Fortinet Community

Hi, Can someone please guide whether we will be able to add remote user into the domain who is connected to HO network using Foritsase SPA.  Regards,Ganesh

Hello using Fortigate 100D I have added it in category overide and also web filtering it works and let me on sometimes but on other times or a diffrent person they get this An application is preventing Microsoft Edge from safely connecting to this site"Fortinet" didn't install properly on your computer or network. Contact your organization to fix the issue.NET::ERR_CERT_AUTHORITY_INVALID     I've tried using a hotspot to go outside the firwall and get certificate and uploading to fortigate but it give me an error suggesting i already have it?      

We use a FortiGate 601E with v6.4.9.Since the last firmware upgrade, FTP transfers with EPSV have been failing. Locally, the FTP server responds with "|||PORT|." However, the FortiGate translates this to "|||PORT" (the final "|" is missing).Transfers with PASV continue to work.I can't disable the session helper because it's required for PASV.

Helloi just updated to the latest version of the linux client 7.4.4.1796 as i kept having errors with the previous version... Now i definitely cannot get it to work at all, keep gettingLogin failed: internal error. Check VPN logs for details.i'm not a fan of yours from the start as i have never had a stable vpn in the past, but this is the worst thing ever happened. i have checked the logs, but nothing explicit telling me where's the problem.

Hi,I am trying to connect a pair of Fortigate HA in A-P mode to 2 Aruba Core switches and wondering what the best practice is.  The Aruba switches are working in VSX mode.  Let's call them CS1 and CS2.  The connection will be like the following:CS1 port11 -> FG1 port 11CS1 port21 -> FG2 port 11CS2 port11 -> FG1 port 12CS2 Port21 -> FG2 port 12With VSX when connecting switches I can just put all 4 links in 1 LACP lag and it works fine. Now with interconnection between the Aruba switches and the Fortigate HA I am trying to find out what is the best option?  1. To put all 4 links in 1 multi-chassis lag on the Aruba side  and set lacp-ha-disable enable on the Fortigate side2. create 2 lags on the Aruba side, 1 lag to FG1 and another lag to FG2.What is the best practice here in terms of stability and failover time? Thanks,  

Hello,I'm facing a traffic drop issue when trying to use FortiGate's load balancing feature via Virtual Servers. Setup:FortiGate with Central NAT enabledInterfaces:frontend: 192.168.1.1 with secondary IP 192.168.1.2wan1: 20.20.20.20 (anonymized), member of SD-WAN zone "SDWAN"When I configure the Virtual Server to listen directly on the wan1 interface, everything works fine.However, for internal reasons, I need the Virtual Server to listen on a VIP.So I created a DNAT rule:20.20.20.20 → 192.168.1.2The Virtual Server is configured to listen on the wan1 interface (since I cannot select the SD-WAN zone directly).In this setup, traffic no longer works. When debugging, I get the following error:2025-10-10 11:48:07 id=65308 trace_id=411 func=init_ip_session_common line=6070 msg="allocate a new session-5355a635" 2025-10-10 11:48:07 id=65308 trace_id=411 func=get_new_addr line=1265 msg="find DNAT: IP-192.168.1.2, port-0(fixed port)" 2025-10-10 11:48:07 id=65308 trace_id=411 func=fw_pre_rou

Good morning, I urgently need help.In one of my web applications I implemented oauth2 authentication using the OAUTH2 service present in FortiAuthenticator v6.6.1  via REST API, so I configured a confidential type relying party, openid type scope and some claims. The entire OAuth2 flow works well in the sense that I authenticate myself and the token is released to me but I would like to know how to log out. The log out is not documented in the documentation. I would like to know how to log out and have the cookie deleted with some command. The only way I get this effect is to delete the server history. Is there a way to do it or is it not provided??? Thanks in advance

As the subject says. (Running 7.6 on the manager btw) Is it possible to nest a metavariable. Inside another metavariable?  Example: new metavariable $(BGP_LOCAL) default value is now 10.$(site.ID).$(VLAN_USERS).0/24 $(site_ID) and $(VLAN_USERS) in this case is a previous defined metavariable which is normalized to a specific gate or defined subnet etc.  Thanks.  

I see that starting from 7.4 we have an option to upgrade multiple ADOMs at once but they have to be on same version. https://docs.fortinet.com/document/fortimanager/7.4.0/new-features/107391/fortimanager-can-upgrade-multiple-adoms-same-version-at-the-same-time-7-4-1Is there any way to upgrade all ADOMs together regardless of current ADOM version ?

