Fortinet Community

HI! Does anybody know if exist the possibility of configuring and controlling central SNAT using the destination port? I mean, could you make the firewall SNAT HTTPS traffic and not SSH traffic, for example? I think that it is not possible, in the version I am using, 6.0.13, but I would like to check if it is as I expect. Thanks for support!

I have HUB and SPOKE ADVPN topology, shortcut tunnels are working fine but direct BGP peering between spoke is not established and only spoke to HUB bgp is working, i have configured neighbour groups/range at both HUB and SPOKES. kindly suggest the solution.

I have set up Fortigate 7.2.3 trial QEMU VM in GNS3.How am I supposed to to evaluate the product if I can't even create a VLAN interface? There are 3 physical interfaces and 1 fortlink (802.3ad Aggregate). Error message:Maximum number of entries has been reached.Object set operator error, -4 discard the setting.

Hi teamsI am using a FortiGate firewall with stateful inspection enabled, and we'd like to understand the packet processing logic for return traffic.Could you please share any information you have on this?Specifically, I am looking for an explanation of return traffic similar to the one provided in the following URL: https://docs.fortinet.com/document/fortigate/6.0.0/parallel-path-processing-life-of-a-packet/478386/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloadingI am currently considering whether to address return traffic by adding a policy route or by adding a less-preferred static route. Our main question is whether the routing table is consulted at all for stateful return traffic.Thank you Kenji

Can we disable the prompt which asks for access read-only, read write access after we login into FortiGate.

 Hi in a scenario,Can i do multiple ports forwarding for traffic coming on a single ip to multiple servers behind fortiweb??

Recently we bought the latest Microsoft Surface Pro with Snapdragon processor, tried installing Windows FortiClient 7.4.1 which reaches 100% & rolls back with installation failure message. Tried with Microsoft App store FortiClient & configured with Windows native VPN & got error "ProSSLVPN Error: code=-30008000(v1.0.1041)". Can any Forti Gurus help ?? Thanks & RegardsMurali S L

I have 2 Active directory servers at 2 different locations my Forti-authenticator sync with this AD using LDAPs where i have imported certificate extracted from AD however need to confirm as my both AD sync but are in different location an my authenticator is also in these 2 different location so should i extract the certificate from both AD 

Hi, we are using FortiClient as VPN but we are experiencing problems to access Factorial Website. To try to solve this problem I have set two URL Filters which is located in Configuration > Security.But unfortunately this is not working either. Any solution for this?Thanks in advance.

I would like to report a bug I have encountered with FortiClient. Here are the details:When I open the FortiClient Console, the window appears but often disappears within a few seconds.If I create a VPN connection named 0000 with the Client Certificate set to None, the FortiClient Console remains open and does not disappear.However, if I create a VPN connection with the Client Certificate set to any value other than None and select it from the dropdown list in the FortiClient Console, the console often disappears within a few seconds.Additionally, I have checked the Windows Event Viewer, but there were no logs at the relevant times in either the Windows Logs\Application or System sections. I also set the Log Level to Debug in the FortiClient Console and exported the logs after reproducing the issue, but there were no logs at the relevant times.Furthermore, I found that deleting certificates issued by DO_NOT_TRUST_FiddlerRoot in the certmgr.msc (Certificates - Current User > Personal

Hi, yesterday a Firewall Policy was accidentally deleted on Fortinet (v7.0.11). In Log Events I only see "Delete firewall.policy 37". How and where can I see what the policy did so that I can recreate it?Thanks.

In a multi-VDOM setup (91G @7.4.8) I have connected routes in several VDOMs, iBGP between VDOMs, one VDOM as RR. For root VDOM I have the route 192.168.0.0/24 (VLAN on a LAG), and the physical port is up. I can even ping it. But it does not show up in the routing table - and thus is not advertised to it's peers nor the RR. Any pointers here? It's not in the routing-table database. I see the connected routes of the other VDOMs via BGP. FG1 (root) # execute ping 192.168.0.1PING 192.168.0.1 (192.168.0.1): 56 data bytes64 bytes from 192.168.0.1: icmp_seq=0 ttl=255 time=0.0 ms--- 192.168.0.1 ping statistics ---1 packets transmitted, 1 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.0/0.0 msFG1 (root) # get router info routing-table connected | grep 192DS1 (root) # get router info routing-table details 192.168.0.0/24% Network not in table  

Hello all, I'm a newbie here as well as a newbie to FortiGate FG_80F Firewalls I have two questions Regarding opening two port in my firewall. First, I want to say that I tried to follow a doc from support How to open a port. The problem is I do not have an IPV4 policy on my firewall so I can't continue with the article from support. 1) I need traffic to pass through Port TCP and UDP 5080 and 5081. How do I configure the Firewall Policy to allow through these ports?2) And how do I configure nat to consistent nat? And need to make sure SIP and ALG is disabled.  I would appreciate any help I can get. Thank youChris

Hi,We have 2 fortigates in different locations and each of them include SPA license, in a addition to a FortiSASE subscription.To maintain policy consistency for remote users and also branch site users, we are planning to use the branch fortigate as an Edge Device in FortiSASE instead of establishing a direct tunnel between branch fortigate and the HQ one.I'm just wondering how common is this ? it looks so complicated reading the admin guidePS: we have UTP bundle with each fortigate (HQ and branch), in my opinion a direct tunnel between both sites is better, and FortiSASE will be used mainly for remote users only.

