Fortinet Community

Hi , I am having issues with this error.Day one i am able to connect with it.However after my laptop updated its system ,suddenly i am unable to connect at all and the same error pops up.I have tried different Wi-fi , still the same error.I have also checked with my company support , they said my credentials all matched on their end.So i do not know what is wrong , i have tried some of the  solution posted in this forum still not able to resolve it. 

Hi,Is it possible to change the IP pool that FortiSASE assigns to me when starting the SSL VPN?now I have the class 10.212.128.0ThanksRegards

Hello Community Contributor, I am facing that FortiPAM disk size issue. I configured VM Size to 8GB for System, 200GB for Log and 600 GB for Video Record.  But if i run exe disk list, it is not like my configuration. It is less than VM Actual size. How can I resolve this? FortiPAM size Thank you in advance.  Best Regards, Henry

I have Fortigate 2201E and want to setup active-active multi-home setup with 2 x ISP for web/app hosting on servers in the datacenter I have 10G from each ISP and will like a truly redundant HA setup that is active-active, not primary-failoverI use cloudflare as firewall/proxy/DNS in front of the fortigate for reference and wanted to check what the best route for this setup is I know most people go for primary/failover like mentioned in this guide https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SD-WAN-with-Primary-ISP-and/ta-p/268524 by @lcamilo but what i want is active-active setupIs this a common setup especially when not putting a router in front of fortigate and instead want to connect directly to the ISPs from the fortigate.  What i have heard so far is use SD-WAN feature and get ipv4/ipv6 blocks from each ISP. I will be getting /24 ipv4 and /48 ipv6 from each ISP. And then connect each ISP to an interface and set

Hello everyone,We are managing around 500-600 FortiClient endpoints and need to upgrade clients quickly whenever vulnerabilities are announced.Current setup:FortiClient EMS (on-prem)Due to security concerns, our Infosec team keeps EMS completely closed to the internetBecause of this, we are forced to perform FortiClient upgrades using ManageEngine Endpoint CentralFrom the infrastructure side, there is no clear technical explanation why EMS must remain closed, but we have to follow this decision.Issues with ManageEngine upgrades:Deployments often fail or stop midwayInstaller crashes during upgradeUpgrade completes but:FortiClient opens with a blank or white screenApplication does not startUsers are asked for an admin passwordVPN stops workingEndpoints are EMS-connected and we perform in-place upgrades, yet problems persist.Questions:How do large enterprise environments usually handle FortiClient upgrades?Is it common to keep EMS securely internet-facing for telemetry and upgrades?Are th

I am trying to install the "VPN-only" Client, but after install, the title of the FortiClient shows "FortiClient - Zero Trust Fabric Agent". I uninstalled FortiClient from Control Panel, no errors during uninstall. I downloaded "VPN-only" installer and installed, but still same result.  Previously it used to show only "FortiClient" as below

I am facing issue in FortiPAM email approval workflow. We don't have any mail server in our organization. We use Microsoft Mail Exchange Server for mail service. Let's say, there are user1(approver), user2(requester) and user3. If user2(requester) request a secret, a mail sent to approver inbox. If approver click "approve button", it created new mail. but it doesn't any approve at requester end. We also cannot use email test connection to gmail account for 2FA purpose.  

Hi,We bought an Microsoft Surface Pro 9 which has an ARM processer.The point of buying this was to hook it up with the Fortinet VPN, so we could go anywhere and still be connected.Problem is i can't install it on the Surface Pro 9, due to having an ARM processer.I was wondering if there was any early access or beta for Forticlient VPN for ARM processers that we could try?Or is there any other solution?I tried the Microsoft store app, but that doesn't seem to work with SAML.The VPN connection is SAML with Azure.

Our company currently planning to buy Fortigate 901G. My question is does FTG-901G support to 10000 remote LDAP user within user definition configuration? If there is a lower default limit, is it possible to expand this capacity through configuration?

