Fortinet Community

I’m trying to create a policy to block IPs from the EmergingThreats list using an External Connector feed, but it doesn’t seem to be working as expected.I have an External Connector > IP Address External Feed configured, and it shows approximately 1500 valid entries.Connection Status 2025/10/28 08:31:32Last Content Update 2025/10/27 16:31:24Entries 1490  Valid  I can view the entries, and if I manually test one of the IPs by browsing to it, the connection succeeds, it’s not being blocked. If I add a single IP address directly to this rule, it does block that address correctly. However, when I rely on the external feed, it does not block any of the listed IPs. I’ve also tested with other external IP lists, and I’m seeing the same issue.Is there something wrong with my configuration, or should I be implementing IP blocking in a different way?Here’s the policy configuration I’m using:config system external-resourceedit "Emergingthreats-block-IPs.net"set uuid 05a9ff8e-cf9

Hi I have an issue with change SSL to IPSec configuration.I follow instruction to build FortiClient Dial UP connection.https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Dialup-IPsec-VPN-Split-Tunneling/ta-p/192207I have an issue with split tunnel, on windows enviroment doesn't appear single routes that assign via split tunnel but only default router. From android trablet it seams work. I am created n°2 policy,1st Dial Up Tunnel -> Local LAN                                       OK2nd Dial Up Tunnel -> to other IPSec tunnel                  KO 2nd policy doesn't work, in diag I see the packet sent but i can't receive answer What can i test? 

 Since the upgrade from 7.0 to 7.4 our FortiGate 100f No Longer Sends Traffic Reports to FortiAnalyser Cloud. It uploads Event Logs and VPN Logs and that's about it.   Is there anyway of switching this on? I can't find any logging options specifically.  Any help appreciated :) 

Hello team!!! We have a Fortigate 100F with many IPsec VPNs for FortiClientI configured all IPsec VPNs with IKE v1 and allways used an AD group synchronized in the Fortigate for user authenticationAlso, I use the peer ID field to select an specific VPNAll these VPNs are workingNow I created an IPsec VPN with IKE v2, but when I try to connect, I get an error:In FortiClient: Wrong Credentials EAP failed connecting to VPNnameIn Fortigate: date=2025-07-23 time=16:06:15 eventtime=1753297576267021760 tz="-0300" logid="0101037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.3.5.7 locip=1.2.3.4 remport=4500 locport=4500 outintf="port9" srccountry="Argentina" cookies="b51c1f1809859ab8/7f365d0b1f864add" user="1000" group="N/A" useralt="N/A" eapuser="testdomain" eapauthgroup="N/A" assignip=N/A vpntunnel="IPsec-dom-W3" status="failure" result="N/A" peer_notif="NOT-APPLICABLE" fctuid="E2D4BA7

i have a few Fortigate firewall running on 7.2.xx version.Planning to upgrade to 7.4.8.do i need to upgrade all at the same time or i can just upgrade the main FGT at our data centre and the rest at our site office at a later date ?all are connected using ipsec tunnels

We have some clients using the Forticlient VPN who get looping at 98%. Others are connecting with no issues.The login is set up to use SAML from EntraID. They successfully log in and this can be seen in the EntraID logs. The connection process gets to 98% and the user is prompted to log in again. I have tried this on a failing device with both the latest 7.4 version and with an old 7.0.8 version and get the same result. The FortiGate the VPN connects to is running 7.4.9.Checking the logs on the FortiGate, there is no indication that the user attempted to connect. Checking the event viewer on the failing client there are no errors listed refering to the FortiClient or for the time the login was attempted.The clients are all Windows 11.I did find one article about setting the global ssl_vpn_webmode to enabled but this was already set when I checked.

Hi,I have ipv4 policy rule to allow traffic to bitdefender servers like:*.bitdefender.com*.bitdefender.netwith both ports 80 and 443 TCP.But when I go to transfer logs, I see that traffic is still blocked: 185.225.250.26 (update-onprem.2d585.cdn.bitdefender.net)443 Akamai-CDN Deny and many other subdomains of .bitdefender.net with application name Akamai-CDN.Why this traffic is blocked as I allowed every (wildcard) subdomains for this traffic? 

