Fortinet Community

Hi everyone Some of our user's FortiClient IPsec VPN connection (Windows 10 x64, FortiClient 6.0.9, FortiGate 6.0.9) drops numerous times a day. Some users have to reconnect more than 10 times a day. The connection simply drops while they are working, and for no apparent reason as applications such as Skype, Teams etc. remain online. Even if there was packet loss for a moment, it must have been very brief. This does not affect all of of our users. For the majority of our users the FortiClient connection is pretty stable. In my experience, the quality of the Internet link makes a big difference. I have experienced frequent disconnects myself on my ADSL home Internet link whereas I don't experience any disconnects anymore now that I am on fibre. All workstations are set up using an image and are therefore identical in the way they are configured. So I don't think the problem lies there. All users connect to the same IPsec dialup tunnel (ike=1, authentication=psk, mode

i created two VDOMSin first VDOM i registered two forti switches and created vlans under fortilink with switches how to create Vlink between vlan in VDOM1 & Vlan in VDOM2   

I have a new deployment, using:Fortigate 120G Controller v7.4.9 build2829andFP231F-v7.6.0-build0894 After a lot testing, I got that the FortiAP GUI is "click sensitive", as the click order of the checkboxes, affects the dtls encryption policies, so I stick with the cfg -a AP_DATA_CHAN_SEC=ipsec-sn,ipsec,dtls,clear in APBut in the controller...Im typing : set dtls-policy ipsec-sn-vpn ipsec-vpn dtls-enabled clear-textAnd still, showing clear-text first (in fact, the exact reverse oder I want)config wireless-controller wtp-profile    edit "MyCustomProfile"        set dtls-policy clear-text dtls-enabled ipsec-vpn ipsec-sn-vpn    end Ok, this could be only a "quirck", being ignored by the internal logic of using the most secure option first, regardless of the order shown in the CLIBut... the sad story .. the channel is CLEAR-TEXT!!!!!!!!!Why is that?What I want?1) Use all options available on AP2) use

I've set up an IPsec VPN with certificate-based authentication and started migrating away from SSL-VPN. Unfortunately, around 10% of our remote users are on DS-Lite. This means they have a public IPv6 address but share a single IPv4 address via Carrier Grade NAT. SSL-VPN works in this setup, but IPsec does not. To address this, I:Added an IPv6 address to our WAN interface via Router Advertisement (ping6 works in both directions).Created a AAAA DNS record for the FQDN vpn.companyname.com.Added the subnet fd00:abcd::10 - fd00:abcd::100 /64 to the IPsec tunnel, along with 172.16.25.x IPv4 addresses.Enabled split tunneling for IPv6: Split to Tunnel → none (we don’t use IPv6 internally elsewhere).Added an IPsec Phase 2 entry via CLI with:set src-addr-type subnet6set dst-addr-type subnet6Now, FortiClient 7.4.3 connects but freezes after clicking "Connect". It does not fail, it just hangs indefinitely.The idea is to establish the IPsec tunnel over IPv6 and route all private IPv4 tra

Hai all. After reading a lot on these forums helping me on the way with Fortinet producs, I have a problem that might be really simple but I don't see it. We have 2 FG100F in HA A-P running behind two Cisco routers in VRRP (ISP routers). I have configured the WAN1 interface with the IP's provided. So far so good. HA works fine when I pull the WAN interface on the main FG. However when the active VRRP router fails the WAN does not go down so no failover occurs. This mean no redundancy.  What is the best way to setup the FG's to the VRRP routers? I've used SD-WAN in other locations where we have redundant ISP's. That works like a charm. However for this main location we have 1 ISP with a redundant 200mb's line. At the moment the setup is: Router A      VRRP       Router B    |                                |FG100 A ===HA=== FG100 B I need

Hi! *Fortigate model is 401F I understand that the cause of 'prevalent I/O error to superblock detected' is a firmware issue or a disk issue. Is there a way to find out clearly where this is the problem? I'd like to know exactly where this problem comes from.(Firmware or Disk) Thank you.

Hi!Q1. in NAT (Routed) Operarting Mode, "diagnose netlink brctl list" shows bridge information for a configured Software switch but not for a Hardware switch. Why?Q2. Is there any alternative method to show FDB for Hardware switch?Thanks!