Hi all,I'm changing some things on my network. Currently (in summary) I have a DMZ with two Fortigate and one switch. The servers and the firewalls connect to the switch.Each server has 2 static routes1º)Default route --> IP address of the external fortigate.2º)Route to reach internal private addresses -->Internal fortigate. I'm thinking about configure the servers with just one default route for the switch that connects them. This switch, sends traffic to external or internal firewall and Doesn't route any traffic between DMZ network and other networks. Server-->Switch-->Firewall Internal / Firewall External. If I use a firewall as default gateway for servers, some times the traffic will have more hops than I want. ExampleTraffic from server DMZ, to server Datacenter:                  -ServerDMZ-->switch(layer 2)-->firewall external-->Switch another time-->Firewall internal. What do you think abou

I am working on setting up a hub and spoke with an Fortigate for Azure deployed in the hub. I have been on the struggle bus for the last day trying to get it working. I have the vnets created on both the hub and spokes. The hub/Fortigate I am able to access and administer it via the GUI/CLI. I have created the vnet peerings between the vnets as well as the default routes to the Fortigate internal interface from the spokes. I feel like I may be missing a step as I cannot get the spokes to talk to the hub and vice versa. I have created the NAT and Firewall policies and I cannot get RDP to work to my VM for testing. I also am unable to ping anything from the Fortigate/HUB to the spokes. Any ideas or should I reach out to support?

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.Environment Details:FortiGate model: 901G (2 units)HA mode: Not decided yet (Active-Passive or Active-Active)Switching environment: Cisco switch stack / clustered switchesLink aggregation: LACP (802.3ad)Objective:High availability at the firewall levelRedundant and aggregated uplinks to the Cisco switch stackStable and supported HA + LACP designAvoid split-brain, MAC flapping, or failover issuesQuestions:What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?How should the Cisco side be configured (single port-channel across stack members, tr

Hi,I have configured a ZTNA setup using FortiGate and FortiClient EMS integrated with Azure AD SAML for one domain (e.g., user@abc.com) (server A) I have now added a second FortiGate to the same FortiClient/EMS environment, but it requires authentication against a different Azure AD SAML tenant (e.g., userb@xyz.com) (server B) Is there a solution to achieve automatic authentication (SSO) for the second account (xyz.com) so that users do not have to manually re-authenticate when connecting to resources protected by the second FortiGate?On my check, when the FC connect to server B it automatic use the account from the current login via browser ( which current login with domain abc.com) --> so it get the error authentication code 21.Regards,

Hi everybody, i have configured FSSO on fortigate, the problem is when i create firewall rule, i want to  set source as sAMAccount (ex: test). But by default on FTG, source must be set by CN (CN=firstname test lastname test,OU=VCC,DC=vcc,DC=com). So my question is are there any ways to set source as sAMAccount? if yes, how can i do it? 

Hi there,i am configuring fortiweb on F5 Load balncer but i am facing an issue that my fortiweb is also using the certificate and F5 load balncer is also using the certificate, as per fortiweb servers in ip pool must accept the traffic on port 80 but in my senerio ip in server pool is F5 Vip ip address which accepts the traffic on port 443 , is there any way that fortiweb decrpt the incoming packet do security stuff and then re-encrpt the traffic and then send it to F5 load balancer. because right now i am facing an ssl error , ssl error connection reset . as well as i want to know if i can add 2 default routes on fortiweb ab i have two incoming links configured as 2 vips in my fortiweb 

Hi Fortinet People, I've just updated firmware v7.0.17 to v7.2.11 and tested network internet download speed and upload speed, which is limited. Before updated firmware download speed and upload speed is 600Mbps- 700Mbps. Now download speed is 200Mbps and upload speed less than 100Mbps. And also Dropbox sync is taking very longer time upload speed is less than kb.  What going wrong? Try to disable security policies antivirus Dns filter, application control, IPS. Issue still persists. Do I need edit SSL inspection? 

