Fortinet Community

Hello,I would like to ask for your advice on how you would configure logging on Fortigate routers and whether it is worth enabling security fabric in such a configuration:-one main Fortigate and Fortianalyzer in the main location.-four Fortigate routers at the branches connected to the main Fortigate (hub and spoke topology) via doubled IPSEC (SD-WAN).-the remote Fortigate routers do not have UTM licenses because all network traffic is reversed and goes out to the Internet through the main Fortigate router. Now how would you configure the security fabric and logging in this case?1. Security fabric disabled, logging into Fortianalyzer only from the main Fortigate (here, traffic to the Internet is visible from remote Fortigates anyway) - this is the current situation.The downside of this solution is that in order to check local traffic, I have to log in to each of the branch  Fortigates.2. Security fabric disabled, but adding remote Fortigates to Fortianalyzer (there

I was digging into this feature wanted to get some real-world understanding.Have you of had this service block something?Is it only malware / file-based (assuming so since its in the AV Profile)Is there anything comparable in the Palo world? Sounds a bit like Wildfire but Wildfire is more sandboxing. But it also has crowdsourcing since if one customers wildfire detects a file that is malicious everyone will get that wildfire update.Thanks and appreciate any thoughts here.

I'm in an organization where we have Application Control enabled in our FortiGate. We have allowed Viber within the Application Control, but for some reason, we can send messages except for media files. This seems to be inconsistent too as some members of the organization can send despite being in the same IP address range. Viber has been allowed in the Application Control since I got in the organization, but this problem suddenly occurred last week. How can this be solved? EDIT: I can confirm that this is not a Viber problem because if we disable the Application Control, we can send media, but disabling Application Control is not an ideal solution for our organization. 

 i have IPsec Dialup VPN, my remote connector couldn't validate when 2FA via email is arrived the only users that can verify with 2fa is less than 50 sec.i have changed the validity of email time to 3 mints, but nothing change. i went through similar issue but fortigate they confirmed that it's has been solved in 7.6.3 i have upgraded the fortios issue still exist.

We are a new customer to Fortinet and I've installed the software on about 600 computers. On my own machine, I get high risks notifications for Firefox when I have updated to 145 but is reported as 143.  11/17/2025 12:02:08 PM warning vulnerabilityscan date=2025-11-17 time=12:02:07 logver=1 id=96521 type=securityevent subtype=vulnerabilityscan eventtype=status level=warning uid=----------------- devid=FCT8003704507633 hostname=----------------- pcdomain=-----------------deviceip=10.2.97.3 devicemac=----------------- site=default fctver=7.4.4.1887 fgtserial=N/A emsserial=F----------------- usingpolicy=Default os="Microsoft Windows 11 Professional Edition, 64-bit (build 26100)" msg="A vulnerability scan result has been logged" vulnid=87955 vulnname="Security Vulnerability fixed in Firefox 145" vulnseverity=High vulncat="Web Client" vulnref=https://www.fortiguard.com/product/encyclopedia/vuln/87955 detectedpath="C:\\Users\\-----------------\\AppData\\Local\\Mozilla Firefox\\fire

Dear,I am having difficulty importing YouTube access data into the report template I plan to use. I believe the dataset currently in use is suppressing the full URL.I am sharing the dataset and a screenshot of the result. In the standard analyzer report (Detailed User Navigation Log), it is possible to correctly view the website and application details for the same day and location.Could you please check the dataset to determine if there is any reason for the suppression of access details and the correct category? This dataset was generated during the product's initial deployment and has never been modified. Two years have passed, and we've only now noticed this issue. I believe this might also be affecting other access records in the report. Reference: Standard Analyzer Report (Detailed User Navigation Log)The FortiGate also contains several access logs for YouTube and for the video/audio category, none of which appear in the report for the same day/time.O Dataser Used 

Hi All, I have some quires which is raising question in my mind. Can I see following information in logs If I enable deep inspection into the Firewall policy. Details information :-1. user id2. password Any information that end user enter into his/her browser to gain access any https/http. I have installed CA certificate into end user machine of Foritgate Firewall (SSL certificate) Firewall policy's inspection mode is proxy based inspection Also applied - security profile such as - Antivirus, webfilter profile (proxy mode), application control ( proxy mode), IPS, Full SSL deep inspection. Still unable to see the which I want - encryption / decryption packets.  Do you have any experience on that please share your view. so that I can resolve my issue. I have gone through several article still not able to get any clue regarding this.  Thanks for your support.      

