Fortinet Community

Hey all.  Between my Fortigate 800C and FortiAnalyzer my logs are being smashed by DHCP Ack. I'm using the interface on the FW  as a DHCP server for a large free public wifi network.  I didn't want to relay and bog down any corporate DHCP, but I also really don't care about logging the DHCP ack.  Maybe an alert if the scope is full - but thats it.  How do I turn this off?    

Hello,I would like to configure an SSL VPN connection on my iPhone on iOS, the problem occurred when adding the certificate, I cannot select it, I do not see such an option, please help.  filename -> no added yet

Hello I want to use DuckDNS as DDNS on Fortigate. How do I do it? Initially the line to use is (example, obviously fake): https://www.duckdns.org/update?domains=mydomainname&token=h123030a-a62b-e6d8-pTZ0-2FT2453foqwe&ip= There is no user name or password or anything else How do I set this up in Fortigate? Thanks 

Hello, I've been experiencing issues with SNMP for a few days now. The branch offices have Fortigate firewalls and Fortiswitches. The logs constantly show that the switches are losing and regaining the connection. When I check, everything seems fine. My second issue is that when a user connects their computer to any port, the port lights up green, but the computer doesn't appear. After doing a few pools, the issue resolves itself.   

Hello Team, I have two FortiGate 2600F FGCP clusters (active/standby) with FGSP enabled between them for a specific VDOM. I would like to verify whether FGSP sessions are synchronized and see which ones are. The following CLI commands appear to report FGCP session information only:diagnose sys session syncdiagnose sys session list  How can I retrieve session information for FGSP specifically? Thanks in advance for the supportBest Regards 

Dear Team, We are facing the issue with retrieve the configuration from fortigate firewall to fortimanager. 1. Run the script from fortimanager to direct managed firewall. (Once the script run whatever the configuration ran in the firewall should reflect in fortimanager, but here manual retrieve is required to reflect, Auto retrieval not working.2. The script contains, Create vlan, assign the vlan to zone, create dhcp using vlan...etc. 3. When we check the configuration after the script in fortimanager, its showing as invalid. After manual retrieval only the configuration is visible. Is there any command available in fortimanager to view via CLI why auto retrieve not working. There is a command in fortigate diagnose debug cli8 ---> diagnose debug enable.Like this any command available please share with us. Note: Fortimanager and fortigate fir  Thanks, Sivanathan T

I would like to request a guide for configuring the Persistent Agent and Passive Agent. I’ve already tried following the official Fortinet guide, but it doesn’t seem to work, and I’m not sure why.In my experiment, I was unable to deploy the agent through Active Directory, so I tried manually installing it on the AD user PCs instead. When the users are connected via a wired network, FortiNAC can detect the agent on the endpoints, but when they connect wirelessly, the agent is not detected.Could you please help me with this issue by providing the appropriate configuration guide or documentation?

HiI have two questions. 1. Is there a way to set admin-lockout-duration to 100000 and let another administrator unlock it when the account is locked? 2. Is the criteria by which the account is locked not the account name but IP based? Thank you

Hello All, I am configurating a basic home lab using GNS3 for my FortiNet SD-WAN practices as below : FMG > v7.0.11 > Permananet trial license > allocated 4vcpu + 4096MB memory3 no of FGT as HQ, remote DC & Branch > each 7.0.5 with 15 days trial license. > allocated 1vcpu+1024MB memory to each FGT.  My Base system is running with intel i5-6500, 4vCPU & 12GB of memory. I have successfully configured the topology & registered all the three FGTs in my FortiManager. at the begining I can see the status for all the devices under "Manager devices" shows "in sync". However, whenever i try to push any policy, the installation gets failed with error "install and save finished status=FAILED". I tried multiple times referring different references available on Fortinet KB as well as internet; but ended up at the same error. Even i have done factory reset & configured all the devices yet no success with same error.  Appreciate any he

Dear Experts, I want to know the theoretical overhead of  bandwidth when IPsec aggregation is used at SD-WAN.For example, pure WAN1: 5Mbps, pure WAN2: 3Mbps and pure WAN3: 2Mbps.Total is 10Mbps. All WANs is IPsec-aggregated as SD-WAN.   PC1 -- FG1(IPsec Aggregated SD-WAN) -- (network) -- FG2(IPsec Aggregated SD-WAN) -- PC2 We tried a little. 8-8.5Mbps between PC1 and PC2. I do not judge if it is reasonable. Any comments are appreciated.  

