Fortinet Community

Hey allUsing a 'hybrid' network model with Fortigate 80F and a Cisco catalyst 9200LForti handles the routing and is relayed to Cisco.Im trying to relay OSPF routes learnt by Fortigate into iBGP handled by our ISP, however its not working.i can see in Forti that the routes are connected locally but not propagated into BGPI get routes from BGP so i can confirm that its working atleast one way, but not the other.Im trying to propagate 10.0.1.1 10.0.2.1 10.0.3.1 all /25 to BGP for advertised routingget router info bgp summary VRF 0 BGP router identifier 172.16.0.10, local AS number 65500 BGP table version is 6 8 BGP AS-PATH entries 0 BGP community entries Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 172.16.0.9 4 65535 473 449 5 0 0 03:14:03 130 Total number of neighbors 1 corenet0-a #  get router info bgp summary VRF 0 BGP router identifier 172.16.0.10, local AS number 65500 BGP table version is 6 8 BGP AS-PATH e

Hello, I installed the Google Play Store FortiClient VPN app on my Chromebook and am getting the following error. "unable to login, chrome browser is not installed" Tech support won't help because this is the free version.  Has anyone had success using the VPN on a Chromebook? 

 Dear Sir/Madam,I am experiencing a situation where my Fortigate (FortiWifi 40F) is experiencing unexpected power outages (the Fortigate suffered an unexpected power failure!) and even with VPN tunnels up, the equipment only works again after a reboot. Has anyone here encountered a similar situation? Thank you for your attention.   

Hi all, a new fortianalyzer VM, located in a datacenter, everything is setup and working properly, latest version.Added a single device, status shows "down", device was added using its serial number, external IP automatically detected. Port 514 forwarded into the fortianalyzer VM.On the FGT, a fabric connector to the FAZ was successfully setup, showing "connected" status, and even log traffic is being shown.What am i missing?

We currently have an RA IPsec VPN that provides access to the production subnet. I have attempted to create a new RA IPsec VPN that provides access to the management subnet. I created a new VPN with different PSK, IPv4 client range, split tunnel subnet but everything else is configured the same. This was previously working but is no longer working. I can see from the logs that Ike phase 1 is negotiation is not completing successfully, and I can see in the logs "SA proposal chosen, matched gateway XXXX", but I am trying to connect to gateway Y. I have compared all settings of VPN X and Y, and forticlient config of X and Y and everything appears to be correct. I previously managed to get this VPN working as intended, but then had issues when trying to configure it for SAML authentication. All I did today was reverted back to local user but this never worked again. I have completely removed all configuration required and re-created but this is still failing Production VPN p

I have come across a strange issue. I have added a new member to an address group, so not changing a firewall rule directly. I can’t seem to find a way to push it to the Fortigate just as an address change? If I add it directly on the Fortigate it complains it is out of sync, and doesn’t sync back. If I do a retrieve, it doesn’t pull it back in to the Fortimanager either. Am I missing something obvious?

Every other content filter I have ever used Lets you install an agent on the client for the purposes of identifying to the content filter who the user is. Content filters: Lightspeed systems, Securly, Go Guardian. You get the point. Currently the only way fortinet does this is server side and it's windows only. You have to install software on the domain controller. Our environment is mixed, we have windows,chromebooks, mac. This is pretty common now. The solution is simple.Eliminate FSSO ( its far overcomplex for its simple goal)windows :  create a simple .msi that reports the username at login to the fortigate Mac: Create a dmg mac program that reports the username at login to the fortigateChromebook: Create a chrome extension that reports the username at login to the fortigate Without this feature content filtering is pretty useless. If you can't identify users on most platforms and assign different policieswhat is even the point of using your conte

