Fortinet Community

Good afternoon, I have a question regarding user session logs. I have a group that has YouTube blocked but in the logs I see YouTube sessions that are blocked and sessions that are not and they download (??) 400 MG, can you explain to me what is happening? I am doing something wrong?I have Fortigate 60F v7.0.13 build0566 (Mature).Thank you so much 

Hello, I'm currently blocking Windows updates via Application Control on my FortiGate firewall. However, I'm having trouble. I want to configure Windows updates to only install language packs. Is there a way to do this? I checked the traffic flow, but I can't figure it out...

I have hub connect to the spoke using 3 different lines, and from bwlow pic i want to troubleshoot why path using 10.103.113.6 is not best path. Anyone knoe how to troubleshoot this? FW01 (Internet) # get router info bgp network 10.4.0.0/16VRF 0 BGP routing table entry for 10.4.0.0/16Paths: (3 available, best #2, table Default-IP-Routing-Table)Advertised to non peer-group peers:10.103.113.2 10.103.113.3 10.103.113.4 10.103.113.5 10.103.113.6 10.204.0.30Advertised to peer-groups:advpn_isp1 advpn_isp2Original VRF 0Local, (Received from a RR-client)10.10.111.6 from 10.10.111.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 1Last update: Thu Jan 8 04:59:01 2026 Original VRF 0Local, (Received from a RR-client)10.10.112.6 from 10.10.112.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 2Last update: Tue Jan 6 09:20:25 2026 Original VRF 0Local, (Recei

Hello,We noticed that FortiClient 7.4.3.1790 loads the following OpenSSL‑related DLLs:libcrypto-3-x64.dlllibssl-3-x64.dlllibcrypto-3.dlllibssl-3.dllThese files appear to be based on OpenSSL 3.1.7, and Microsoft Defender for Endpoint is associating them with:CVE‑2024‑13176plus one additional vulnerability affecting OpenSSL 3.1.xCould you please clarify the following?For the OpenSSL 3.1.7 components bundled with FortiClient 7.4.3.1790:Are these builds affected by the vulnerabilities?Or are they patched/customized by Fortinet, even though this is not mentioned in the release notes?Is there an existing or upcoming FortiClient build that includes a more recent OpenSSL version (e.g. 3.1.8 or 3.1.9)?Is there a Fortinet security advisory confirming whether FortiClient is impacted (or not) by CVE‑2024‑13176?We are trying to determine whether this should trigger remediation or if it is likely a false positive from Microsoft Defender.Thank yo

Hi all,I’m currently working with two FortiGate 401F units that I want to deploy either in a Virtual Wire Pair or in transparent mode to serve as IPS devices. These are placed in a classic 3-tier layer design and should sit transparently between the Core and Distribution layers.In our current setup we are dealing with asymmetric routing, and the FortiGates are supposed to act as IPS. We have the FGSP cluster configured, and sessions are being synced correctly. However, when following the Fortinet documentation for UTM inspection on asymmetric traffic (https://docs.fortinet.com/document/fortigate/7.4.9/administration-guide/324430/utm-inspection-on-asymmetric-traffic-on-l3), the traffic is not being forwarded back to the session owner. Instead, it still exits out of the transparent interfaces.So far, even with symmetric session pickup / session routing options tried, the traffic path remains as if the FortiGates are just passing through without proper asymmetric session steering back to

Modernizing applications in the healthcare sector is not just a technology initiative. It is a strategic decision that directly impacts continuity of care, the protection of patient data, and compliance with increasingly strict regulations. Hospitals, clinics, and laboratories are rapidly adopting the cloud to support telemedicine, electronic health records, connected medical devices, and analytics initiatives. For technology and business leaders, the challenge is clear: how can we accelerate modernization while maintaining control, predictability, and trust?       The Challenge of Cloud Modernization in the Healthcare Sector   The cloud offers scale, agility, and elasticity, but in the healthcare sector it also increases operational complexity. Hybrid and multicloud environments coexist with legacy systems, critical applications, and connected medical devices, all handling highly sensitive data. For decision-makers, the main challenges include: Safeguarding sensi

Hello and sorry for my english, I try to configure WAF profile on my fortigate 7.6.5. it is not difficult to configure but for create exceptions i don't understand what is the best way... For example, the WAF block this URL : http://moodle.toto.fr/course/modedit.phpI have the event ID signature : 40000137First, it is possible to do exception in GUI ? don't find....i undertsand i can do signature exception in CLI but i see there is also :address-list : Address block and allow listsurl-access : URL access listso what is the best way ?thanks a lot

Hi EMS adminsIn FortiClient EMS 7.4.x, what is the difference between database backup and zip backup?Is it the same? May I understand zip backup contains DB backup and EMS settings? What is the recommended backup?Searched in documentation but couldn't find the difference.

