Fortinet Community

Hi everyone,I’m working on setting up a reliable email-backup workflow for our FortiMail system and wanted to get advice from others who’ve done this before.Environment: FortiMail (on-prem)Around 800–1000 active mailboxesDaily volume ~40–50GBRetention requirement ~90 daysNeed an automated solution + quick restore optionWhat I’ve already tried / considered: FortiMail’s built-in archive export works, but local storage fills up fast.Periodic manual export for certain users (not practical long-term). Thinking of pushing backups to an external SMB/NFS storage or an S3 bucket for safer retention.Also tested a small third-party utility like Advik Email Backup Wizard just to check mailbox-level export formats (EML/PST/MBOX), but I’d still prefer a more integrated FortiMail-side method if possible.

Hi Team I would like to clarify a few points regarding the On Ramp configuration in FortiSASE.If the license covers 2 instances and 400 connections, is it recommended to deploy 2 instances and distribute 200 connections each? If the customer has only 180 locations, can we establish 2 tunnels (one to each instance) and use them for load balancing or configure them as primary and secondary?Is there any documentation available for configuring Aruba to FortiSASE On Ramp tunnels?Regarding tunnel IPs: is it mandatory to configure them? I understand it is required when using policy routing on the on-prem FortiGate, but are there other cases where it matters? Do we need Mode Config with DHCP-assigned IPs for FortiGate and Aruba SD-WAN gateways, and is this fully supported?Thank you

Hi, I do have existing FortiGate HQ 7.4 and 7 remote branches 7.6, all configured and running. Recently, I added FortiManager to my environment. I added all Firewalls to the Manager with two ADOMs, one for 7.4 and another for 7.6. Now, I want to achieve centralized management for my Firewall. On each Firewall, I have almost 1,000 objects, 50 policies, SD-WAN, and VPN. I checked with ChatGPT to determine the best option for promoting the configuration from local on each firewall to be shared for all devices within the same ADOM. But I need to understand if that's double or there is anyone has faced the same scenario. thanks:keycap_1: Use “Bulk Move / Promote” in FortiManagerInstead of promoting objects one by one:Go to ADOM 7.6 → Policy & Objects → Addresses / Services / VIPsClick More → Bulk Move / PromoteSelect all objects you want to centralizeFilter by type (Address, Service, VIP)Filter by usage (used in multiple firewall packages)Choose Promote to

With Forti Client 7.2.x the connection to LDAP Samba stopped working. From the conversations I have with Fortinet within tickets it seems that they do not intend to fix it. They always refer me to the NFR department. Do you have any solution for this problem? Do we have to slowly prepare to replace FortiClient with some other system?

Hello, When trying to create in Fortigate an IPAM subnet with a Class C subnet (192.168.0.0/24), I received an error stating that the mask must be within the range 8–16. The document below also states that the IPAM pool subnet can only be a Class A or Class B subnet. I’m trying to understand the reason for this limitation, or whether I might be missing something, since our current subnet is Class C. https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/166728/configure-ipam-locally-on-the-fortigate

We have subscriptions to this service in AWS.  How can I check the current CVEs applied to this rule group?

Hello, I am new at fortigate, ich have a FortiNet FG100E.My Setup is: Software Switch (assigned to Port1-4, X1,X2)->VLAN 5 (802.1Q)->VLAN 10 (802.1Q)->VLAN 15 (802.1Q)->VLAN 20 (802.1Q) In my Aruba Switch can i select a Port to "tagged" or "untagged", now i want to assign on my fortigate only VLAN20 to Port 4-6, and VLAN15 to 7-8.  Can anyone help me to to setup the Ports/VLANs? How do i need to setup?Can any one help to Setup the VLANs on this Ports? 

Hi Team Is there any way to find full list of FortiSASE POP IPs ? For check the latency before the deployment. Thank you. FortiCloud Products   

I’m deleting (or disabling) a firewall policy, but the sessions that were created under that policy remain active.firewall-session-dirty is set to clear-all. But it doesn’t clear the existing sessions.Is there any way to make FortiGate automatically terminate sessions when a policy is disabled or deleted?Or is manual session clearing (e.g. via diagnose sys session clear) the only option?