Hi,We have a problem with PDF SCAM emails. The attacker sent a PDF file which contains a scanned letter (image) instead of text. Is it possible to enable OCR functionality to convert image to text and than we are able to use our blacklist dictionary?

Hi,trying to find out what's going wrong concerning typical 1x Hub - 2x Spoke setup with internal BGP.First setup is the setup with IBGP. This works fine, the spokes can communicate with the hub. Below is the design and the relevant info. The Hub is a FGT100F, the spokes are 60F. All in R7.4.9Under this info and code, I'll explain my issue when I want to do spoke1 > spoke2 communication via the Hub (no ADVPN wanted) Hubwan1 = 94.104.146.35lan, IP 192.168.200.1/24Lo_BGP, loopback, 192.168.255.1/32IPsec: tnl_Spokes, ike V2, dynamicSDWAN zone Internet, contains wan1 for internet accessSDWAN zone RemoteSites, contains "tnl_Spokes"SDWAN rules: 1x towards Spokes, 1x towards Internetpolicies:LAN to Internet (all/all)LAN to RemoteSites (all/all)RemotSites to LAN (all/all)RemoteSites to Lo_BGP (loopback addresses of spokes > Lo_BGP)Spoke1wan1, IP obtained via DHCPinternal (lan), IP 192.168.10.1/24Lo_BGP, loopback, 192.168.255.10/32IPsec: tnl_Hub, ike V2, dialup to public IP of h

Hello, I might not be the first one to ask this question. When i try to install forticlient vpn only (last version), the file extract on the computer, and then, a small windows popup et hide. The installation doesn't continue, no message. I am on win11, i try to execute as administrator, no particular firewall. How can i find why the installation is not working? Thanks you,

Hello is there a way to make this work, ipsec with fortiauthenticator User + sms?only user working throw fortiauthenticator but sms no, in sslvpn all working good with sms.Without fortitoken or cloud

Hello,I wanted to consult with you about the option of exporting all events (under threat hunting) from FortiEdr (5.2.0) to Splunk.I establish to pass security events, system events and audit trail with the syslog option, but it is not efficient enough.I wish to pass all events (under threat hunting) to Splunk, with maximum data. Is there a way to do so?  Thanks! 

I really run out of idea on user grouping based on Azure Entra ID object ID.I Follow the administration guide to prepare SSL VPN migrate to IPSec VPN with SAMLhttps://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients#SAMLIdP On phase 1 configuration I face EAP credential error config vpn ipsec phase1-interface edit "FCT_SAML" set eap enable set eap-identity send-request next endLook for lots of tech doc only this workhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Error-EAP-failure-with-IPsec-Dial-Up-VPN-using/ta-p/363196 Which mean I had to define the user Group without any Entra Object ID to make user authenticate success or firewall policy with the user group without Entra ID object.config vpn ipsec phase1-interfaceedit IPSec123set authusrgrp "Azure_IPsec_Empty"nextendconfig user groupedit "Azure_IPsec_Empty"set member "Azure_IPs

Hello Fortinet Community, I have an SD-WAN deployment where a branch site establishes two IPsec tunnels to the head office. The SD-WAN rule at the branch is configured so that traffic destined for the head office uses Tunnel 1 by default, and Tunnel 2 is only preferred if Tunnel 1 is unavailable.  During a recent incident, we noticed that a printer management server at the head office attempted to communicate with a branch printer. Screenshot Taken from Head Office FG(Printer MGMT server in Head Office - 10.128.0.220 & Printer in Branch - 10.242.89.19)   In this case, the head office firewall selected Tunnel 2 as the outbound path. The branch firewall, however, responded via Tunnel 1, which caused the session to fail.As a temporary workaround, we disabled Tunnel 2 on the branch firewall, and communication was restored. Obviously, this is not an ideal long-term solution. My question is:Is there a way to configure the branch firewall so th

Hello everyone, I set up a Dialup IPSec tunnel between two FortiGates. The remote FortiGate connects to the server via an external LTE modem. Port forwarding is configured on the modem. If the connection is lost, the tunnel isn't automatically reestablished. Phase 1 appears to be established, but phase 2 isn't. After rebooting the remote Fortigate, the tunnel establishes itself automatically. However, after the connection is lost, it doesn't establish itself again. Where to look for the problem? Here's the debugging log:ike V=root:0:VPN_Test_TSw1:VPN_Test_TSw1: created connection: 0x9764470 5 192.168.2.2->105.109.199.30:500.ike V=root:0:VPN_Test_TSw1:348: initiator: aggressive mode is sending 1st message...ike V=root:0:VPN_Test_TSw1:348: cookie f28a0d09e11de14b/0000000000000000ike V=root:0:VPN_Test_TSw1:348: generate DH public value request queuedike 0:VPN_Test_TSw1:348: out F28A0D09E11DE14B000000000000000001100400000000000000026E0400003C0000000100

