Fortinet Community

Hello Team,Our FortiClient EMS uses a manually uploaded Let’s Encrypt server certificate containing two DNS SANs.Certificate renewal is already automated through our Salt master. After each renewal, we currently download the certificate and manually upload and apply it in EMS.We want to automate only the certificate deployment and activation steps while keeping certificate renewal managed by Salt. Or happy explore option auto renwal in EMS with two DNS SANs.Please provide the supported API or CLI procedure for importing the renewed certificate, matching private key, and intermediate chain, and assigning it to the applicable Web server and Endpoint control services.Please also confirm the required authentication and permissions, any service restart requirements, and whether this operation can run unattended on our EMS version. Thanks,

To allow a website from a blocked FortiGuard category on a FortiGate firewall, follow these steps:Log in to FortiGate: Access the FortiGate web interface using your admin credentials.Go to Web Filter: Navigate to Security Profiles > Web Filter.Edit the Web Filter Profile: Find the web filter profile being applied to the policy and click on Edit.Override the Category: Under the "Static URL Filter" section, click on Create New or Override, then enter the URL of the website you want to allow.Set Action to Allow: Change the action from Block to Allow.Apply Changes: Save the profile and ensure it is assigned to the correct firewall policy.Test the Website: Verify that the website is accessible and the policy is working as expected.Make sure to review the organization's security policies before allowing any website. I have just unblock a web development website webzeto.com 

Hello Fortinet Community,We are experiencing recurring FortiClient VPN connection issues with one of our customers and would appreciate your advice.System Information:Device: MacBook Pro (Apple M1 Pro) Operating System: macOS 27.0.1 FortiClient VPN: 7.4.3.4323 (Free VPN Version) VPN Type: SSL-VPNProblem Description:The VPN connection works normally for several days. However, after some time, FortiClient becomes unresponsive when attempting to reconnect.Restarting the Mac does not resolve the issue. The VPN only starts working again after reconfiguring the connection, but the problem returns after a few days.Troubleshooting Already Performed:Verified the VPN configuration. Successfully tested connecting and disconnecting the VPN. Checked Fortinet network extensions and background services – all active. Reviewed FortiClient logs without identifying a definitive cause. Verified that the VPN works correctly immediately after reconfiguration.Our Questions:Is FortiClient VPN 7.4.3.4323 offic

Hi Team,We plan to deploy a FortiPortal Scalable Cluster with two nodes in one DC and one node in the other. If the DC with the two nodes goes down, the single node can operate independently per the configuration:config system ha set min_nodes 1endWhat will happen when the two-node DC is brought up? Will it be enough to change the single configuration to a scalable cluster? Will the changes made on the single node during the outage be replicated to the other nodes?

Good morning teams 😊;For FortiClient EMS Trial, I created an IPsec VPN tunnel.However, I cannot export the XML configuration file with the VPN password included.Is there a way to export the VPN XML configuration with a password?What I would like is that when the user imports the XML configuration file (with forticlient) , they are required to enter a password before they can access the VPN.thanks for you support 😊

Hello, Can i deploy FortiGate VM on Huawei private cloud? is it supported and compatible ?  And could you please advise what are the supported hypervisors/platforms on Huawei private cloud for the VM Deployment? And does this one ( Huawei Cloud EulerOS 2.0 64 bit - CentOS 7.9 ) supported for FortiGate VM deployment ? Thanks in advance

im having an issue with our FortiClient IPsec VPN randomly disconnecting users. we are running a FortiGate 60F, using IKEv1 with xAuth.The VPN connects and works fine, but sometimes it disconnects after just 4-6 minutes, while other times it stays connected for hours. I've tested this on different Windows laptops with FortiClient VPN-only 7.0.8 and 7.2.14, and both versions have experienced the issue.I've spent quite a bit of time checking the logs and running IKE debug on the FortiGate, during one of the disconnects, I noticed these messagesrecv IPsec SA delete, spi count 1recv ISAKMP SA deleteFrom what I understand, this means the client itself is requesting the disconnect, but I cant figure out why. There was no DPD failure, and Windows didnt report any Wi-Fi disconnection at that timeHas anyone experienced something similar? Is there anything else worth checking or changing in the current IKEv1 setup? I'm also considering switching to IKEv2, but Id rather understand whats causing t