Dear Sirs, I am attempting to implement a basic ZTNA to secure RDP access on port 3389 for remote access and IP/MAC-based access control for local access.After following all the step-by-step configuration of the solution with the following scenario: ZTNA: FortiGate v7.4.8 + FortiClient EMS v7.4.4 + FortiClient agent 7.2.2FortiGate FG-80F: 192.168.254.99WAN1: 189.x.x.x (primary)FortiClient EMS: 192.168.254.106Desktop Windows 11 Endpoints (FortiClient 7.2.2): DHCP 192.168.22.10.xInternal RDP Server: 192.168.254.101 1. Forticlient EMS is connected to Security Fabric connectors2. Zero Trust tags created - Secure_Endpoint2.1. Created ZTNA Server (Access Proxy) — TCP Forwarding (RDP)2.2. Created Service / Server mapping - TCP Forwarding 192.168.254.101:33893. Created ZTAN Rules and associated with EMS tags4. Created Policy & Objects → Firewall Policy - Fortigate5. Installed and configured FortiClient endpoint (7.2.2) and registered in EMSHowever, when performing tests, the

We have a Fortigate-60f and it'll give us basic logging of VPN users like who logged in and when and total bits sent and received. Is there any way to have this log files that they access or copy to and from the network over the VPN? I understand that this may require a subscription but I can't seem to find further information about how to set this up. Thank you!

Hello. I am using a handout FortiGate unit, that still have several months left on a support contract.How can I register that unit under my Fortinet account and purchase a new support contract, when the current one expires?

hello, A modern, fully-licensed, entry-level firewall and an older, powerful, but unsupported enterprise firewall. FortiGate 60F (New Open Box Licensed) vs. 301E (Used, Unlicensed) as shown below:Fortinet FG-60F FortiGate 60F Firewall Security Appliance FG-60G-BDL-950-36 used unlicesbed Fortinet Fortigate 301E NGFW Firewall Network Security SFP FortiOSWhich should  i purchase and what the cheapest cost to license the 301E? Also, can I manually update the 301E without / bypassing FORTINET server ? During login dol i need to access the FORTINET server first before accessing the unit ? Thanks, David

Currently we have a Cisco Firewall that has multiple NAT rules for Citrix applications. Now we are adding a Fortigate FW in front of the Cisco Firewall and it blocks Citrix applications. Do I need to create the same NAT rules on the Fortigate FW or could I create a range to allow all the NAT rules through the Fortigate. What would you suggest? 

Friends, I'm having trouble remotely accessing the firewalls (FortiGate) using FortiManager. This problem started after updating the FortiGate firmware from v7.4.8 to v7.4.9. When I try to remotely access a firewall in the network, FortiManager is assigned the source IP 169.254.0.1. Has anyone here encountered this situation before? Thank you for your attention.

I have added my FortiAnalyzer (7.2.) as a device to itself. In addition, I configured in my FAZ local device log settings, to send local event logs to itself. The connection seems to be working fine, since I receive event logs. Still FortiAnalyzer is shown as "down" under my device manager view. The following command also shows that, there seems to be a connection established.diagnose test application oftpd 3 Is that a GUI bug? Thanks a lot!

Keeps hanging in isolation netwerk and cannot find any documention of this works

Hi  Recently there were numerous sites that were getting blocked by Web filtering on my fortigate. Were there any recent changes on the Fortiguard Databases that might have caused this?  One example was that Youtube stopped working, I then checked and saw that High Bandwidth Application category was changed to block causing Youtube to stop working  Thank you 

Introduction As industrial systems evolve toward remote operations and cloud integration, traditional OT architectures are being reimagined for a connected world. The challenge is maintaining the same security discipline that protected critical processes for decades — but now within virtualized, cloud-native environments. To achieve this, most organizations still rely on a foundational reference: the Purdue Model. To visualize the structure and dependencies of industrial control environments, security professionals often refer to the Purdue Enterprise Reference Architecture (PERA) — commonly known as the Purdue Model. It organizes industrial systems into hierarchical levels, as you can see in the following diagram:     This model helps define security boundaries — what data can (and cannot) traverse between levels. It underpins segmentation strategies, firewall rules, and monitoring zones in modern architectures — including those deployed in the cloud.   Why Segmentatio