  FortiSOAR transforms Unix user access management into an automated, auditable workflow. By consolidating user data, classifying account status, and integrating with the FortiSOAR User Module, organizations gain a foundation for scalable governance today—with future expansion into Windows and hybrid environments. With this framework, user access reviews that once required manual effort can now be performed seamlessly through FortiSOAR—ensuring speed, accuracy, and audit readiness.   Problem Statement Enterprises face significant challenges in managing user access across thousands of servers. While FortiSOAR’s Asset Module maintains system inventories, it lacks built-in direct mechanism to continuously review and validate associated user accounts. Today, administrators must manually export user lists, reconcile them with asset records, and track approvals—a process that is slow, error-prone, and unsustainable at scale. The challenge is two-fold: Automating the re

Hello,I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.Requirement:Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.Issue I’m facing:The problem comes down to policy order.If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.So effectively, the firewall only applies the firs

Hello all, We have a major issue with the Forticlient VPN connection..After many tests, here is what we know : When using the Forticlient app on an ANDROID tablet/phone with a direct wi-fi connection, it works flawlessly  When using the Forticlient app on an ANDROID device by using a phone's mobile data to connect the device to the internet, it doesnt work. We get the error message « show error:revoked by android reboot »  When using the Forticlient app on an IOS device, it works perfectly either with direct wifi or a through a mobile hotspot. We are always using the latest iOS, Android or Forticlient version available.We have this issue since April 2025.Our IT service is clueless.  Does anyone here could help to sort this out?  Thank you very much and have a great day! FortiClient 

Hello,we are running a SDWAN infrastructure with one Hub and several spoke. All sites are equipped with 60E clusters running 6.2.3.On one of my spoke I have a strange behavior.each 3 min I have this error in router events logs:BGP: %BGP-5-ADJCHANGE: neighbor 192.168.88.254 Down BGP Notification FSM-ERRfollowed byBGP: %BGP-5-ADJCHANGE: neighbor 192.168.88.254 UpThe problem is that during this event all connexions from spoke to hub are shut during roughly 30 sec any idea ? 

I have a FortiSwitch attached to my FortiWiFi50G and would like to take a backup of my FortiSwitch Configuration. Does anyone know how to accomplish this? #Forti Switch

Hi ,   I would like to know the difference between the capabilities that a native SD-WAN at the Fortigate level can offer and those offered by the UNDERLAY AND APPLICATION MONITORING SERVICE license.When should this license be used ? What are technical limitations in native sd-wan in fortigate ? BR

Hello,I would like to know if it is possible to use RSSO instead of FSSO solution, because one of my customer using FSSO has problems with DNS resolution, but I have some doubts for wired clients.There is a lot of documentation about wireless devices using 802.1x, but is it possible to integrate Radius Accounting when the user logs in using the NPS server?Tank youVincenzo Stolfi

Hi, I have FortiClient EMS, FortiManager, and several FortiGates in my environment.EMS is connected to each FortiGate and showing "connected" in the Fabric Connectors;In EMS I configured classification tags to some users;In FortiManager, I have a Global Header Policy applied to all FortiGates;This policy has an EMS classification tag as part of the source match condition.Problem is devices without the EMS tag are still matching the policy. Only troubleshoot I was able to do is running <diag user device list> only to find that there are no tags showing up. Forticlient EMS  v7.4.3Fortimanager v7.4.6Fortigate(s) v7.4.7 I would appreciate some help on how to further troubleshoot the issue. Thanks in advance.  

I can only access a specific website when I disable the web filter. The Fortigate 40F firewall doesn't display any message informing the blocked category. The website isn't placed in any category. When I disable the web filter, I access it normally. I've already placed the website in the Static URL filter, including Exempt, Block, Allow, and Monitor... but nothing happens. It doesn't block or allow. I've also disabled the Fortiguard Category Basel filter, and nothing happens.   

I' ve got a policy/protection profile set up for just outbound email from our public email server and in the DLP rules I' m looking for SSN' s. We are getting quite a bit of false positives in that the numbers look and are formatted like ssn' s but aren' t. Typical example is a reply to an email from Hotmail. Microsoft adds this to their email: Hotmail: Free, trusted and rich email service. Get it now. ( http://clk.atd= mt.com/GBL/go/171222984/direct/01/ ) As you can see, the URL has a 9 digit number that looks like a SSN. Is anybody else using DLP to look for SSN' s or credit card numbers in email/html and is running into this type of problem? We' d really like to continue to use the regex to look for data leaks but it' s becoming a management/helpdesk nightmare. Also, does anybody know when Fortinet gained the capability to look inside the new MS office file formats(.xlsx and .docx)? I tested pretty extensively with DLP and noticed that the firewall could look insid

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?   Thanks