Hi,I have a customer who currently uses two WAN connections: a primary one (Swisscom) and a secondary one (Horizon).Some services are also exposed only on the primary WAN.They asked if it’s possible to combine the two connections so that, in case the primary wan becomes saturated, part of the new traffic is automatically redirected to the secondary wan.Additionally, they would like to expose services simultaneously on both WANs.From what I understand, the only way to address the first issue is to configure an SD-WAN, adding both WANs to the Virtual Link Zone, including this zone in all policies and static routes, and then creating an SLA monitor.As for the second point, how could that be handled?Would it be feasible to create a virtual VIP address?Thanks,Cheers

Dears  I need Memory size for this Products : FGT-60F FGT-50GFGT-70G 

BodyHi everyone,GoalI want my FortiGate 60F to continuously ping a specific host, for example 172.16.23.254. If it stops replying, I need FortiGate to trigger a webhook that will notify a Telegram group. The Telegram webhook side is already working, so I only need help with the FortiGate trigger.EnvironmentModel: FortiGate 60FFortiOS: 7.4.8Target to monitor: 172.16.23.254The target is on LAN, reachable via interface: internal4What I have workingA webhook action that successfully sends a message to my Telegram bot when manually tested.What I am trying to achieve on FortiGateSet up a reliable ICMP probe to 172.16.23.254Generate a log event when the host is considered down, and again when it recoversUse an Automation Stitch to catch that event and call the webhookQuestionsWhat is the best practice approach for my case?Desired outcomeWhen 172.16.23.254 fails ICMP for N consecutive probes, FortiGate sends a webhook to Telegram with a short message that includes the host, status, and time.Wh

FortiClient VPN on Windows ARM64 – app crashes when opening “Configure VPN” (JavaScript error in Electron process)Message:Hello,I’m encountering a crash issue with FortiClient VPN-only 7.4.3 (ARM64) on Windows 11 ARM64. The application installs and launches properly, but crashes immediately after clicking on “Configure VPN”.Installation note:The official installer (FortiClientVPNInstaller_arm64.exe) is an online stub (~5 MB) which does not accept standard command-line switches such as /log, /extract, or /quiet.To proceed, I monitored the temporary folder during installation and manually extracted the .msi file from the AppData path.After that, I either ran the MSI directly using msiexec /i or allowed the original EXE to complete. The installation finished successfully.The application now launches correctly in VPN-only mode.Current issue:When I click on "Configure VPN", the application immediately crashes.There is no visible error message in the GUI.No relevant logs appear in Event View

Hello All, Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates. But in test via openssl s_client -connect mysite:443 -servername mysite -showcerts I'll see error "Verify return code: 21 (unable to verify the first certificate)"What's wrong, what I missed?

As you have noticed, serverless computing has revolutionized how applications are built and deployed. AWS Lambda, one of the most widely adopted serverless platforms, enables developers to run code without provisioning or managing servers. It offers scalability, cost-efficiency, and rapid development cycles, but with these benefits come with new security challenges. Unlike traditional applications, Lambda functions are ephemeral, event-driven, and often exposed via APIs or integrated into complex microservices architectures. This makes them attractive targets for attackers seeking to exploit misconfigurations, insecure endpoints, or vulnerable third-party dependencies. As organizations increasingly rely on Lambda for critical workloads, ensuring robust security becomes not just a best practice but a necessity. This is where Fortinet’s security solutions, specifically FortiGate and FortiWeb, come into play. FortiGate, a next-generation firewall, provides deep packet inspection, threat i

I can't believe that I have to buy an entire product (Fortiauthentior) that duplicates 95% of what I already have just so I can do user authentication on a Forti firewall for machine that are not Hybrid enrolled. Absolute joke forcing customers to buy more product.

I have deployed FortiManager-VM in an air-gapped environment and enabled communication with FortiGuard via a proxy server.Recently, I purchased and registered an add-on license to increase the maximum number of devices that can be managed by FortiManager-VM. The additional device license is successfully registered and visible in the Fortinet Support portal, but the actual FortiManager appliance does not reflect the increased device capacity—the newly added device licenses are not syncing.The original base license for 10 devices continues to work and receives updates from FortiGuard, but only the original 10 devices are recognized. The appliances do not recognize the add-on licenses for additional device management.In this proxy-enabled, isolated environment, do I need to manually upload the license (.lic) file to FortiManager to activate the added device capacity? Is there a recommended procedure for applying an add-on license to increase the number of manageable devices when automatic