Cookbook: ADVPN s/BGP on LoopbackGuide on how to properly setup ADVPN with on Loopback.This is a quick and easy configuration. Don't let MSP's charge you 40-50k for this solution. We've been in three scenarios this year, where we had to come in and fix a customers install that their MSP did for 50k, and rip it completely out and start over.Full Testing proof Dual-Hub / 15 overlays: https://youtu.be/04BjjyMYEEk?si=o6qpHrprttcPCyHGCreating templates and deploying with FMG: https://youtu.be/h42MymcAVng?si=nhaJUHNVnrCqcrp8Proving cross overlay traffic works: https://youtu.be/3SmNWZGlIgw?si=QCXi7reaJq3eKQDYImportance of sla-min-meet: https://youtu.be/WMpTmdnr**bleep**?si=tlp2o-xPlCrPVt3EProof aux-sessions is bad, turn it off: https://youtu.be/2ay5iQkZOf8?si=WiT8teo5dklebGbKReach out to me if you need help, guidance, or just want it done quickly and correct by a US based Fortinet partner.========================= Pre-TASKS ==Plan this out, watch this firstI truncated

finally had time to add this to my HOWTO sheet for everyone.Requirements:Forticlient: 7.4.1 +FortiOS: 7.4.5 +https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharingEnjoy!UPDATE: I just revised the document so it is a full XML config file (tagged as partial) thus you may import it into foritclient and it will only add the additional profile and preserve your others.NOTE: Admins may want to import this into theirs, and then re-export it. It will allow the PSK to become encrypted and then you may be able to share it.

There are already some upgrade issues realted with version 7.4.9.Upgrade reason is, that fortigate cluster doesnt operate at all after every 14-20 days and only way to get it back, is to make power interruption.I have heard, that if to upgrade from 7.2.11 to 7.4.9, fortigate can be stuck after upgrade. Somewhere was comment from Fortinet, that they investigate that problem.I upgraded a model 60E and it was succesful. It makes me more confident, but only little, because model 600F is different and that is I'd like to upgrade next. Best case, there is no downtime at all and dual SFP tranceivers also are compatible. Worst case, that I have to manage via console and boot from older version and configuration and then I have old version back. Does anyone have expreiences, what models are related with this problem or is it just FortiOS case and not hardware related problem?

We had our fortigate set to auto update firmware and it did. No issues, and then days-weeks later the customer reported same devices off it's LAN not getting internet access, and some devices off it's sub interface (VLAN 10) which was used for their Guest wifi (No AP's off this firewall).  While looking at the GUI under dashboard Network, or Assets & Identities, the Address column instead of showing regular IPv4 addresses (EX: 192.168.1.x) it was showing something like a GUID # which was something like 32-48 characters long, but not a IPv6 address.  After a reboot they reported the issue went away and the GUI started showing correct, so we are downgrading to 7.4.8. 

How to configure FortiGate Secure SD-WAN using the FORTIMANGER for HUB and Spoke ADVPN Deployment  Take control of your network like never before! Step into the world of cutting-edge networking with our in-depth guide to configuring FortiGate Secure SD-WAN for a Hub and Spoke deployment using FortiManager. This is more than just a tutorial-it's your blueprint to transforming your network into a high-performing, secure powerhouse! Here's what you'll master:Building Secure Overlay Tunnels: Achieve seamless connectivity between hubs and branches.Crafting Advanced SD-WAN Rules: Elevate app performance and user experience with precision steering.:shield:️ Optimizing Routing: Maximize efficiency and security across your infrastructure.:control_knobs:️Centralized Management with FortiManager: Simplify complex deployments with ease. https://youtu.be/6tz7fWc960I 

Hi all,I was thinking about upgrading to 7.4.9 but I’m seeing a few threads and posts about issues with IPsec tunnels. Is there a particular configuration type which are mainly impacted? We have many tunnels with third party vendors. Will 7.4.9 cause issues with them? Is there a patch or fix for it?I checked 7.4.8 but it’s got a lot of vulnerabilities which are patched in 7.4.9, so I’m stuck on my decision.Thoughts?