Hi, we set up an ADVPN Hub and Spoke network layout like this: Hub is Fortigate 3000F, Spoke is Fortigate 60F.We configured BGP on Hub and Spoke (on the IPSEC Tunnel)We noticed that "connected networks" of spoke are distributed correctly: 10.39.80.0/24 -> IPSEC TUNNEL but the static route (10.172.6.1/32 -> 10.39.80.2) is distributed with the wrong "next hop".  On the Hub we got:10.172.6.1/32 -> 10.39.80.2instead we would10.172.6.1/32 -> IPSEC TUNNEL Any hints? 

Dear Forti Team,dear community, is a reseller (here: Matrix42) able to provide its clients a real serial number of the FortiEDR licence they use?In detail, the reseller stopped selling the FortiEDR service which is still used by us.We're using a reseller-primed URL to get into the Management Console.Unfortunately the service will end december 31th which took us by suprise as the reseller claims to have informed us - but just didn't.So in the need of finding a new reseller we were asked to provide a serial number of the FortiEDR but since the old reseller can only provide something like FEDR000000000123 (and 123 stands for the only three "individual" numbers) we are a bit lost.Does that look like a real serial number? And if not can we advise the old reseller were to look in his own management console?Best regards Rico

Hi,I'm having trouble with this setup with an IPsec setup: I'm trying to replicate what i had with ssl-vpn; multiple local user groups and the possibility to connect via phone.I could make it work with different users by using a tunnel for each group with a unique ID, the problem is when connecting via phone it doesn't work. I've read some documents that say to use IKEv1, other to use IKEv2, the problem is FortiClient mobile doesn't let me configure auth/enc on IKEv1. I also tried using eap settings but i get stuck in the login prompt, asking for the password on repeat, so i still couldn't connect with phone with any of the config i tried. Have anyone encountered this? or do you have any paper with the steps on how to make an IPsec tunnel work for both PC and mobile?Thanks,

Hi Fortigate has failed and the operating system must be reinstalled.Fortigate model is 401F. The log on the disk disappears due to OS reinstallation, but the customer wants the log to remain on the Fortigate disk. I'm using FAZ, can I transfer the log in FAZ to the disk in fortigate? Thank you.

Hi, Does anyone know how to check to which account is the device registered via CLI? -sotir1984-

I was wondering if there is a place out there where some template configurations for Fortigates can be found that survive security audits.  I am aware that Fortinet offers generic best practice guides for each OS releases (for ecample Best Practices | FortiGate / FortiOS 6.4.0 | Fortinet Documentation Library, and Hardening your FortiGate | FortiGate / FortiOS 6.4.0 | Fortinet Documentation Library), but this just talks about what best practices in general should be. What I am looking for is a concrete almost cut/paste like config template that could be used for specific purposes - like an ISO or NIST or ... conform security standard. Does such a document / website exist that offers such full exemplary configurations?  Thanks.

how to add multiple selected devices into one report per day?

Dear all, we would like to use VDOM partitioning. In every example I found the FortiGates are ind of connected fully meshed, every vdom uses its own physical interface.  I actually want to do something different: 2 FortiGates (FGCP), both with:- WAN link uses 2 10GbE Interfaces with LACP- LAN link uses 2 10GbE Interfaces with LACP root VDOM on vcluster 1 (FortiGate FGCP A1.1)vdom1 VDOM on vlcuster 2 (FortiGate FGCP A1.2) Do I need separate physical interfaces for each VDOM or may I share all physical links between vdoms, i.e. using different VLANs on top of the physical links (i.e. WAN and LAN interfaces)?   

Hi everyone Some of our user's FortiClient IPsec VPN connection (Windows 10 x64, FortiClient 6.0.9, FortiGate 6.0.9) drops numerous times a day. Some users have to reconnect more than 10 times a day. The connection simply drops while they are working, and for no apparent reason as applications such as Skype, Teams etc. remain online. Even if there was packet loss for a moment, it must have been very brief. This does not affect all of of our users. For the majority of our users the FortiClient connection is pretty stable. In my experience, the quality of the Internet link makes a big difference. I have experienced frequent disconnects myself on my ADSL home Internet link whereas I don't experience any disconnects anymore now that I am on fibre. All workstations are set up using an image and are therefore identical in the way they are configured. So I don't think the problem lies there. All users connect to the same IPsec dialup tunnel (ike=1, authentication=psk, mode

i created two VDOMSin first VDOM i registered two forti switches and created vlans under fortilink with switches how to create Vlink between vlan in VDOM1 & Vlan in VDOM2   