Good morning everyone,I’m currently facing an issue with two FortiGate 100F clusters, both configured in HA (Active–Passive) mode, running firmware version 7.2.8.ScenarioEach FortiGate pair is configured as an Active–Passive HA cluster.Both clusters are interconnected through two point-to-point IPsec tunnels (using WAN1 and WAN2 interfaces).Dynamic routing is handled via OSPF, while multicast traffic is managed using IGMP + PIM-Sparse Mode.In the HA configuration, HA1 and HA2 are defined as heartbeat interfaces (both with the same priority — I’m not sure if that’s ideal), and WAN1 is configured as the only monitored interface to trigger failover.Port 1 on both clusters is used for the internal LAN, connected to a switch distributing local traffic.For OSPF, both IPsec tunnels are used for route propagation, with higher priority assigned to the tunnel over WAN1, and LAN interfaces set as passive.Observed behaviorUnder normal conditions everything works as expected:OSPF adjacency forms co

Hi again FNAC adminsFortiNAC-F 7.2.9.Ruckus ZD1200 10.x WLCI have one single isolation VLAN for quarantine, dead-end and registration.VLAN switching works now fine via RADIUS DM. Tested it by disabling adapter or disabling host, and it moves it instantly to isolation.The issue now is with quarantine: For wired connection it works well, i.e.: host is quarantined instantly when it fails scan. But for WiFi it doesn't move it to quarantine.With tcpdump we can see RADIUS DM is sent to the WLC, but the host never moves to isolation. DM are still sent periodically by FNAC, like if it is still trying.Disconnecting the host from WiFi and reconnecting again still put it in prod VLAN.Force remediation (group) enabled on the SSID, and quarantine VLAN configured for the SSID as well.Did I miss something?

We currently utilize the Local RADIUS server on FortiNAC-F to perform EAP-PEAP. It works well. However, I'd like to transition to EAP-TLS but can't really wrap my head around what needs to be done to make that happen. We have a 3rd-party cert from Sectigo uploaded to FortiNAC-F for Local RADIUS Server (RadSec) and Local RADIUS Server (EAP) [radius]. What else is needed?

Hello Everyone, It would be greatly appreciated if someone could explain the specific information exchanged during the ADVPN tunnel creation process—particularly in the following IKE messages:Shortcut OfferShortcut QueryShortcut ReplyShortcut NegotiationThese messages are part of FortiGate’s ADVPN (Auto Discovery VPN) mechanism, which enables dynamic spoke-to-spoke tunnels without manual configuration.  

If a computer has Fortinet and fortiient installed because it’s part of a business network would fortinet be able to Flag and monitor content from virtual machines and windows sandbox?

Dear All, I am experiencing issue with IPsec over SDWAN. the issue which I am facing are as flows:- We have two sites which is configured with IPsec over SDWAN so that I can monitor remote site with using their local IP. Site 2 Site IPsec tunnel are up and also configured set source ip (x.x.x.x) under config sys sdwan>config members  .but still performance SLA is not coming up. I troubleshooted.1. Routing (static routing)2. Policy 3.  phase 2 selector 4. SDWAN rule5. Performance SLA6. Set source IP even after all the troubleshooting performance SLA is not coming up. Firmware version - 7.2.11 Need your prompt response & help to address this issue. Thank you 

Hi,I’m having an issue logging in to FortiClient VPN when trying to connect to my B office while I’m connected to the A office network through the FortiGate SSID.When I disable all firewall policies, the connection works.Could you please advise which policy might be blocking the VPN connection?

Dear Fortinet pros, I’ve been thinking for a while about the best way to share a single ISP across multiple customers on a FortiGate cluster (100F), with maximum performance as the main goal. My first approach—using EMAC VLAN interfaces—ran into a problem: IPsec tunnels aren’t hardware-accelerated in that setup and only achieve about 5–10% of the possible bandwidth. Support advised using standard VLAN interfaces to enable hardware acceleration.So I’ve switched to the following design:Basics: The FortiGate cluster is connected to the data center network via an LACP trunk (x1 + x2 interfaces). There are no FortiSwitches. All network interfaces are placed under an 802.3ad aggregate named “DC-Network.” The goal is to use only VLAN interfaces there.The IP addresses below are masked: all 172.x.x.x/x addresses represent public subnets, and all 10.x.x.x/x addresses are private ranges. There’s a public IP block 172.19.1.0/27 that I want to split into smaller /29 subnets for individual cust