Hello,I need some help with EAP chaining with TEAP for SSID configuration.To my knowledge, Wifi Certification with machine Certification is doable, but how to integrate LDAP authentication of users to that?At the moment, the authentication is passing through Cisco ISE, and it is checking both machine certification and the username/pass of the user. Is there any way to combine them to FortiNAC-F 7.6 or 7.4 ?  Thank you in advance.   

Hello everyone,I have a quick question regarding FortiAuthenticator Cloud.Does it support two-factor authentication (2FA) integration for NoMachine Client software (Enterprise license)?If so, could you please share any configuration guidelines or compatibility notes for setting this up?Thanks in advance!

Hi everyone, I’m having an issue with my SSL/TLS certificate when setting up a captive portal for Wi-Fi authentication. 1. I imported my company domain certificate (fullchain.pem and privkey.pem) under System > Certificates. 2. The import works fine, it shows valid dates, status OK, and everything looks good.3. The certificate also appears correctly under System > Settings > HTTPS Server Certificate and under Server Certificate. However, when I try to configure Single Sign-On (Service Provider Configuration), the certificate does not appear in the list. This certificate was generated using Let’s Encrypt (Certbot) and it’s a wildcard certificate.My FortiGate is running version 7.6.4.I want to use this certificate for the Wi-Fi captive portal, so that users are redirected to a company domain like auth.wifi.company.com during authentication. Has anyone experienced this before or knows why the certificate doesn’t show up in the Service Provider Configurati

Hello,I installed the #Fortimanager and tried to log in to the GUI using FortiCloud and Fortimanager credentials both give the error message "Couldn't resolve hostname", I am not able to get to the web GUI Anyone could help here, please? |Thank you 

Dear Fortimail admins, I want to create a group email address on FortiMail like on Exchange and Google workspace. My goal is to have an address (ex : marketing@domain.com) that automatically forwards incoming emails to multiple recipients (ex : 4 users). Essentially, I want to set up a distribution-style group so that when someone emails marketing@domain.com, all members receive the message.Is there a way to configure this on FortiMail in server mode? Kind regards,

Hello Fortinet Community,I’m trying to configure Captive Portal authentication using Azure AD SAML on my FortiGate firewall, but I’m running into a certificate error during the authentication process.Here’s what I’ve done so far:Imported the Azure AD IdP certificate into FortiGate.Configured the SAML SP settings on FortiGate (Entity ID, SSO URL, Logout URL using public FQDN).Created the user group and enabled Captive Portal on the interface.Policies are in place to allow Azure endpoints without authentication.Despite this, the login redirect works, but the process fails with a certificate-related error.Questions:Has anyone successfully resolved this certificate error when using Azure AD SAML for Captive Portal?Do I need to use a publicly signed SSL certificate on FortiGate for the SP URLs?Any tips on matching the certificate requirements between Azure AD and FortiGate?Any guidance or examples would be greatly appreciated!

I'm a network engineer student, working on an un-real networking project. I have 3 sites connected via an IPSEC Tunnel. Two of them are using ospf and one is using EIGRP. Do we need to transition the third site to ospf or Routes Redistribution will do the Job? Also What routing protocol should we use in the tunnel?

I have advpn with 1 hub and 5 spoke like below picture.Each spoke have 3 connection to the hub, two using internet and one using dedicated wan.Wan connection for each spoke use different vendor.when i check bgp neighbor from the spoke, i can see below prefix for each connection.WAN :Internet-2From above 3 picture we can see for wan there is only one prefix for each spoke subnet but 2 prefix for each spoke subnet for internet link.Need help and advice here should we block all prefix on internet-1 for nexthop 10.10.111.xxx and block all prefix for nexthop 10.10.112.xxx in internet-2?Also if we see in the topology, let say there are initiate traffic from spoke1 to spoke2 and spoke 1 choose internet-1, it's possible the hub forward the traffic using internet2 and change the nexthop to 10.10.112.3?

Dear Everyone, Currently we are configuring automation-stitch to send alert to our platform for anonymous login to FortiGate GUI. I tried to configure the trigger with specific condition.- if user A try to access to dashboard and failed login for more than 3 times, automation-stitch must consider this is bruteforce attack.- if user B try to access to dashboard and failed login for under 3 times, the automation-stitch must also trigger this alert but consider it is not bruteforce attack. Kindly provide me some ideas regarding to this. Thank you.Joy

Today, one of our remote iffices experienced a complete WAN outage on all internet links.We have a redundant L2L (LAN-to-LAN) VPN tunnel configured to handle this failover scenario, which should route internet-bound traffic through our headquarters.The tunnel configuration is verified as correct. The SD-WAN is registering the failover attempts, and the logs also confirm that the egress attempts are occurring. However, the transmission throughput is stalled (or "capped") at 84kbps and is not passing viable traffic.

