Fortinet Community

We have two pairs of 91G's running 7.4.6 at two different locations. Each has a DMZ with subnet 192.168.100.0/29, and each location has a route map that allows redistribution of connected routes into OSPF. Site A is preferred and has route redistribution with a better metric. This works fine, but the problem is if the server at Site A goes down, but default the associated FortiGate doesn't know that server is down (the switch port is still up) and continues to advertise the connected route. Is there a way to configure SLA to query the server at 192.168.100.2, and if that server is not reachable, then the FortiGate removes 192.168.100.2/29 from the OSPF process until the server is once again available?

Review the following configuration configwaf machine-learning-policy edit1 set sample-limit-by-ip 0 next end What is the expected result of this configuration setting? A) When machine learning (ML) is in its collectting phase, FortiWeb will accept an unlimited number of samples from the same source ip address B) When machine learning (ML) is in its collecting phase, Fortiweb will not accept any samples from any source ip addresses  

Hi,in the documentation of the FortiGate Rugged60F it says, that port internal4 and wan1 form a bypass pair.As I understand by reading documentation (https://docs.fortinet.com/document/fortigate/7.4.7/hardware-acceleration/754739) this results in forming a hardwired connectivity between these ports in the case of a power failure / power-off.This might result in a security issue, if using those two interfaces in different network segements / vlans, if I understand this description correctly.I also couldnt find any documentation on how to disable this feature - only for different FortiGate models. And those either say its possible to disable via CLI (80/81), but a different model describes it cant be disabled and is the default configuration (Rugged 90D):https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-poweroff-bypass-and-bypass-watchdog-on/ta-p/195677https://community.fortinet.com/t5/FortiGate/Technical-Tip-Bypass-Ports-on-FortiGate-Rugged-90D/ta-p/194412Could you hel

Hi everyone,I’ve encountered a confusing situation when creating IPSec tunnels on FortiGate (version 7.4.8). If I create a loopback interface and then try to create a tunnel interface with the same name (e.g., “TUN-1”), I get a duplicate object or conflict error, which makes sense.But, if I use the tunnel creation wizard and select “Create” in the interface selector, it sometimes allows me to create a loopback interface and a tunnel-interface with the same name in a single step. I think this might be a validation issue or a bug. According to Fortinet docs and best practices, each interface must have a unique name.Is this a known issue with the wizard?Could future firmware updates break these configurations with duplicate names?

I want to send an email when an interface goes down on the Fortigate firewall or when an IPsec tunnel goes down. I couldn't find any articles mentioning a trigger that would send an email for a specific interface or a specific IPsec tunnel. I have a specific interface I want to set up. How can I configure this?

Hi everyone  I have two firewalls 201G model version 7.4.6, when i configure vdom partitioning with separate two cluster root and rnd. Root is primary in cluster 1 and rnd is primary in cluster 2, but rnd didn't work. I show HA configured, which is no problem; status and role are correct. When i connect the wan port to rnd primay (cluster 2), the port status is down and pppoe is not up, but when i connect the same port on cluster 1, it's up, but pppoe status is installing. Does anybody meet that case, and how can i fix that Thanks for your help

Hello, I need your help.I have a Fortigate 100F running firmware 7.4.7, and I have configured GRE over IPsec tunnels.My networks are routed using static routes.The problem is that when one tunnel goes down, the traffic still continues to flow through the main tunnel, so failover to the second tunnel does not occur.Is there a way to configure something like a link monitor or any other mechanism so that when Tunnel1 goes down, it automatically switches to Tunnel2

We have forti cloud EMS version 7.4.3 , invitation code (no expiration set) set to single user does not work, when user is entering invitation code in forticlient-7.4.3 version ( tried both manually and copy paste), it does not give any error it's just show processing tab and nothing moves further. Tried to entered invitation code via CMD also but no luck. Please help here

Hi there, Is there any way to configure information disclosure as alert and deny .I am getting forgery request request in this scenario my server is requesting for internal urls in it behave , fortiweb is blocking it already in standard inline protection profile but not blocking low severity alerts and sessions are very high. Please help 

Hi! I have an issue that has been bugging me for quite a while. I have a FortiSwitch where all the ports appear as offline in my FortiGate GUI, but the ports are active and, for the most part, functioning properly. I assumed this was a silly GUI visual glitch until recently, when I tried to add a FortiAP. However, it does not register when plugged into the switch, but it does register when plugged into the firewall or another switch. I have tried reboots and performed a factory reset on the switch, which provided some relief. The switch now lists the devices connected to the ports, but all the ports still show as offline. The ports appear to show activity when viewed on the console. This issue appeared one day after no known changes, such as updates or configuration changes.  Here is some information about the devices.Fortigate 60F Version: v7.2.11 build1740FortiSwitch Version: S124FN-v7.6.1-build1047FortiLink manages switch. I have other switches connected and

