Fortinet Community

Hi, I have FortiGate connected to  Cisco switches (core + access), which is connected to 7 FortiAPs. I want to create multiple SSIDs (VLAN 10 and VLAN 20). Currently, I have created two VLANs under my LAN physical interface on my FortiGate, and two SSIDs in bridge mode. on the switch side. I changed the point-to-point interface (to FG and to AP) to Truck. and created (vlan10, vlan20). Unfortunately, the internet is very slow, and AP keeps restarting suddenly. I opened a ticket with TAC, but it was not helpful. Kindly advise if my config is correct. Or better to move to Tunnel mode. And what is the difference between Tunnel and Bridge mode in function and configuration on a Cisco switch?

Hello,   The issue is: why Fortilink cannot be established over a media converter ? What are the limitations ...? Vendors of ""proper"" media-converters ??? I thought that media converter is only a dump converter: from electric signals to optical -so it does not introduce anything in the traffic -> ergo it completely transparent and FolrtiLink shoul (!) works   What about config like this Of course : -FG is configured for FortLink on the port that is connected to the media-converter -SFP are proper for the fiber : SFP SM for SM fiber type -Link on BOTH sides are UP and blinking... [F-Gate UTP] <--Cat 5e copper --> [ UTP  MediaConverter  SFP] <--Fiber --> [SFP  FortiSwitch]   any magic command from CLI (again...!) on Fgate or Fswitch ?????   UPDATE: the SAME Fortinet SFP module plugged from switch to Fluke Analyzer and connected via media-converter to normal  (non-fortilink) port in FGate  works from the first kick ... &nb

I have 2 site to site from site-A to site-B and sdwan only enabled in site-AIn the site-B I configure static route to site-A via 2 link with same cost.The issue is when site-A select link-B for example then site B reply using link-A.How we can prevent this kind of asymetric?

OK to set the scene.We are using Fortinet EMS Cloud with Entra SSO authentication.  We create the deployment and push via Intune.  Our machines are built with Autopilot in a Hybrid setup.  When the Forticlient is installed and the machine rebooted, the VPN shield is not present so the user in unable to connect to the network remotely.  Note, this is not an issue for newly built machines on the network only those that are remote.The endpoint profile is not pushed to the machine until the user has logged into the machine.  But as the user cannot login, the machine cannot receive the profile.How can the configuration profile be pushed as part of the initial Forticlient install? Martin

I'm currently trying to get some port forwarding setup on my Fortigate 61F running 7.2.11 build 1740 but am running into some issues because I'm having to run the Fortigate behind another SOHO router (long story). The Fortigate has been added to the DMZ of the SOHO router and its interface is being assigned an ip from the router via DHCP.  I started by configuring the port forwarding like I normally would do by creating a VIP using the following details:External Ip address is set to 192.168.123.45Internal ip address is set to 192.168.21.2Both Internal and external ports are set to desired port numbers Once the VIP was created, I then created the firewall rules to allow traffic to flow, not realizing at first that the traffic was going to have the local_in policy applied to it instead.  Once I determined that it was being treated as local_in traffic, I created a local_in policy for the traffic as follows: interface is set to internal3 srcaddr is set to alld

Hey,I’m currently getting ready for the NSE5 FAZ-7.2 (FortiAnalyzer) exam and looking for the most updated and reliable practice questions for 2025.If anyone can suggest trusted resources or mock exams that closely match the actual test format and difficulty, I’d really appreciate your help.Thanks in advance.