I am looking for possible solutions why my users are losing connection with the EMS server outside our network. The EMS server states unreachable on the forticlient at random times and loses the users credentials, also they are unable to reconnect to the EMS until they reconnect to our network internally. I work at a Police Department so my users need constant connection to VPN. What would cause the loss of connection to the EMS and they have to reconnect by coming back to the PD to connect to the internal network. Where should I start looking?

Hey guys. I'm trying to get my FAZ to backup its settings to an SCP server of mine. However I want to make sure I'm on the right path. I've set up SCP on my FortiGates, so I assume it can't be too much different.  config system backup all settingsset cert : set crptpasswd : So are these the Private key and the password used to unlock the key? I've tried generating a keypair with PuttyGen, but not sure how to apply it to these settings.  Can anyone point me in the right direction?

I would like to use a FortiExtender 101G to connect to a Fortigate 60F (HA Pair running 7.4.9) and use the FortiExtender as a second WAN connection. Like this: FortiExtender (LAN port) <-> Fortigate 60F WAN2 port. The cell service on the FortiExtender will also have a static IP. 1) Is this setup possible?  I only want to use the FortiExtender as a WAN, nothing else.  So I need to setup the FortiExtender like a regular ISP modem (like "bridge mode").2) If this configuration is possible, would I configure the static IP of the cell provider in the Fortigate WAN2 port?  Another wrinkle is that I would have to setup all of this remotely, no physical access to either device.  I would have a non-technical person helping me with connecting the devices.  I therefore need to make sure that I can configure the FortiExtender without the need of connecting a laptop directly to the FortiExtender first.  I need to the configure the For

Just upgraded to ubuntu 25.10 and I can't no longer open de forticlient app, I get this message about "ERR_INVALID_ARG_TYPE" and then when pressing ok, nothing else happens.The version I am currently using is 7.4.0.1636 (not the current one)  

Hello, please help me understand this article. I have a WAN interface in a SDWAN zone which is used for DNAT. And occasionally the policy that contains the VIP won't get hit and traffic doesn't pass. Now there's this article explaining how to handle VIPs when the interface is a SDWAN member.Creation of a VIP (DNAT) when WANs are in... - Fortinet Community The article basically states:- On the VIP, use the physical interface, not the zone- On the policy, use the physical interface as incoming interface, not the zone Now the catch is,  you can't even use zones in the VIP interface selection GUI. And furthermore, you can NOT select the physical interface in a security policy when it is part of a zone.What is this tip even about? The first one is useless because that's a restriction of FortiOS and the second one is also not applicable because it's just not possible. If "wan" is part of "virtual-wan-link" you can only ever reference that zone in a policy, never the

Hey all,I passed FortiManager 7.4 admin today. I had previously passed FortiGate 7.4 admin. I think that means I'm an FCP, right? Do you know if you have to do anything to get this to get recognized or to show up on the fortinet training site?Thank you

Hi, is it possible to achieve redundant ISP connectivity in a FortiGate HA setup using software or hardware switch, without relying on an external switch.Pleas guide.   

Has anyone done Window pc>Fortinac>OpenLDAP for 802.1x user authentication.The authentication keeps on failing, regardless of EAP protocols used.Switch model used Juniper EX. Attached FNAC radius logs.(2823) Received Access-Request Id 233 from 10.176.2.159:60141 to 10.176.2.24:1812 length 158 (2823) User-Name = "user1" (2823) NAS-Port = 564 (2823) State = 0x1dfeb1601ffda4e7b61bb33bb2402358 (2823) EAP-Message = 0x020300061500 (2823) Message-Authenticator = 0xbf1130bb5dbab2bf9b877bc0c1313dbd (2823) Acct-Session-Id = "8O2.1x815f094b00060db3" (2823) NAS-Port-Id = "ge-0/0/3.0" (2823) Calling-Station-Id = "10-7d-1a-1a-5b-c3" (2823) Called-Station-Id = "c8-13-37-c7-4a-b8" (2823) NAS-Port-Type = Ethernet (2823) Restoring &session-state (2823) &session-state:Hint = "0438c294-f027-4352-a474-d5faa06ff01c" (2823) &session-state:Tmp-String-1 := "request" (2823) &session-state:Framed-MTU = 1180 (2823) &session-state:TLS-Session-Information =