Hello everyone!I am having this problem with my FGT 80F release 7.6.2F build 3462, using a Fortinet SFP model FN-TRAN-SX.Below is my environment:- The device connected on the WAN 2 interface only supports speed 100 full.- Whether connected via copper or fiber the WAN 2 interface is always set speed to 100 full.- The device connected on the WAN 2 has only one fiber NIC. The connection to WAN2 copper interface is made through media converter.Fault description In the current release, the device connected on WAN2 is only seen if it is connected in copper, while the WAN2 interface in fiber remains switched off even if we disconnect the copper cable in the branch, following output when only fiber cable is connection on WAN2 interface FGT-80F-1 # diagnose hardware shared-port wan2Get nic name: wan2 medium type 2, Copper even in the case of both cables disconnected on WAN2 the output of the following command does not change, as per your documentation (ART ID 33393

Hi,I’ve configured port policies on my switch, but it seems that each port only authorizes one MAC address. I’ve attached two screenshots of my current policies.Could someone explain what I might be doing wrong or what settings I need to change so that multiple devices can connect through the same port?Thanks in advance for your help!

Hello,Has anyone tried running FortiGate VM or any other VM appliance from Fortinet on a Raspberry Pi?How was your experience? And how did the setup perform?

Hello Experts, At SD-WAN fortigate site-to-site VPN, we use IPsec aggregation with 2 IPsec tunnels (WAN),which are connected to LTE. At each LAN side, SIP phone is connected.As voice quality is not good (maybe due to instablity of LTE),we added Forward Error Correction (FEC) for both direction (Egress and Ingress).As the result, the quality is improved a little. We saw the configuration at CLI and the following is seen.set fec-egress enableset fec-codec rsset fec-ingress enable Q1 We want to know the overhead of FEC in this case. How much is added? Also, we found the other FEC configurations, as below. SDWAN2-1 (vpn1_1) # set fecfec-egress Enable/disable Forward Error Correction for egress IPsec traffic.fec-send-timeout Timeout in milliseconds before sending Forward Error Correction packets (1 - 1000).fec-base Number of base Forward Error Correction packets (1 - 20).fec-codec Forward Error Correction encoding/decoding algorithm.fec-redundant Number of redundant

Hoping someone can point me in the right direction to discover how outbound NAT can be applied in an SD-WAN configuration. Running 6.0.6We have WAN1 and WAN2 in the SD-WAN interface. Both have /29 addresses. I need the Exchange server to use the 2nd available host address on the WAN interfaces for Outbound. But the WAN interfaces are not available options for destination interfaces, only the SD-WAN interface.Is there a way to accomplish this that I am just not seeing?Thanks,

Hello, I am trying to create an SD-WAN Overlay template but hub field keeps showing None when I try to populate it. Please any ideas on what could be causing this? I'm running  FortiGate 7.6.4 and  v7.6.4  for the FortiManager. Please has anyone encountered this before or any ideas on what to do   Thank You  

Good morning, I have a fortigate 40f, and I can't access it.The equipment configures itself and I start working but there is a power cut in the tube and after it starts working, I can't access it because no one leaves it as if it was blocked, but it hits several hard resets and even then I can't access it.

I'm adding a second wifi SSID to our current setup.  We are using Fortigate V7.4.8 with NPS for authentication.  The first wifi SSID, which works fine, is setup to allow a domain user to connect.  I'm setting up the second as an IT wifi hotspot to allow select IT personal to join a specific VLAN for IT tasks.  Everything is setup and works great except for authentication.   Here is my setup for radius: config user radiusedit "DC_RADIUS"set server "X.X.X.X"set secret ENC XXXset nas-ip "X.X.X.X"set source-ip "X.X.X.Y"set secondary-server "X.X.X.Z"set secondary-secret ENC XXXnextedit "XXX_IT_RADIUS"set server "X.X.X.X"set secret ENC XXXset nas-ip X.X.X.Xset auth-type ms_chap_v2set source-ip "X.X.X.Y"set secondary-server "X.X.X.Z"set secondary-secret ENC XXXnextend DC_RADIUS is our radius setup for domain users and XXX_IT_RADIUS is the radius setup for our IT wifi.  The issue is that even though I'm specifying the auth-type for XXX_IT_RADIU