I am trying to limit how many ports I am using between my Fortigate and my Fortiswitch. I want to have multiple vlans, the fortilink, and several physical ports all associated to the same hardware or software switch environment. All the documentation I have read (as well as forum posts) seems to dance around being able to learn about devices or associate devices outside of the dedicated Fortilink interface that is hardcoded into my fortigate. Part of this is so I can use a single cable to my fortiswitch to manage it and pass data, but also have other connections outside of the fortiswitch share the same VLAN and/or DHCP pool. Am I misunderstanding what the Fortilink interface is? Based on my setup and current understanding, it seems like I have to have 2 separate connections into my fortiswitch. One for the fortilink to manage the switch, and then another connection to actually pass my traffic at full speed without getting limited by the throughput behavior of the fortilink i

Hello all.  I have a single ISP that has brought in two fiber lines for me, both on the same subnet. Combined they should be 10Gbps, and are on my SPF+ ports on a Fortigate 100F firewall. I believe, if I understand correctly, that I shoulod use link aggregation to combine these into a single 802.3ad interface, and assign the SPF+ ports to it, then give them my static IP. Am I on the right track?

How to Block facebook messenger and allow facebook browsing only. I dont want to install signature in client end mobile app or browser. how will i block the only messenger?Device name: Fortigate_50GFirmwire version: 7.4.9

When an SSL-VPN gets disconnected without the user intentionally pressing the Disconnect button, shutting down the PC or such, FortiAnalyzer logs the reason for the SSL tunnel shutdown either as "Lost the connection" or as "User requested termination of service".  The first reason is expected, the second isn't. What causes such a disconnect to be logged with reason  "User requested termination of service"? Kind regards, Herta

Is there a way to successfully perform periodic license validation on FortiVM without setting the default route to the Internet?Due to certain circumstances, I need to permanently set the default route to the LAN side. However, when I do this, the license validation fails.I assumed that as long as the FortiGate could reach FortiGuard servers and resolve their names, it would be fine. So I added static routes for the following destinations to enable connectivity.・service.fortiguard.net・update.fortiguard.net・guard.fortinet.netPing to those destinations succeeded. Currently, the license validation only succeeds when the default route is set to the Internet.Is there any way to resolve this issue?Software Version：7.4.7

Hi there,we are working with multiple IPv4 subnets in the area 10.98.0.0/19 but we're configuring them on multiple interfaces as multiple networks with subnet lenght 26.I'd like to add a filter to the prefix list - In Bird2 you can work with greater than equal or less than equal like 10.98.0.0/16{26,26}I tried the same on forti manager, I've added a an entry to the prefix list and entered 26 as prefix length in both greater than and less than. But it throws an error:I don't understand quite right, as it keeps telling me "Greather than" must be greater than prefix (met) and less than or equal than "less than" (which is met as it's equal to it)...What am I missing?

Hi,We have hypervizors with VXLAN interfaces which are connected over vlan 600. So I created vlan 600 in the fortigate, and vxlan interface on top of that. That part works.But now the hypervisor vxlan's will have to connect to different vdom's. So one VXLAN terminates in vdom-a while another terminates in vdom-b. Creating emac interfaces on vlan 600 for each vdom did not help,  because VXLAN can't be created on an emac interface.Any suggestion/experiences on how to go arount this?

HI All,As per the subject I am seeing this traffic logged and timing out due to upstrean firewall dropping it. As far as Video filtering was enabled in on of my vDom but I have since disabled it and am still seeing this logged.I have proxy address set under 'system autoupdate tunneling' and 'config system fortiguard' has 'proxy-server-ip' set. So two questions :1 - Why does this not use the proxy ?2 - How do I disable this entirely ?Thanks Domoninic

