where FortiGate IPS detected DNS.Pointer.Loop traffic originating from workstation. The automated quarantine action affected both of our DNS/Domain Controller servers, resulting in a DNS connectivity outage across the organization.We manually unbanned the servers, which restored services, and traced the related DNS activity back to the originating workstation.Our concern is that a single endpoint, whether due to malware, misconfiguration, or a user changing network settings, could trigger an automated security response that impacts critical infrastructure.What would be the recommended FortiGate configuration or best practice to prevent this from happening again?

Hi,i had an working PPPoE IPv6 internet connection but now i noticed that this isn’t working. I don’t getting an IP address.I can’t say sice when and after what change this happen, perhaps it can also be an probem on the providers side.This is the WAN Interface config:config system interface edit "FTTH" set vdom "root" set mode pppoe set allowaccess ping set type redundant set member "port15" set lldp-reception disable set estimated-upstream-bandwidth 1000000 set estimated-downstream-bandwidth 1000000 set monitor-bandwidth enable set role wan set snmp-index 22 config ipv6 set ip6-mode pppoe set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 53 set prefix-hint xxxx:xxxx:0:200::/56 next end end set username user

Hello,i have a FortiSwitch running at 7.2.9. There we have a trunk with no name.We want to delete this trunk.Because the name is the reference for every command, we don’t have any possibility.config switch trunk       edit ""        set mode lacp-active        set auto-isl 1        set members "port24"    nextIs there another way to delete this trunk?Thanks

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.