Network Components:2 ISP (SDWAN)2 FW(HA)2 RTR(Redundant WAN)1 SW(L3)Current setup: LAN(L3) → FW(HA) → ISP(SDWAN) → NET                           ^→ RTR(WAN) → NET                          Routing: L3 SWChange to:  LAN(L3)--->FW(HA)-->ISP(SDWAN) →NET                                          ^→ RTR(WAN) → NET                                           Routing: FW(HA) Routing Architecture ChangeCurrently, the L3 Switch performs the routing for traffic destined for the WAN. Under the proposed design, WAN-bound traffic will instead be routed through the Firewall before being forwarded to the WAN Router.Considering the full-mesh redundant topology:Firewall HA: Active-Passive WAN Routers: Active-PassiveWhat would be the best interface design between the Firewall and WAN Routers to maintain redundancy while avoiding routing or loop issues?

I need to know how to configure the policy to provide email access with an attachment filter in FortiMail.

Hello, I would like to use my 300D as some kind of ipsec concentrator.It will be used for a lot of dialup connections. Every connection is authorised by configured radius server. Till now everything is ok and configurated (phase 2 is established). Next thing is to assign ip taken from radius, which is connected to customer's mac address in radius database.Unfortunatelly i have no idea how to configure it. If i change anything phase 2 is falling down. May i ask you to give me advice how to move it forward please? It is my first post here, i couldn't find such problem using search mode :)

FortiGate-VM64-HV Trial Issue on Hyper-VPlatform:- Hyper-V (Server 2019) Gen 1 virtual machine- FortiGate-VM64-HV v8.0.1 build0245 (GA.F)- Trial LicenseIssue:The trial license activation completed successfully and the CLI shows "License Status: Valid". However, after logging into the web GUI, I logged out immediately.CLI access works normally.Network Connectivity:- Can ping 8.8.8.8 successfully- Default route configured via 192.168.1.254 on port1Relevant Output:FGT-VM64-HV-NZVQOU # get system statusVersion: FortiGate-VM64-HV v8.0.1 build0245 (GA.F)First GA patch build date: 260421Current Security Level: HighFirmware Signature: certifiedLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1694 MB RAM/2048 MB allowedHostname: FGT-VM64-HV-NZVQOUOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeCurrent HA mode: standaloneBranch point: 0245Release Version Information: GAFortiOS x86-64: YesRouting Table:S* 0.0.0.

Hello Fortinet Community,I have installed FortiGate-VM64 FortiOS 8.0.0 in my EVE-NG lab environment.The FortiGate VM boots normally, and I am able to access the GUI login page.Current IssueI can successfully enter my credentials and the GUI appears to authenticate successfully. However, immediately after login, I am logged out and redirected back to the login page.In other words:Open FortiGate GUI. Enter username and password. Authentication appears successful. GUI starts to load. Immediately after that, the session is terminated and I am returned to the login screen.EnvironmentPlatform: EVE-NG Device: FortiGate-VM64 FortiOS: 8.0.0 Build: 0167 Image: FGT_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvm.zip Deployment: KVM/EVE-NGLicense StatusThe FortiGate license is showing Up to Date / Active, so there does not appear to be an obvious licensing issue.What I have checkedFortiGate VM is booting normally. GUI is reachable. Username/password are accepted. License status shows up to date. The

Hi everyone,I manage like 30 fortigate devices and I updated them to 7.2.13 when it was released.Since I got users complaining about slow SMB traffic inside IPSEC tunnel s2s. The users are all behind this 101E model and they are thé only ones to complain.Bandwidth is like 300KB/s during transfer in 7.2.13I tried to check ipsec config (encrypt. algo.) Changed and adjust MTU but the traffic is still slow...Since the users told me it started since last update I tried to rollback to 7.2.12. same issue. I remember that I updated 7.2.12 and 7.2.13 a week after. So I checked to rollback to 7.2.11 and now speed is back to normal like it was before 8MB/s.I'll open a ticket but it seems linked to this model. Anyone has the same behaviour ?