Hi,is it possible to provision a Let's Encrypt certificate with an additional domain (SAN certificate) on a FortiGate 200F. We are using the firmware 7.0.11 at the moment.In the wizzard there is only one input field for domain. Padi

Dear Support team, I am using fortigate evaluation license which never expire.  I have configured automation trigger for interface goes down but not getting email , please refer the output. Can you tell me is there any limitation in evaluation license. System is starting...Starting system maintenance...Scanning /dev/vda1... (100%)Scanning /dev/vda2... (100%)The config file may contain errors.Please see details by the command 'diagnose debug config-error-log read'.Serial number is FGVMEVHBOOPJCGE6FGVMEVHBOOPJCGE6 login: adminPassword:Verifying password...Login incorrectFGVMEVHBOOPJCGE6 login: adminPassword:Verifying password...Welcome!WARNING: File System Check Recommended! An unsafe reboot may have caused an inconsistency in the disk drive.It is strongly recommended that you check the file system consistency before proceeding.Please run 'execute disk list' and then 'execute disk scan <ref#>'.Note: The device will reboot and scan the disk during

Hi Guys,  FortiGate 7.6.3:  i have a remote to site tunnel correcttly working with Microsoft SSO, i'm trying to set a second one with local user/certificate access but i'm stuck on getting the access request on the correct tunnel. The first tunnel is using a remote GW,192.168.1.120The second tunnel has assigned a remote GW 192.168.1.123 with different public IP both are one the same public interface. When i check the remote client accessing logs, i see that all the request go to the first tunnel and never the second one.Do you have any idea why i'm getting the traffic on the second one?(all virtualized on AWS)

I am setting up Zabbix. Could anyone recommend a template for the F60 box?

Hi,I have multiple virtual servers configured, their `Virtual server IP` is in a dedicated class A subnet just for this. The VS are then reachable through the SSL-VPN.I now need to make some of those VS reachable from the internet. I'd like if possible to keep the private IP address for the virtual server, and to just dNAT the public IP address to the VS ip address. (so I can keep a public enpoint and a private endpoint, with dns records for each of them)Although, my tests didn't suceed.At the moment I have the not-working following configuration:config firewall vip edit "vip" set uuid aaa set extip 192.0.2.4 set mappedip "10.0.0.1" set extintf "port1" set portforward enable set extport 443 set mappedport 443 next end config firewall vip edit "vs" set uuid bbb set type server-load-balance set server-type tcp set extip 10.0.0.1 set extintf "any" set monitor "hc-zzz" "

Hello, I am working with quarantine actions on FortiDeceptor and noticed something important. When I integrate FortiDeceptor with FortiGate for quarantine, if an attacker connects to a decoy (for example via RDP), the attacker is immediately quarantined. The issue is that this prevents me from observing the attacker’s techniques and tactics in more detail, since the quarantine is triggered right away. Is there any configuration or adjustment that allows FortiDeceptor to delay quarantine or to give the attacker more time to interact with the decoy before FortiGate enforces the quarantine action? Thanks in advance for your guidance. Regards,İsmail Ürek

The company's intranet penetrates to the cloud server through SD-WAN. Recently, the intranet suddenly became unable to access the server. The problem was located on the Fortinet firewall. After checking the logs, it was found that access to SD-WAN was blocked due to policy violations. The Policy ID was displayed as 0, and this policy could not be found on the policy settings page. How can I solve this problem?

Good morning,I am having a problem with an ADVPN using IPsec tunnels.I have a hub-and-spoke setup, and at my branch office, I have two IPsec tunnels that communicate with the hub using the ADVPN BGP routing protocol.When my branch office’s spoke-1 degrades, BGP routing doesn’t detect the failure in the SLA performance configured in the SD-WAN, where both tunnels (spoke-1 and spoke-2) are located, and it continues routing through the degraded spoke-1.Has anyone else experienced this issue?In the SD-WAN SLA configuration, I have disabled the static route update.

Hello everyone,I had a FortiClient EMS implementation for a client which required configuration of regular firewall rules with ZTNA Tags , no use of ZTNA Servers, plain old classic rules with just an extra layer of security/compliance.The implementation worked as expected but the raised question was, what happens when the client doesnt have the security posture tag anymore while sessions are active/accepted ? Well, at first the situation was quite obvious, as long a session was active/didnt expire, although the tag was no longer presented based on which the access was granted it would still work, after it would expire or was manually cleared, the next initiated connection would fail until the computer/client had the correct tag. This situation made do a little research and led me to this article which should solve it : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-remove-allowed-existing-sessions-after-ZTNA/ta-p/362819  I tried to replicate i

