Fortinet Community

Hi ZTNA adminsRegarding EMS georedundancy HA deployment, on each site there is one EMS, one edge FGT, and each has its public IP. The clients are registered with ztna.domain.com pointing to the first site's public IP.My question is, what is the best way to have a redundant deployment that makes switching ZTNA app gateway as transparent as possible to the user.My first though is to use FortiADC's GSLB, so the DNS directs to the available ZTNA gateway. However it seems for me an excessive solution for a small problem. So I think that some simpler solutions should exist.Any idea will be welcome.

Hi, I'm having a problem with Fortimail as a VM on the gateway website. Unfortunately, I can't communicate with the SMTP.ore server.I've taken the following steps:FML public addressExposed public IP ports to FML -> 475, 587Entered server communication via SMTPs in FMLAdded an A record in the hostingAdded an MX record indicating this server as a higher priorityIs an SPF record really necessary?Has anyone had similar problems? Is there a solution? The hosting is blocking port 25

What resources did you use to pass this exam? I went through the free course on fortinet institute and felt like I understood most things. I have my CWNA so i know the basics of wifi. But the finer details such as memorizing specific CLI commands have me questioning if I’m ready or not. Does the exam test on tiny details like this or is it more broad? I scored 90% on the sample questions but it’s only 8 questions so i know it doesn’t mean much. Have any of you found any good practice tests to gauge your readiness?

Hi All We are having issues with reading SNMP data from our 4 FS1048E switches. Initially they were running software 7.2.something and everything was fine. After upgrading to ver. 7.4.3 the problems started. The issue exist on all 4 of our FS1048E, but not on any of our 100/200/400 series switchesWe only get partial data when polling by SNMP, and investigation shows that the SNMPD process often goes to 100% CPU, stays there for a while and then, eventually kills it self.       Upgrading to 7.4.6 has not solved the issue. With the software currently on our Fortigate, 7.4.6 is the recommended version to run.No issues seen on traffic switching.TAC case has been created, but no useful help from that side.Anybody else seen this?

I have been running Full UTP on a ha pair of 40F for my family main goal was fitler kids vlan. small device had to cut back on some stuff but was still able to do the filtering. I just bought a pair of 100F, and I wanted to ask if this is dumb thought.Comparing the UTP vs just Forticare the two things I see I would miss that my 2 years of logs show I use is DNS filtering and web filtering. However 99.9% of my web filter hits are on my kids vlan. For my VLAN to VLAN routing and ACL I had a pair of mikrotik routers.My plan was to replace the routers with the two 100F buy forticare run SSL decrypt and APP control at that level. Then keep UTP on the 40F but then only decrypt on my kids vlan and only run web filtering and dns filtering on just that vlan. I don't think DNS filtering is a heavy hitter. I am honestly a bit confused why app control can't do it all I see the same categories in app control and as I understand app control is before web filter in the policy chain.I have a dedicated

 I red documents  for VOIP priotizing https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/190566/traffic-shaping-for-voip   but when i have a tunnel for a voip central server (its not in our hq), is destionation that IP sip server and outg interface that tunnel? As you can see i priotize sip traffic, not voip as a protocol.Look the picture below.  

Subject: Unable to block WhatsApp Web file uploads despite SSL Deep Inspection and Application ControlDescription:We are trying to block certain file types (PDF, EXE, BIN, ZIP, RAR, DOC, DOCX) uploaded via WhatsApp Web using FortiGate. We have applied the following configurations:SSL Deep Inspection is enabled on the relevant firewall policy. Custom Application Signatures for file types have been created and added to the Application Control profile.All relevant ports (TCP/80, TCP/443, UDP/443) are included.Logging is enabled.@whatsappIssue:Despite the above configurations, WhatsApp Web file uploads are still allowed; blocked actions are not enforced.Packet captures with diagnose sniffer fail to detect WhatsApp Web traffic by hostname, only by IP.Attempts to create custom signatures for multiple file types (PDF, EXE, ZIP, etc.) either fail due to CLI errors or do not block files as expected.QUIC protocol (UDP/443) seems to bypass Application Control unless disabled.Objective / Requ

Hello,we have a huge active directory with around 99 OUs and many thousand users in it.If I browse it, my firewall freezes.I'm only able to create users, by copying the existing ones and change the username.  I can solve it, only query the necessary OUs, but if a User gets moved from one OU to the other, I have to change it every time. I use Server Port 389 / sAMAccountName / Bind Type: regular / Secure Connection / Protokol STARTTLS / no certificateUser Auth. works fine. Problem only occurs when I browse the LDAPFortigate is a 200F (no cluster)Any thoughts?