I have a new deployment, using:Fortigate 120G Controller v7.4.9 build2829andFP231F-v7.6.0-build0894 After a lot testing, I got that the FortiAP GUI is "click sensitive", as the click order of the checkboxes, affects the dtls encryption policies, so I stick with the cfg -a AP_DATA_CHAN_SEC=ipsec-sn,ipsec,dtls,clear in APBut in the controller...Im typing : set dtls-policy ipsec-sn-vpn ipsec-vpn dtls-enabled clear-textAnd still, showing clear-text first (in fact, the exact reverse oder I want)config wireless-controller wtp-profile    edit "MyCustomProfile"        set dtls-policy clear-text dtls-enabled ipsec-vpn ipsec-sn-vpn    end Ok, this could be only a "quirck", being ignored by the internal logic of using the most secure option first, regardless of the order shown in the CLIBut... the sad story .. the channel is CLEAR-TEXT!!!!!!!!!Why is that?What I want?1) Use all options available on AP2) use

I've set up an IPsec VPN with certificate-based authentication and started migrating away from SSL-VPN. Unfortunately, around 10% of our remote users are on DS-Lite. This means they have a public IPv6 address but share a single IPv4 address via Carrier Grade NAT. SSL-VPN works in this setup, but IPsec does not. To address this, I:Added an IPv6 address to our WAN interface via Router Advertisement (ping6 works in both directions).Created a AAAA DNS record for the FQDN vpn.companyname.com.Added the subnet fd00:abcd::10 - fd00:abcd::100 /64 to the IPsec tunnel, along with 172.16.25.x IPv4 addresses.Enabled split tunneling for IPv6: Split to Tunnel → none (we don’t use IPv6 internally elsewhere).Added an IPsec Phase 2 entry via CLI with:set src-addr-type subnet6set dst-addr-type subnet6Now, FortiClient 7.4.3 connects but freezes after clicking "Connect". It does not fail, it just hangs indefinitely.The idea is to establish the IPsec tunnel over IPv6 and route all private IPv4 tra

Hai all. After reading a lot on these forums helping me on the way with Fortinet producs, I have a problem that might be really simple but I don't see it. We have 2 FG100F in HA A-P running behind two Cisco routers in VRRP (ISP routers). I have configured the WAN1 interface with the IP's provided. So far so good. HA works fine when I pull the WAN interface on the main FG. However when the active VRRP router fails the WAN does not go down so no failover occurs. This mean no redundancy.  What is the best way to setup the FG's to the VRRP routers? I've used SD-WAN in other locations where we have redundant ISP's. That works like a charm. However for this main location we have 1 ISP with a redundant 200mb's line. At the moment the setup is: Router A      VRRP       Router B    |                                |FG100 A ===HA=== FG100 B I need

Hi! *Fortigate model is 401F I understand that the cause of 'prevalent I/O error to superblock detected' is a firmware issue or a disk issue. Is there a way to find out clearly where this is the problem? I'd like to know exactly where this problem comes from.(Firmware or Disk) Thank you.

Hi!Q1. in NAT (Routed) Operarting Mode, "diagnose netlink brctl list" shows bridge information for a configured Software switch but not for a Hardware switch. Why?Q2. Is there any alternative method to show FDB for Hardware switch?Thanks!

I am trying to limit how many ports I am using between my Fortigate and my Fortiswitch. I want to have multiple vlans, the fortilink, and several physical ports all associated to the same hardware or software switch environment. All the documentation I have read (as well as forum posts) seems to dance around being able to learn about devices or associate devices outside of the dedicated Fortilink interface that is hardcoded into my fortigate. Part of this is so I can use a single cable to my fortiswitch to manage it and pass data, but also have other connections outside of the fortiswitch share the same VLAN and/or DHCP pool. Am I misunderstanding what the Fortilink interface is? Based on my setup and current understanding, it seems like I have to have 2 separate connections into my fortiswitch. One for the fortilink to manage the switch, and then another connection to actually pass my traffic at full speed without getting limited by the throughput behavior of the fortilink i