Hi All, I have configured IPsec over SDWAN with redundant links (S2S Ipsec tunnel) to connect multiple branches and monitor with SDWAN. But the problem is when I configure OSPF on tunnel interface then only single neighborship come up and another neighbor is not showing. And when I configure static route then it works for both redundant interface. I troubleshooted multiple times but did not resolve the issue. Is there anyone who has faced the issue while configuring OSPF on tunnel interface with IPsec over sdwan. Thank you  

Hello guys, please who can support/assist me in resolving my lab issues. I have been troubleshooting since day before yesterday with no resolution. I have my windows 10 vm and fortigate 7.6.3 vm on the vmware station I am pretty much sure i have the ip configurations correctly The windows 10 vm is on custom- host only fortiagate vmnet 2 is also on custom - host only The vmnet2 on the virtual network editor is also on vmnet 2 with 10.10.10.0/24 network My port 2 on fortigate is 10.10.10.1 /24my NIC on windows 10 is 10.10.10.2 /gateway - 10.10.10.1Physical host - 10.10.10.75 /gateway 10.10.10.1I made sure both fortigate vm and windows 10 vm are on the same vmnet2 However i do not know why i cannot reach fortigate  I just realised that if i change the connection from custom - host only to bridged it works and i can reach the fortigate  the custom - host only wouldnt   and i am concerned that not having lan network

HelloIm troubleshooting an issue where after forticlient v7.2.7 is installed via an msi file and a mst, the application installs but is in an unlicensed stateThe msi/mst file is downloaded directly from the customers site in the EMS PortalWhats interesting is the VPN Config is bieng pulled down from the profile.There is enough licenses available so its not thatDoes anyone know what else I could check here?Thanks

Dear team, Has anyone else observed this issue? When we create a contractor user with a corporate email address and no one logs in with that user, after a while, it causes the existing user VLAN to change to isolation. When I check that user and click Show Hosts, I can see another host belonging to the same user with the contractor email address. The strange thing is that when I check that host, I can see that the logged-on user is the contractor user, even though we did not log in. Somehow, I guess the passive agent finds that device user, checks the email address, and matches it with the contractor user. Is this normal behavior? It's not happening instantly; it takes some time to detect the other host and link it with the contractor user. My goal is to create a contractor user, assign them to the onboarding VLAN, and install new computers. That's why the help desk team creates users with corporate email addresses and keeps them for a month. Do you have any suggest

Hi! I recently updated the firmware of a FortiGate 200F from version 7.2.11 to 7.4.9 and the HA did not finish synchronizing.There are 2 tables out of sync: system.central-managementfirewall.internet-service-nameAny ideas to solve it?  

Hello, I wanted to install FortiClient EMS HA with Bitna mi Docker architecture with FortiClient EMS 7.4.4 image. For this, I used the official Postgres and FortiClient latest version packages. However, despite several attempts, EMS does not start with HA. I used the official documentation during the installation. Thanks in advance for your support. he gets nodesEMS Node(s):Name | Role | Status | Last Seen--------------------------------------------------+---------+---------+----------------------------ems-1 (*) | primary | online | 2025-10-18 18:14:07.562784DB Node(s):Host | Port | Role | Status | Latency (MS).. .. .. .. | | standby | offline | 40.. .. .. .. | 5432 | standby | offline | 41 

We have a vendor who has 2 servers with 2 NICs configured with teaming. Port 1 of each server is directly plugged into port 2 of each FortiGate (also belongs to vendors, and these are 60E's running 7.0.x). We've been testing failover, and it's been problematic. At least one server, sometimes both, will be unreachable when we test failover. We can disconnect the cables to the standby FortiGate, and the servers are instantly reachable. Even after the server is reachable, as soon as we plug the cable back into the FortiGate, the server is sometimes unreachable. We've not had any experience with this before, but then all FortiGates we manage have ports plugged into switches. Are there any ideas as to what we can try? Thanks

Hi Guys. I have starved my own knowledge and googlefu so i hope someone in here can help me.We are transitioning from SSLVPN to IPSEC VPN and want to keep using our SAML setup. When trying to connect to the IPSEC VPN tunnel i get prompted with my SAML prompt, enter my credentials, log in and the client then hangs in "Connecting".In my debug i see the SAML request being processed and completes as it should but i see no IKE debug prompts.Nothing appears in my VPN log either. The only thing i can see is in my Forticlient, where i get an error regarding power which i reckon is not related to this. When connecting to the SSLVPN (same public IP, different ports ofc.) i go straight through and connect with no issues. Does anyone have any idea why i am stuck in "Connected" when my SAML request is processed?Kind RegardsEDIT:We have tested with Forticlient versions 7.2.4, 7.2.5 and 7.4.0 and with different vendors of net adapters and from different locations.