I have fortigate firewalls with latest mature OS, I need to configure Avaya telephony system, when i am seeing logs it showing various port ranges(10000 to 65535), when i put IPS and application control on the policy, telephony  communication stops, i need to put security on this so kindly guide me what modification i need to get this done, Avaya systems are avaya IP office 500 - R11.0.4.2 

I have a Fortigate 80F device, 6.4.16 fw. I want to block games from opening on LinkedIn at my company. I tried it through the web filter, but it didn't work. How can I do this? 

Hi there, We use FortiClient VPN in our company and we are having problems when using some websites such as Factorial and Teamwork. Content does not load properly when we are connected to the internal VPN. We have tried adding this websites in FortiSASE as URL exceptions but didn't work. We are using FortiClient 7.4.4 version with MacOS 26. Any advice?Thanks in advance.

Hi All,  I encountered a strange issue on my forticlient VPN version 7.4.1.previously I have setup custom IPSEC VPN in my Fortigate FG500e with RADIUS/NPS user groups, and for a long time there were no issue. in the few days back, the vpn client start having strange behavior, after I put my password is should have been keeping the password and asking for MS authenticator token. but now the forticlient remove the password making it blank and asking for authenticator. when I put my authenticator token, it keep notifying "please provide password" : for the record I'm using version 7.4.1.1736the VPN is IPSEC not SSL this issue only happens using RADIUS authentication, when using fortigate local user the vpn can be connected normally. please help 

I'm still looking for a configuration guide and best practices for setting up a FortiGates cluster with a core based on two 1024E FortiSwitches in an MCLAG. I'm having the problem that when connecting access switches in a ring topology, the ring closure process begins to be negotiated even on the ICL interface of the MCLAG. Any help on this?

Hello,i need to move my on premise Fortianalyzer to Azure.How can i move my license actually associated to the on premise faz to the new one on azure?Is it feasible?I would like to do the following: create the new faz on azureimport the old faz configuraziontransfer the on prem license to the new azure Fazchange the ip on all the fortigates to the new Fazbe able for a short period to access the on prem faz to see the old log (i.e. for two weeks), i these case i need a trial license or because it's receiving no logs i'll be able to access the machine with no license?haven't found documentation about transferring the licence, so i think i just need to go on my forticloud and change the serial number of the old on prem faz with the new one, is it correct?And at which stage of the deployment should i select the BYOL ? Thank youRegards

Hi, If I use Microsoft Enterpise CA in my domain to issue a SUB CA for Fortigate to do deep inspection, do I need to deploy SUB CA on the clients system, especialy Linux, or I just need my ROOT CA certificate? 

I need a help to send outbound connection requests logs to EMS from all the endpoint clients installed in my company devices.Also even thought added rules to block rules in the list it's not blocking the traffic.

I have a FortiGate71F (v7.4.8 build2795) "FortiLink'ed" to a FortiSwitch124F (7.6.1-build1047)I have a Dynamic Port policy:config switch-controller dynamic-port-policy edit "typcialdevices" set description "A port policy for typical devices we know about." set fortilink "afortilink" config policy edit "forti-aps" set description "The FortiAPs" set mac "b4:b2:e9:*:*:*" set hw-vendor "Fortinet" set family "FortiAP" set vlan-policy "vpapmgmt" next edit "pmsi-default" set description "LAST policy rule. This indicates the default properties for any" set mac "*:*:*:*:*:*" set 802-1x "nps-even" next end next endI have a Security Policy:config switch-controller security-policy 802-1X edit "nps-even" set security-mode 802.1X-mac-based set user-group "nps-radius"

Hi everyone, I’ve been fighting with this setup for the last two days and could really use some expert eyes.I’m trying to deploy a FortiGate IPsec VPN using SAML (Azure Entra ID) for FortiClient connections — to replace our old SSL VPN. The tunnel initiates fine, NAT-T is detected, and Phase 1 completes with a valid proposal.But after that, I only see this in the debug logs — no actual user name, just a FortiClient UID block:  ike V=root:0:FCT_SAML:6005: received FCT data len = 290, data = 'VER=1 FCTVER=7.4.3.1790 UID=[REDACTED_CLIENT_UID] IP=[REDACTED_PRIVATE_IP] MAC=[REDACTED_MAC_ADDRESSES] HOST=[REDACTED_HOSTNAME] USER=[REDACTED_CLIENT_UID] OSVER=Microsoft Windows 11 Enterprise Edition, 64-bit (build 26100) REG_STATUS=0 ' SAML itself is configured and reachable:  set entity-id "https://remote.exampledomain.pt:4448/remote/saml/metadata/" set single-sign-on-url "https://remote.exampledomain.pt:4448/remote/saml/login" set single-logout-url "https://re