Hey everyone,I really need a bit of guidance. I’m working on the FortiOS 7.6 Administrator Self‑Paced course right now because I’m planning to take the NSE 4 FortiGate Administrator exam and get my FCP – Secure Networking certification.But I just saw a notice that says this 7.6 course and its exam will be retired on December 31 2025, and there’s a new FortiOS 7.8 Administrator course coming out on October 15 2025.Now I’m confused — should I finish the 7.6 course and take the exam before it retires, or stop and wait for the 7.8 version instead?If I pass the 7.6 exam, will it still count toward the FCP – Secure Networking certification after the new version comes out?My plan is::keycap_1: Finish NSE 4 (FortiGate Administrator).:keycap_2: Then do one NSE 5 (likely FortiManager Admin) so I can complete the full FCP – Secure Networking.Can someone please confirm the best path to follow?Thanks in advance for helping me sort out the

We have several Fortigate units (30XE and 20XF) that were upgraded from version 7.2.X to 7.6.4. After the upgrade, we noticed some strange traffic behavior. We have defined a custom management IP and restricted it from accessing the Internet(Deny). However, after the upgrade(7.2.X>7.6.4), we observed some forward traffic where the source is the management IP and the destination is FortiGuard (which is abnormal). At the same time, in the local traffic, we can see that the FortiGate’s WAN IP is also connecting to FortiGuard, and that traffic is allowed — which is expected (normal service) My question is: since this unexpected forward traffic started appearing after the upgrade, could this be a bug in version 7.6.4? All of our customer’s FortiGate devices that were upgraded (around six units) are experiencing the same behavior.  

Hi FGT adminsToday I saw 2 FortiGate physical appliances, with FortiOS 7.2.10, having a strange admin that I've never seen before on any other FGT.On first FGT:On other FGT: What is this account user for? Or should this be removed?

I have installed the latest forticlient package on my debian machine and configured it to connect to our vpn.After providing my (correct) password, the status is changed to 'Connecting', a 'disconnect' button appears, but nothing happens. The status remains connecting for hours. In the terminal, this appears: ```14:23:28.412 › IPC_RENDERER_REQUEST.LOADED14:23:28.413 › WindowManager handleWindowLoaded14:23:28.914 › WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient"]14:23:28.914 › WindowManager handleCreateMainWindow14:23:29.502 › Receive websocket type=FCT_UPDATE_TASK_DONE14:23:32.949 › Receive websocket type=FCT_UPDATE_TASK_DONEError occurred in handler for 'keytar.deletePassword': [Error: Unknown or unsupported transport “disabled” for address “disabled:”]``` Although I can find other posts about this, I could not find a solution. Any ideas?Thanks in advance, Ruud

Hi Folks,I’m new to Fortinet and the community and I’m reaching out for guidance please.I work for a Gov funded educational org and have been tasked with implementing a SDWAN PoC for Internet access at our remote sites.SETUP –Each site is equipped with a DIA ISP link and we will have access to a Gov provided WAN link that uses a client-side webscript proxy for Internet services.I’ve used the instructions from this Youtube video to plan and configure how the SDWAN setup would be on a Fortigate appliance:https://www.youtube.com/watch?v=K9IUwPXTt3U&t=423sDIA public IP – 194.x.x.184 (Primary)Gov link – 10.x.x.254 / webscript (secondary)Both links would be members of the same SDWAN zone with a simple performance SLA and best quality SDWAN rule. A static route would be configured to send all traffic (0.0.0.0) to the SDWAN zone.Firewall policies to allow traffic would also be configured as per instructions.My question/concern is if the proxied link could be used in an SDWAN setup and if s

Hello everyone, I created a local-in policy as described in this example: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-in-policy-using-ISDB-as-a-source-address/ta-p/323085Overall, the policy works, but for some reason, some IP addresses contained in the ISDB, and these ISDBs are listed as sources in this policy, are not blocked.What could be the reason?

Hey folks,I’ve been diving into FortiManager and noticed there’s a way to deploy SDWAN using Jinja2 templates instead of the traditional static policy/package approach.From your experience with large scale deployments, how common is Jinja templating for SDWAN and policy automation? Is it considered standard practice among MSSPs and enterprise customers, or still more of an advanced/power-user feature?Also curious from a career/skills perspective, is it worth investing time to learn this method for efficient SDWAN deployment at scale?Would love to hear real-world experiences.