Good day,I am new to FortiGate and having some trouble to setup the SSL portal. First I used FW 6.2.7 setting up the SSL portal with  http://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/584456/configuring-saml-sso-login-for-ssl-vpn-web-mode-with-azure-ad-acting-as-saml-idp. This works perfect but I had some trouble to open external URLs from the SSL portal.I opened a ticket and support confirmed there is bug in FW 6.2.7 and I can go to FW 6.4.5. Ok so I updated to FW 6.4.5. But now SSL Portal is not working anymore. I get a <ERR_EMPTY_RESPONSE> from my browser. I tried to debug the login with <diagnose debug application sslvpn -1> and saw this error: 262:root:6]rmt_web_auth_info_parser_common:460 no session id in auth info [262:root:6]rmt_web_get_access_cache:797 invalid cache, ret=4103But I don't what it means and how I should proceed. Has anyone had a error like this before and can give me some advice. Many thanks,MaDe 

Hi, I would like to know the steps to configure ZTNA with 3party vendor for MFA. Is that supported? Or is it mandatory to be with FortiAuthenticator only? Pls any guidness

Hi everyone,We’ve set up a captive portal for employees to connect their personal devices to our Wi-Fi using Microsoft 365 SAML SSO authentication.When connecting from an iPhone, the captive portal opens correctly and redirects to the Microsoft login page. After signing in, users receive the MFA prompt to enter their code. However, when they switch to the Microsoft Authenticator app on the same phone to validate the MFA and then return to the Wi-Fi login screen, the captive portal closes automatically.It seems that if you swipe up or switch to another app, the captive portal session ends, forcing users to start the process again. This creates an endless loop. Users authenticate successfully, but the portal resets before completing the connection.Has anyone encountered this issue or found a workaround to keep the captive portal session active duringMFA on iPhones? Thanks in advance!

I have Let's Encrypt on my Ubuntu Web Server.   It generates a certificate with the firewall certificate: DNS Name: firewall.scsiraidguru.com DNS Name: learningwp.scsiraidguru.com DNS Name: mc.scsiraidguru.com DNS Name: patrickmckenneylandscaping.com DNS Name: scsiraidguru.com DNS Name: www.patrickmckenneylandscaping.com DNS Name: www.scsiraidguru.com  every 60-90 days.  I setup SCP account and rsa-ID on the Web Server and Fortinet 61F.   I setup a test backup file.   It can get a backup from the FortiOS and copy it back to the Web Server.   I want to automate the certificate import from the Web Server to FortiOS.   I setup a copy.sh file that will compare the new certificate to the copy in my home cert directory.  When it changes, it copies the new pem files into my home cert directory.  It then creates a pfx file in the home cert directory.   I want to get the FortiOS to import the new certifica

I installed Windows 11 Enterprise on my computer (AMD Ryzen 7 7730U). I downloaded the latest version of the Forticlient-only VPN application and am running it as an administrator. My firewall is off. There shouldn't be anything blocking the application, so I'm sharing the error message with you. By the way, I can't open any files in the downloaded folder. I can only see text documents and logs. Could you please help?  [2025-10-18 09:20:27.4672990 UTC+03:00] [1520:7188] [sslvpndaemon 541 debug] CListener::Initialize() A pipe client connected.[2025-10-18 09:20:27.4770572 UTC+03:00] [1520:7188] [sslvpndaemon 501 debug] beforeConnectNamedPipe[2025-10-18 09:20:27.4772196 UTC+03:00] [1520:1792] [sslvpndaemon 740 debug] Thread CListener::SReceiveMessage() created. pipe handle: 0x0000000000000610[2025-10-18 09:20:27.4772406 UTC+03:00] [1520:1792] [sslvpndaemon 587 info] CListener::_ReceiveMessage() PID of pipe client: 16700[2025-10-18 09:20:28.5952594 UTC+03:00] [1520:1792] [sslvpnd

im not able to use

Hi everyone,I am searching for a way to use MFA with TOTP without paying for FortiToken.  Our internal users get authenticated via SAML and MFA from Microsoft Cloud. But we do have some external accounts which can't be linked to SAML but need VPN.  Is there any other way to set up MFA with a TOTP App without using FortiToken?