For the past few days, our new Windows 11 25h2 PCs, fresh from our master image, have stopped connecting to the VPN with Fortclient 7.4.0.1658. The icon no longer appears in the system tray either. Any idea ?

A helpdesk endpoints admin accidentally marked all endpoints uninstalled. What is the best way to get them registered and connected again for all of the clients that have forticlient installed.

Hi everyone! I do have HQ, and 10 more branches. Each branch has direct internet. So I need to do a deep inspection at each site. I was using the normal way. Generate a CSR from each Firewall. Sign it by my Local CA as a subordinate. Then import it to my FortiGate. Then use this new cert in my SSL policy. But I have read a document from Fortinet showing a better way to create on my Local CA: Create a Microsoft sub CA certificate https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/680736/microsoft-ca-deep-packet-inspection Still, I'm confused. What's the different, and better way? Just generate one cert as mentioned. Or do CSR from each FW to let FW information appear to users when there is an SSL error? Kindly advise and let me know the best and different. Note. I do have Local CA and FortiManager to manage all my 10 FortiGates.

Hi All, I'm looking at a configuration where I have 2 standalone Fortigates (not configured as HA pair) and a fortiswitch which has FortiAPs connected. Is it possible to configure Fortilink from each Fortigate to the switch to allow the switch to be managed from both fortigates with one Fortilink having higher priority over the other or is it the case of using VRRP between the Fortigates and Fortiswitch? Regards Adrian

Hello, i have a working VPN Device Tunnel (named FG-VPN-Device) for my Windows 11 Clients. These clients can connect on a certificate based authentication with the fortigate firewall.The Tunnel is configured with Mode Config enabled and a the IP is assigned with a Client IP Range (10.58.58.50-10.58.58.99). But i can´t route any traffic over SD-WAN with this config, as the IP Range has no gateway.After some more reading, i think, that i need to set a IP and DHCP Server for this Interface (named FG-VPN-Device). I followed this article  DHCP IP address reservation with Dial up ... - Fortinet Community But after settings these options, the Windows 11 Client can´t connect anymore.There is no DHPC assignment to the client. any idea what is missing?

Hi all, I've been using Forticlient VPN for a while on my M1 MacOS and it worked perfectly. Suddenly, when I try to connec through VPN it always come the same error: "Network error. The request timed out."I've tried with firewall off and different networks and still it doesn´t work. I also have total access to disk and network extensions on for Forticlient. Do you know what could be? Thanks!! 

Hi, Users connect to M365 services using a redirection authentication to the FAC (version 6.6.2).The config is working fine on Microsoft and iOS but not on Android devices.For example, if i add an account to the teams application on the phone, i insert the username and after that i receive got a blank page and not the fac page. All suggesition will be appreciated :) Regards,Simon  

Trying to set-up Agentless Portal access as per  https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Agentless-ZTNA-with-FortiGate-v7/ta-p/373718#M11651 I have it all configured but when I try to access the web portal I get the following error. Any suggestions?

I just ran into this: I have an Adom in FMG. In this is a FGT100F I want to use for lab purposes. It was reseted to factory default before adding it to FMG. It added successfully and I can configure it in FMG. I was able to deploy device configuration to it successfully.I then created a provisioning system template that assigns system dns, ntp etc. The template also does the interface config (creating vlan interfaces and afterwards configuring them). For the interface configuration one variable out of the policy package is used.Once I assign that FGT100F to that template and try to deploy device config only it fails. There is no installation log available and the progress log only says "[fw-teststandort1[copy] root] Copy global shared objects failed (adom:my_Adom, dev:fw-teststandort1) (reason:none)". It does not provide any further information. Also dia deb app securityconsole 255 does not provide any more information. Does anyone have a hint on how to further debug this to