We received this notification from our Fortinet support team regarding SSL VPN tunnel mode.is this referring to SSL VPN for users using forticlient SSLVPN or site-to-site IPSec VPN tunnel ?We are still using SSLVPN mode in our forticlient VPN.SSL VPN tunnel mode replaced with IPsec VPNStarting in FortiOS 7.6.3, the SSL VPN tunnel mode feature is replaced with IPsec VPN, which can be configured to use TCP port 443. SSL VPN tunnel mode is no longer available in the GUI and CLI. Settings will not be upgraded from previous versions. This applies to all FortiGate models.To ensure uninterrupted remote access, customers must migrate their SSL VPN tunnel mode configuration to IPsec VPN before upgrading to FortiOS 7.6.3 and later.See Migration from SSL VPN tunnel mode to IPsec VPN in the FortiOS 7.6 New Feature guide for detailed steps on migrating to IPsec VPN before upgrade.A complete migration guide can be found in the following links:For FortiOS&

Hello All,On our FortiGates under Global/Network/DNS we specify our own DNS Servers but they are almost always in red (high latency) or showing as unreachable.We are only using plain old DNS (udp/53).We have never been able to work out why (it happens on both our 600F and 100F) and what we need to do to fix it , I have no idea if there is some config somewhere that's missing etc etc.Hoping the experts out there can help ? Regards  

Hello everyone, I have the following problem. We currently still have a FortiAnalyzer 400E in use, but it is being replaced by a FortiAnalyzer VM instance based on Proxmox/KVM. We set up the FortiAnalyzer VM yesterday and connected it to our FortiGate as a second Fortianalyzer. So far, everything is working well and running smoothly. However, I noticed today that the FortiAnalyzer VM is reportedly receiving almost three times as many logs as the FortiAnalyzer 400E. According to the license information in the FortiAnalyzer 400E dashboard, it has received approximately 17.6 GB of logs so far today (see image below). We have only one VDOM, the second one is old and not used anymore. That is why the FortiAnalyzer VM has only one VDOM.  The FortiAnalyzer VM has received approximately 51 GB in the same period today, at least according to the dashboard (see image below).  Even on the FortiGate itself, you can see a huge increase in remote logs from around 25

Hi everyone, I’m setting up a SIP Trunk between my 3CX server (on a LAN) and my provider’s MSC, and I’m facing an issue where the 3CX sends its local IP instead of the public (NATed) WAN IP. The setup is as follows: 3CX (192.168.x.x) → FortiGate LAN (192.168.x.1) → FortiGate WAN (10.x.x.194) → POP ISP (10.x.x.193) → MSC ISP (172.x.x.5). The FortiGate performs outbound NAT, SIP ALG is disabled, and UDP 5060 plus RTP 9000–10999 are open and forwarded to 3CX. However, during outbound calls, 3CX logs the following message:Call from "numext"<sip:numext@IP_ISP;transport=udp;user=phone>;tag=xyz to "numcalled"<sip:numcalled@IP_WAN_FORTIGATE;transport=udp;user=phone> has been dropped as it was not acknowledged in time. Please verify configuration and ensure there are no connectivity issues. Packet capture on the FortiGate shows that traffic to/from the ISP (port 5060) passes correctly, but SIP packets remain fragmented, and the Contact: / Via: headers still contain th

Hello,I've run into a strange issue with a remote access IPsec VPN on my FortiGateMy Setup:I used the IPsec VPN Wizard and selected the "FortiClient" template (the one that says it's for Windows, Mac OS, and Android).The tunnel uses IKEv2, a Pre-shared Key.My goal is a split-tunnel (only local traffic goes through the VPN).My Configuration:IPv4 split tunnel is ENABLED in the tunnel settings, and it points to an address group containing my two local subnets.The Phase 2 selector is the default one created by the wizard:I have two firewall policies to allow VPN traffic to my two local networks (one with NAT OFF, one with NAT ON, as my network requires).The Problem:Windows (FortiClient VPN app): Works PERFECTLY. It connects, gets an IP, and the split-tunnel works as expected. I can access local resources.Android (FortiClient VPN app): Fails every time. I use the exact same server IP, PSK, and user credentials. It tries to connect and then fails with the error: "Error: Protocol timeout reac

HelloI am using FortiClient VPN on Android Motorola phone. FortiClient version: 7.4.2.0179Phone: Motorola Moto g Power 5GAndroid Version: 15  I get the following error when trying to connect "FAILURE! Sorry, could not start connection "xxx". Error: Revoked by Android: REBOOT!  The wierd thing is I can connect to FortiClient when I am on Wifi but I cannot connect using mobile data.  

Hi folks, is there any way to re-send the activation email via FortiManager? The customer says it happens very often that this email is not received when a new user is added. When I tested it, email sending from FortiGate (version 7.4.8) worked fine. Platform Type : FMG-VM64Version : v7.4.7-build2685 250527 (GA.M) I know how to re-send the activation email from FortiGate and I also know how to find the activation code in the logs on FortiGate. I'm only asking if there is a way on FMG for this one customer. Many thanks in advance! FortiManager FortiToken