Hello.I'm moving away from a HP switch (no cli access) and a Sonicwall firewall to the Fortigate side. I have a 91G and 2x148fpoe switches connected.  They are currently configured in Fortiilink and managed so all ports are being managed from the 91G. I have 2 Proxmox servers that I will be moving over to the new environment and am trying to understand how LACP/LAG works on the Fortigate.  It seems similar with Active/passive mode and 'bonding' 2/or more interfaces into the same LAG group so traffic can travel across both if/when needed. I'm trying to understand, and it seems like I would do the following:1. Open the fortiswitch ports tab2. Choose Trunk ports3. Give it a name and add ports either from the same switch, or specific ports on different switches.4. Set the mode to 'active' and hit 'ok'. If I'm thinking correctly then this would set up, say port 1 on sw1 with port2 on sw2, in a LAG/LACP group as active.  Correct? Is that all there is t

Hi,I am looking for older version of FortiClient VPN version 7.0.8 for MacOSCan someone please help me with the information about where I can get the dmg file.RegardsAmbili B Menon

I have disabled split interface in order to setup MLAG on two fortiswitches. I am using the default subnet 10.255.1.0/24 which I have made routable external via WAN1 (lab network so its actually all RRFC1918 space). I cannot seem to create a policy to allow inbound access to fortilink interface so I can SSH to the switches (only_default.fortilink).How do I configure this so I can ssh from an external (non-fortilink) network?Thanks,

Hello all.I'm trying to understand vlans on the fortigate. i have a 91G and 2 148poe switches in managed mode.This system will be replacing a sonicwall firewall and hp switch config.The current config (HP switch, Virtual Server, VLans on VMs) - workstations receive dhcp from a vlan100 server if the hp port is 'tagged' with the correct vlan. An example would be this:If on the hp switch, G1 has 'untag' (native vlan 1) for port G1 and Tagged with vlan 100, then whenever a device is connected to G1, it receives a dhcp address from my (tagged) vlan 100 server. All this all works well.The 91g has native vlan1. It's default network is 192.168.1.0 and any devices connected to it get a 192.168.1.x network. The fortigate has also been configured with a Vlan 100 network.Port 11, on the fortigate is the default vlan1. I connected that port to the HP switch. The hp switch port (uplinked from the fortigate) is configured as "untag G17".Port 9 on the fortigate is configured with the default vlan 1 ne

Hello team!! We have 2 Fortigates in 2 different sites: FGT80F in site1, and FGT40F in site2I had created a P2P IPsec VPN between both Fortigates some time ago (Connected through Internet)This VPN was working fine for more than 2 years until now.Recently I realliced that although the VPN was up, I couldnt access to anything in the other site through the VPN.  Both Fortigates have Firmware 7.6.4In "Dashboard -> Network -> IPsec", I used the "Bring down -> Entire tunnel" option to "restart" the VPN.After few seconds, the VPN was up again, and started to work (I started to reach anything in the other site through the VPN)After some time (less than 2 hours, IDK how much time exactly), happened the same issue and I "solved" this again by "restarting" again the IPsec VPN, using the "Bring down -> Entire tunnel" option. I cant see any related log.Do you have any suggestion to try to diagnose why did this happen?We didnt change anything recently. Thanks in

Hello everyone, As for i know, REST API Administrators should be disabled by default in FIPS-CC mode:1) (REST API admin account option is not avai... - Fortinet Community)2) (Solved: Re: Fortigate 3301E missing API 7.2.11 - Fortinet Community) I'm new to Fortinet, and i'm currently configuring a Fortigate61F with firmware version v7.2.8 build9703 (FIPS-CC-72-5), downloaded following instructions from this article (Extended Support for v7.0 FIPS-CC Certifi... - Fortinet Community). Enabling FIPS mode was done via console following this guide: (How to enable FIPS-CC mode - Fortinet Community)Command "get system status" shows "FIPS-CC mode: enable"Creating an admin from:  System - Administrators - New - REST API Admin, succeed.APIs works as expected. I haven't found anything related REST API in FIPS-CC mode in the FortiOS 7.2.8 Release Note.Is this the intended behavior or i have made some mistakes enabling FIPS mode? Thanks in advance!  

Hi EMS admins When I update from EMS 7.4.4 to EMS 7.4.5 I have the following error.Upgrade EMS: Err:1 http://apt.postgresql.org/pub/repos/apt noble-pgdg InReleaseUpgrade EMS: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FCC7D46ACCC4CF8 The upgrade finishes successfully however. And I think you have seen similar error if you performed the same EMS update operation. The question is:Did it bypass the signature check and installed PostgreSQL update? Or did it just abort PostgreSQL update and performed the other package updates?

I need assistance updating my FortiWeb with. We do not have support for downloading the firmware.