hello guys, i have this part of script where I try to get all logs from fortianalyzer to save in text file When i run script, i just get the first 100 logs and any other logs can get it  Knowing that when I changed the offset value to 500, it returned 100 logs different from the first 100. This means that when we change the offset value manually, it works, but when I do this in the script, it only takes 100 logs.Note that when I do a debug in the Forti Analyzer, it actually shows what is happening in the script and returns only the first 100 logs, but any other request does not return a log. # ----------------------- # Step 4: Retrieve logs using pagination with limit = 100 # ----------------------- all_logs = [] offset = 0 limit = 100 # Use 100 logs per page max_attempts = 3 # Maximum attempts to retry fetching logs print("\nRetrieving logs in pages...") while offset < total_logs: logs_payload = { "id": "123456789", "jsonrpc": "2.0", "m

Hi, I have new deployment project for ZNTA. We have a Local CA. we have generated a CSR from FortiGate and signed it by a local CA to be imported in FortiGate. and for EMS I would like to know what should do for the certificate, as there is no CSR option. Should I only import local CA Root Certificate to EMS server? Kindly need help to understand the certificate required for EMS within local CA and FortiGate.

Hello Forum, im trying to setup FortiLink in this setup: Fortigate <-> Cisco Switch <-> FortiSwitch I get the FortiSwitch up and running, connecting through the Cisco Switch with native VLAN set to the FortiSwitch VLAN.The Switch is fully manageable through the FortiGate -- Great Success!! But i facing the issue if Im connecting a second interface to the FortiSwitch and Cisco Switch. I wanted to setup this connection for redundancy so the topology would look like this: If im connecting the second Port of the Portchannel to the FortiSwitch, the link is starting flapping on the cisco site.. Is there maybe a problem with spanningtree oder port-profiles on the FortiSite? Does anybody of you had this problem earlier?We have to deploy this enviroment, because we cant change our distribution switch right now. Thank you!

Good afternoon,according to SSL certificate shortening, is there possible to NFR customizing ACME provider (GEANT CA), not only Letsencrypt ? In this time I found that customizing ACME provider in not possible, right ?FortiWeb ? FortiGate ?Thanks and best regardsJ.Karliak

HelloA question for Fortinet.There is already machine learning on FWB and FSM for anomaly detection.Any idea when it will be implemented on FML? I believe is crucial for intelligent filtering.

Hi community, I am currently using the Let's Encrypt feature on my FGT (FOS 7.0.4).Everything is working really good.I just had the idea to use the FGT as a "certificate hub". So the external FQDN of my NAS points to the FGT WAN IP. This way the FGT can issue a certificate for the external FQDN for my NAS.Now I am looking into a way to export the issued Let's Encrypt certificate (cert file, key file and passphrase). Found out that the cert file and key file are stored at the FGT and can be exported over the CLI. Sadly, the passphrase is "only" saved encrypted on the CLI (because of security reasons).To import the Let's Encrypt certificate to my NAS, I need the passphrase unencrypted. Any ideas how I could get the encrypted passphrase on the CLI into an unencrypted form? Looking forward for your ideas. Many thanks.Kind regardsDominik FortiGate

Hello, for several days, a bot has been trying to connect to my Fortigate 60F.How can I block these attempts ? Thanks !

Hi FortiClient admins What is FortiClient Server?  https://repo.fortinet.com/forticlient_server_readme.txt Anyone knows?

Hi, this FG60F with 7.4.5 (before 7.4.4 and same problems) has lots of problems with SD WAN. Today I was there to ceck internet access and SD Wan config but I cant solve the problem. The SD WAN is strange, like at least 2-3 times a week and than for some hours one of the WANs has 30-80% package loss. Also than navigating behind the FG you notice the problem when you are using WAN x at this moment. At the same time that the FG showed 70% package loss, I connected my laptop behind the router and checking with pings and internet speed test the line for >20min and NO problem at all. Again connecting to the FG I get package loss. I changed even the cable to be sure. The SD Wan config is simple, one implicit rule sessions 50-50 and Performance SLA to ping Cloudflare 1.1.1.1 and 5-5-10-500-5-5 all activated. What can be the reason of these package loss showing in the FG? Also I have fortiddns over WAN1 and when it shows package loss, I have problems connecting from