The IPsec VPN (remote access) is configured, and we are using Cloud Authenticator as the RADIUS server with 2FA enabled. IKE -1 we are using and as per (Peter TAC engineer ) the EMS does not support IKE-1 in 7.4.4 version. I'm not receiving the token and TAC also unable to provide the solution yet, It has been pending from last 14 days.  Regards,Rohit

Here you can find all important FortiGate CLI commands for the operation and troubleshooting of FortiGates with FortiOS 7.4.  SystemGeneral System Commands   get system status General system information exec tac report Generates report for support config, get, show, tree set, unset, append, unselec Configuration commands <command> ? or tab Use ? or tab in CLI for help <command> | grep [-f] Grep command to filter outputs diag debug cli 7 Shows webGUI changes in CLI   Process Information   get system performance status General performance infos diag sys top [sec] [number] Control + C to stop command Process list Sort with P (CPU) / M (Memory) diag debug crashlog read Crash log  Network Network Interface Information   diag ip address list            &

Hi,I have created a remote IPsec VPN for remote users. the users can connect to the VPN.However, they can't access anything in the LAN behind the FortiGate through HTTP or HTTPS.For example, I can SSH to the FortiGate to manage it; however, I can't access it through HTTP/HTTPS.I don't have a route issue because I have ping/ssh to the FortiGate/LAN behind it. I don't have a Policy issue as I have allowed all the services.Model: 401FVersion: v7.6.4.

Hello FNAC adminsOn the support portal, image download, under FortiNAC-F > v7.00 > 7.2 > 7.2.9, I found this file: FNAC_install_7.2.9_build0166.bin.Made some searches but couldn't find anything about it.Do you have any idea?Is it for manual installation on a Linux server?If so then why it is not documented? And if so then is it supported?

Hi. VPN setting guide in the FortiSASE document doesn't have ikev1, it means IKE version can use only ikev2?And is FortiSASE's VPN IKEv2 not supported on Android?Does SASE have the ability to set up Android and SIA?Thank you

Hello,After upgrading FortiGate to version 7.6.5, we encountered issues with IPsec tunnels. According to the Fortinet technical article, the default Diffie-Hellman group values were changed from  5 to 14, 20, and 21. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-tunnels-not-connecting-after-upgrade-to-v7-6/ta-p/423320 Current situation:On PC clients, the issue was resolved by changing the configuration and setting matching DH groups (14, 20, 21) on both sides of the connectionTunnels are working correctly after synchronizing the settingsProblem: The FortiClient VPN application on Android does not have the option to select DH groups higher than 14. As a result, mobile users cannot establish VPN connection after the FortiGate upgrade.Questions:Is there a planned update for FortiClient Android application with support for DH groups 20 and 21?What is the recommended temporary workaround - should we roll back the configuration on FortiGate to older DH groups

 after changing the Admin sport to 4433 i get the "Connection lost. Press Enter to start a new session." in the clichanging back to 443 and it's all good.   factory reset, no help. any ideas?  

We have a hit and miss issue accross multiple sites.  We are using WPA 2 Enterprise authentication via LDAPS on Fortigate 60F and 80F firewalls. When I test the connectivity under User Authentication, the accounts are authenticating without issue, but when used to connect to the wireless network, it fails with a message stating "unable to connect to network" On some Fortigates it works without issue and on others it does not.  The firmware is more or less the same but the issue is across multiple firmware tracks. The firmwares I am using is the latest version under 7.0,7.2,7.4 and 7.6 I noted that on the firewalls where it works, under Log>WiFi Events, the authentication session shows the username of the person attempting to log in.  On the firewalls where wireless authentication does not work it shows the user as N/A under WiFi Events.

The RSS feed that provides product firmware release information is suddenly missing FortiOS versions 7.4.x and 7.2.x even though are still under support. These just recently went missing and only versions 7.6.x and 7.0.x are showing within the feed. Can this please be looked into?

In recent days, we have received tickets from users reporting that FortiClient is not running on their computers. The symptom is that when the FortiClient icon is selected, a blank window opens and immediately closes. When run again, it does nothing. In the task manager, the FortiClient process was visible but did not perform any action. This has already occurred on four computers, and as a reactive measure, FortiClient was uninstalled and reinstalled. This occurred on computers running versions 7.4.3 and 7.4.5. I am writing in this forum to ask about a possible solution to this problem in case it becomes widespread and to find out if it has happened to anyone else. In the release notes, there is a bug with ID 1226762 that is very similar to the case I am presenting, however, we do not have computers with AMR64 Windows.  

Hello, we are using the free version of FortiClient to connect users to our Fortigate and have since used SSLVPN. We are trying to transition to IPsec but I'm having trouble trying to automate the process of installation and configuration. I've tried this technical tip:Deploy the FortiClient VPN configuration ... - Fortinet Community which mostly works with the exception of the PSK, I have to enter it manually on every device for it to connect. Is there a workaround for this? According to the technical tip it should work this way Thanks in advance