Hello There,We are trying to run a playbook to extract pdf files and upload them as a attachment.Extraction seems to work fine but we end up getting a error on the upload.Following is the error in the UI.\n CS-INTEGRATION-5: Error occurred while executing the connector action ERROR :: 400 Client Error: Bad Request for url: https://localhost/api/3/files :: {'type': 'TypeError', 'message': \"Internal Server Error. Check log 'prod.log' for more details\"} :: Url: https://localhost/api/3/files Call for URL: https://localhost:9595/integration/execute/ failed with status code 400 \n Looking at prod.log in cyops-api/prod.log we can see that there is a Issue with the restrictedMimeTypes. [2025-12-02 09:10:07] php.WARNING: Warning: Undefined array key "values" {"exception":"[object] (ErrorException(code: 0): Warning: Undefined array key \"values\" at /opt/cyops-api/src/Service/UtilityService.php:669)"} [] [2025-12-02 09:10:07] php.CRITICAL: Uncaught Error: App\Controller\FilesControll

Hello, i try to write a Report Query with a where clause for the "action" field, if action is only in the "SELECT", "GROUP BY" and "ORDER BY" statement everything works as expected, but if i add the action field to the "WHERE" clause it does not work.The following query does not work, commenting out the "AND action like 'deny'" row will make it work, can somebody explain this behavior to me??I am using "traffic" log type source. SELECT srcip, dstip, action FROM $log as l WHERE $filter AND policyid=0 AND action like 'deny' GROUP BY ( srcip, dstip, action ) ORDER BY srcip, dstip 

Dear Expertise, I would like to ask you regarding backing our Fortigate log to tape is a good way or not? we are using FAZ and our license can support only 5GB per day. Thanks

Hi Team,Can some one give a knowledge base/ article which details the step-by-step procedure on how to replace a fortigate firewall running V7.4.8 in Fortimanager GUI.In my setup Fortigate VM's are running - SD WAN rules, please give me detailed step-by-step procedure on how to replace (RMA) the faulty Fortigate Virtual machine with a new Virtual machine from Fortimanager 7.4.8 GUI.Also please detail the procedure to transfer the license from faulty machine to new virtual machineThanks,Prabhu

Hi Team Is there any best practice for deciding Scan for Vulnerabilities need execute Event-based scanning or Scheduled scanning.  

I'm using IPsec VPN with FortiClient 7.4. I've configured two IPsec VPN servers (primary and backup) and deployed the settings to clients via FortiClient EMS. However, during usage, the connection to the primary server consistently drops every 30 to 60 minutes, while the backup server disconnects even more frequently and irregularly.All components are running version 7.4, and there’s no packet loss between the public networks involved. This issue affects all users in our environment.Has anyone encountered this behavior? Any suggestions on how to troubleshoot or resolve it would be greatly appreciated.

I use my FortiAnalyzer (7.4.8) as a "poor man" syslog server and am trying to see if I can incorporate logging from Cisco Umbrella. Cisco Umbrella only sends to AWS S3 storage and I have the path and keys for said bucket. I saw where FortiSIEM has said functionality, but I don't own that product... so seeing if there is a way to handle this via FortiAnalyzer in any form or fashion. This might end up being my final push point if it cannot, to go with something more dedicated as my new syslog platform.

We have our Fortigate firewalls configured for Syslog offloading to Cynet.  We are then trying to take action, to block IP addresses of users trying to brute force VPN credentials.  We are using a script provided to Cynet by Fortinet named Fortigate-Remediation V0.2.exe, and when it tries to block an IP address, it is getting back "Max retries exceeded".  Any chance anyone knows what the fix for this is?

Hi all, Could I use the FANT-5IN1-TG-5M-FEV antenna with the FortiGate 50G-5G? Thanks a lot Best regards,

Hi everyone,I built a small public-facing web app that calculates Air Force PT scores using the latest standards. The site is fairly simple (just data inputs, PFT calculations, and score outputs), but I want to make sure it's properly secured since it’s starting to get more traffic.I’m running it on a cloud VPS and have a FortiGate VM set up, but I’m not totally sure if I’m configuring things correctly for this type of lightweight tool. Specifically:Do I need full Web Application Firewall (WAF) features for something this small, or would basic IPS + URL filtering be enough?Are there recommended settings for protecting simple form-input sites from script injection or bot traffic?Should I be using any FortiGate-specific features to handle potential spikes in traffic or prevent abuse?And lastly, is there anything I should check to make sure my HTTPS setup is fully compliant?I’m not handling any personal data, just the PT scoring inputs, but I still want to lock it down correctly.Any guida