Fortinet Community

Looking to expand my fortigate knowledge and I dont have the money for a homelab/firewall, but want to learn how to play with Fortigates. I been looking for a lab you can rent.

Hi all,I'm currently updating my fortimanager configuration.The problem I'm struggling with is about dynamic addresses used in interfaces with a captive portal. I have many fortigates with a specific interface that handles guests access (through the captive portal) and I need to tell Fortimanager to insert in the exempt list different addresses. Using dynamic addresses mapped to single devices does not seem to work. When I'll try to install policy packages fortimanager ignores the mapped dynamic address (for different fortigate). Rizio

Hello Community, I have an issue with authorizing FortiAnalyzer with FortiGate,Please advise,  

Hi !I'm looking at going NSE4-> and will buy physical firewall as a start, then add switch/AP to learn how security fabric works.I have a proxmox for VM's (fortimanager/analyzer)I'm looking at the FGT 80F, it will handle 7.6 and have more RAM then the 60F.The 80F will handle everything I need (spec wise).. Just want to doublecheck if it's a good model or if I should look at another model?Thanks!

Hi Everyone, I'm trying to integrate fortinet firewalls v7.0.x, v7.2.x and 7.4.x with Fortimanager v7.4.8 and v7.4.7 but unfortunately unable to integrate to all in my gns3 lab however I was tried to do low encryption algo and ca cert and local cert according to fortimanager but no luck. Hence please help me out on it and share the steps to do the success lab. Thanks in advance 

Hello Fortinet Community,I am reporting a false positive detection for my legitimate Android APK file built with Flutter. File Name: AppleTrack.apk SHA-256 Hash: 7607192fcfcdd64cdef7107ceeb3000d8f4a3dc7cd4b530cfc8a36e951ef7663 VirusTotal Report Link: https://www.virustotal.com/gui/file/7607192fcfcdd64cdef7107ceeb3000d8f4a3dc7cd4b530cfc8a36e951ef7663/detectionAPK : https://drive.google.com/file/d/17JviLMrjUim3dza6Mv94dqCzJTQmSp9a/view?usp=sharingDetection: FortinetAndroid/Generic.S.7E8092!tr (1/65 on VT, all others clean).This is a safe Flutter app for game tracking (Apple of Fortune tool). It uses standard packages like video_player, url_launcher, and shared_preferences. No malware, network calls are only to Google/YouTube for tutorials. The obfuscation is from standard Flutter build (--obfuscate flag). Sandbox shows normal behaviors (DNS to googlesource.com, flutter.dev, etc.).Please review and whitelist/remove this false positive from your database. I can provide the full source

Hello,  I am having an issue with FortiClient. It is installed on a device with an ARM processor. I am attaching a screenshot of the PC specifications and the error message that appears. We have reinstalled, deleted files, cookies, versions, etc. Can you please help me?Best regards.

Hello! I have a question about the FortiClient full app (not the "FortiClient VPN-only" version), can it be used for SSL & IPSec VPN connections only in unlicensed mode, after the 30-day "trial" period expires?I know I can simply use the "FortiClient VPN-only" version, but the problem is that it's latest version currently is 7.4.3 and I have a Windows ARM64 machine on which that version recently started having a JavaScript error and simply won't work anymore.I've tried the FortiClient full app, which is 7.4.4 and it works.

We have two Fortigates of interest FGT1 and FGT2 participating in both area 0 and area 12.FGT1 receives a route from FGT3 via FGT2 via area 0 (as expected).But FGT2 receives a route from FGT1 via area 12 (not expected).This creates asymmetric routing. Any guidance on debugging would be appreciated. Area 0 is a managed network, we do not control the Cisco routers. There is nothing in the wan1 cloud other than interconnects. FGT1 at Site 1 originates a VM subnet /30. FGT1 participates in both area 0 and area 12.FGT2 at Site 2 also participates in both area 0 and area 12.FGT2 at Site 2 routing table shows the /30 via area 12. My expectation is the route would be learned via area 0.FGT3 originates a /24 route that appears at FGT1 via area 0 as expected.FGT4 is only on area 0 and receives the /30 route via area 0 as expected. The core issue here is that we have asymmetric routing at FGT2. I understand that intra-area OSPF traffic is preferred over inter-area traffic. How

Hi guys, I can't install the free Forticlient VPN client on Windows 11 ARM. It doesn't generate any errors, it just rolls back and returns the following message:    This was the version I downloaded:  

hello kindly we need your assistance in checking the problem, we have an endpoint which is connected to Forticlient ems an when off-fabric, we need to block the user from having local internet access and for all the traffic to reach the internal network only through a configured ipsec tunnel. the issue is that when connected to vpn i have 2 default route, the vpn with lower metric, but on windows he will do automatic check when seeing the internet is dow and then he is using the local default route with the higher metric. i need to totally block the internet for the off-net user. how we can achieve this and intend to have a permanent and stable solution. to note that the webfilter is enabled and all categories are set to block

Hi everyone,I’m working on a FortiGate running FortiOS 7.4.x.I have:2 WAN interfaces inside virtual-wan-link (SD-WAN)2 IPsec interface inside another SD-WAN zone called remoteAbout 100 different /24 subnets that should be routed into the remote zone (over the IPsec tunnel)All internet traffic must go out through virtual_wan_linkThe obvious solution is creating 100 static routes, one for each /24, pointing to the remote SD-WAN zone — but that’s not practical at all.How do you guys handle large numbers of remote networks in SD-WAN deployments?Thanks!