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

we are using forticlient v7.4.7, today our users brought down their latest updates. Our VPN users are coming back down the VPN tunnel to download their updates, this maxed out our 1GB line. We have Windows updates set in the forticlient to go direct instead of using the tunnel. We also have the .exe and microsoft domain set to got direct. We are still seeing all this traffic coming down the VPN tunnel and then using our web filtering policies on the Fortigate to go out. Can anyone help with this?

Hello, good evening! I've been having VPN connection problems for a few days now. I've already tried reinstalling and configuring it, but without success. Currently, my connection is timing out and I can't access it. Could someone tell me what might be causing this? Thank you in advance. 

Can anyone provide any guidelines for remote ipsec VPN with fortigate 7.6.6 os & its integrate with LDAP local user many more members ? 

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

I updated the FortiGate from FortiOS 7.6.6 to 7.6.7 and am experiencing issues with SSL inspection certificates.After the update, the firewall started dropping all traffic. Even traffic matching firewall policies without SSL inspection enabled is being dropped.As a temporary workaround, you can disable SSL inspection globally to restore connectivity.Has anyone else encountered this issue after upgrading to version 7.6.7? Is there a known bug or a recommended fix?Update:Not logging dropped packetsFirewall memory usage reaching 90%Thousands of active sessions (compared to normal levels)

I am French, I bought a MacBook in July from an individual. He told me he won it thanks to his company that gives gifts, so with an Apple care guarantee. Nothing alarming, everything seemed normal, up to a few days. It is written that the MacBook belongs to this company. With attached a proof and a code requested. I can't get anyone from the company who can contact me, to learn more and get more information.It says it belongs to Fortinet France, but I only find sites in English and no French interlocutor can anyone help?  

I have problem with my NAC where sometime the endpoint is loss connectivity both for wired and wifi. Previously i post error from client side here and now after i enable authentication log from FNAC then we can see for same endpoint the authentication can be success and sometime is fail.The fail message is ‘No EAP session macthing state’ View from authentication step then i got message ‘outer-method failed to authenticate Switch_IP → FNAC IP’The issue is from FNAC?

Configuring a static IPv6 address on client fails with state "dadfailed"When configuring an IPv6 address the system sends out a message to check if the address if already in use.If the Fortigate has ippool6 type nptv6 configured it acts it replies on the external-prefix configured.Similar to arp-reply enable.Adjust the nptv6 pool itself or adjust the client by using an address in the internal-prefix range or not affected by ippool6.Check other ippool6 and vip usage for overlap as well. Example On linux client: ip -6 addr EXTERNALIP shows state dadfailedDirectly after configuring the ip address we get the packet capture:  VMMAC > 33:33:ff:00:00:06, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) :: > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has EXTERNALIP  FGTMAC > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::FGTEUI-64 > ff02::1

Subject: FortiLink Through Standalone FortiSwitches in an MCLAG DesignHello Fortinet Community,I would like to get your advice on a planned network design involving FortiGate, standalone FortiSwitches, managed FortiSwitches, and FortiAPs.Proposed Network Topology          FortiGate                 | Standalone FortiSwitches      (MCLAG Peer Pair)                 | Managed FortiSwitches                 |           FortiAPs In this design, the FortiSwitches directly connected to the FortiGate will operate in standalone mode as an MCLAG peer pair. The downstream FortiSwitches will be managed by the FortiGate through FortiLink, and the FortiAPs will connect to the managed FortiSwitches.I would appreciate your advice on the following questions:Design feasibility: Is this topology supported by Fortinet, particularly when using standalone FortiSwitches as an intermediate layer between the FortiGate and the managed FortiSwitches? FortiLink connectivity: Can the FortiGate discover, authorize, a

firewall Remote-IPsecVPN not able to get ping WAN ip,rest of the all services is okay including router IP.which is same series.