Hi team, After upgrading our FortiGate to FortiOS 7.2.12, SSL VPN connections via FortiClient were consistently disconnecting at 40% during tunnel setup.This issue did not occur on 7.2.11. After downgrading to FortiOS 7.2.11, SSL VPN connections are now stable and working as expected.Could you help me troubleshoot this issue further to confirm root cause and ensure safe upgrade paths in the future?

Hi, I must upgrade a Fortigate 1000F from 7.2.10 to 7.4.8.I receive an error that i've never seen : "File is not an update file".I'v verified checksum of the file.I've got the same error when i try to upload the file directly to the gui and if i try the upgrade with fortiguard servers.The support team send me a firmware image to compare with the file i've downloaded and the files are exactly the same. Has anyone ever encountered this problem?ThanksSimon

Hi community members I noticed from time to time docs.fortinet.com is not accessible and I get the below error message.  From CLI: $ ping docs.fortinet.comPING docs.fortinet.com.geo.fortinet.net (149.5.234.138) 56(84) bytes of data.64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=1 ttl=46 time=51.0 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=2 ttl=46 time=43.4 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=3 ttl=46 time=57.1 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=4 ttl=46 time=43.0 ms--- docs.fortinet.com.geo.fortinet.net ping statistics ---4 packets transmitted, 4 received, 0% packet loss, time 3004msrtt min/avg/max/mdev = 42.972/48.625/57.136/5.852 ms$ wget https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/704939/vrrp-virtual-macs--2025-05-04 09:43:02-- https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/704939/vrrp-virtual-macsResolving docs.fortinet.com (docs.fortinet.com)... 14

Hi all. I have an odd issue and can't figure out what is going on. I use the P2 ControlD free DNS server over port 853 for DoT. This worked perfectly for months and never saw any issues until now, but it shows the IP4 addresses (76.76.2.2 and 76.76.10.2) for ControlD as unreachable. However, I can ping the IP addresses from the fortigate no problem and other routers show no issues. Also, Quad9, Cloudflare, Mullvad, and other DNS over TLS providers work. Any ideas?

Hi FWB adminsIn FortiWeb standard A-A HA I can see session pickup (in CLI), but not in high volume A-A HA, while I think this feature must be available here since HV A-A HA should keep the sessions on fail-over, as this is basic HA feature when the sessions are critical.So is it implicitly enabled even not shown or it just doesn't exist in HV A-A HA?

Hi everyone, I'm currently preparing for the Fortinet NSE6 FNC-7.2 exam and was wondering if anyone could recommend the latest and most effective practice resources or mock tests that closely match the actual exam format.Any guidance, study tips, or trusted sources would be greatly appreciated. Thanks in advance.

Hello team, Is there a tool to make aessment on fortigate firewalls? For example for Palo Alto exist Expedition tool Thanks in advanceBR

I can't figure this out. I created an SSID (wifi) which got added to the wqt.root software switch as wqtn.30.wifi. I understand you can't add an interface to SD-WAN if it's in use, but removing wqtn.30.wifi from the software switch only makes wqtn.30.wifi available to add as a member in SD-WAN, not the actual WiFi interface.I've tried adding wqtn.30.wifi to the SD-WAN zone, but the policies don't seem to be working the way I'd expect them to.What's the trick to getting the WiFi added to SD-WAN?

I have an existing Azure environment with a vFG that currently has one subnet. However, we need to add several more VNets with different subnets now, and we want the FG to control the traffic between them.Each LAN side NIC needs to be on a separate subnet, which would put it in a separate vNet.  All NICs have to be on the same VLAN.  I'm not sure how to configure this.    

I'm pulling my hair out.A user in the company is trying to get to a website. however the Fortigate is blocking access to the page. Using Firefox, when I go to the website I get:- The firefox "potential security risk ahead".when I click "Advanced..." I get:- The certificate is not trusted because it is self-signed.- Error code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT- View CertificateWhen I click "View Certificate" I get- Organization: Fortinet- Common Name: Fortiguard SDNS Blocked PageI click "Accept risk and continue" I get to:- "Fortinet Secure DNS Service Portal" and "Web Page Blocked! You have tried to access a web page which belongs to a category that is blocked. "Ive checked the site withhttps://www.fortiguard.com/webfilterhttps://www.fortiguard.com/services/sdnsand the site passed both.On the firewall I setup a new policy, with the source being my computer, and the destination being the website i'm trying to get to. I turned off all the security polices and put the SSL Inspection to

Hi,when viewing "FortiView sessions" I'm seeing [object Object] in the source column instead of IP.Don't remember it was like that before... (currently on 7.4.9)  any ideas would be appreciated,Thanks...

Hi, Infrastructure :FGT 100F 7.4.7Core switches : 1024D 7.4.5Access switches : 148F 7.4.5AP : 7.4.5 Just one vlan is unavalaible on some switches and some AP after TIER-2.The root bridge is at TIER-4 on the topology. When i force the root bridge to be at core switch, STP is flapping.Do you some ideas to resolve this issue ?Thanks in advance

I have Forti devices with the 7.2.x firmware family, and i'm planning security updates to mitigate vulnerabilities. However, the PSIRT vulnerabilities site recommend migrate to 7.4.x family to fix them, and in some cases, the vulnerabilities in that family suggest migrate to 7.6.x.From your experience, are these family versions stable? Or do they have a lot of bugs?