Hello team, I'm facing a strange issue with a FortiVM we have deployed on our company.Every 2 or 3 hours, we are losing Internet connectivity. Tried to ping from Forti CLI to 1.1.1.1 / 8.8.8.8, I'm getting no reply, tried to ping google.com or any other web page and I'm able to resolve those URLs to their relevant Public IPs (but no reply), so there is no DNS issue.We've tried to transfer this VM to a different ESXi, but the issue wasn't resolved.Yesterday, we re-deployed the FortiVM (fresh install, not a snapshot from the old VM) with TAC support, upgraded to 7.2.12, but today, in my surprise, we had the exact same issue. We are using this firewall for SSL-VPN Connections, no web filtering or any other "extreme" security features are enabled.The firewall has two Virtual Interfaces (one internal, one external) which are connected to the ESXi through a trunk interface. Anyone had this issue before?Thanks in advance. 

Hi, I have configured SSO to Entra 365 on a Fortigate 40F running 7.0.13. I created a trusted certificate and added it to the Fortigate. When I use the FQDN to connect to the SSL port and use SSO it never works properly always seeming to time out, especially after signing in on the 365 side and it relays back to the Fortigate. I did adjust the remote timer. However when configuring in Forticlient, if I use the IP address I get a self-signed warning but am able to connect to the VPN after signing in using SSO.  Is there some kind of DNS thing I need to do on the Fortigate? I notice the web listening mode in SSL/VPN settings is showing the IP address and not the FQDN.  I am highly certain all  the SAML stuff is all good as I have beat this up for a few days.  So thinking its a DNS resolving issue. I have already placed an A record on my public DNS. And I can always sign-in without fail using the FQDN to the web admin interface. 

I want to know if there is a way to create Fortilink p2p redundancy using Fiber Link and Radio Antenna

Dear FTNT community, Is there any way of configuring multiple (different) isolation ports in FortiNAC-F 7.2.X ? In our case we want one portal for wired connections and another different one for wireless connections. Thank you in advance.

Hello everyone,I have a question regarding FortiAnalyzer Cloud licensing. I have the following setup: one FortiGate 70G at the main site and two additional FortiGate 50Gs at two branch offices. We want to use FortiAnalyzer Cloud. If I understand the FortiAnalyzer datasheet correctly, with the "5GB/Day Subscription" license you need a collector, which is a small on-premises appliance or VM running in collector mode. That means that, in addition to the subscription, I would also need a full license and hardware for the appliance or VM. Did I understand that correctly? If that’s the case, I think with this scope the more cost-effective alternative would be to go with the "per Device Subscription." I would appreciate your feedback. Best regards,Karsten

Hi, I’m running into a strange issue with an IPsec tunnel to a Cisco firewall and I’m hoping someone can help.The tunnel comes up fine and traffic does pass through, but the connection slows down significantly. For example:If I ping 8.8.8.8 directly from an end-user machine, the replies are just a few ms.If I ping a remote address over the tunnel, the latency jumps to about a second.Even pinging the remote VPN gateway itself shows very high delay. As soon as I bring the tunnel down, latency immediately improves to under 10 ms.Setup details:Both the Internet and VPN zones share the same physical interface on the firewall (different VLANs) and use the same ISP.I don’t believe the issue is on the remote side, because if I establish same tunnel to the same remote gateway from a different firewall, it works normally.So far, I’ve tried flushing the tunnel on both ends, but that didn’t help.Does anyone know which commands I could run to troubleshoot this further, or what else I should be chec

Someone can correct me if my understanding below is correct or not regarding sdwan best quality and lowest cost (SLA). Best quality When use best quality the parameter used is only to select one from available belowLowest Cost (SLA)With this criteria then the parameter used is SLA target from each performance SLA?

Hello, I have a pair of 100F firewall configure in HA with Active/Standby and HA dedicated MGMT Revervation is also configured with ha-direct enable. I am tried putting the AD details in the fieldsa and under regular provided the AD Credentials Administrator, and trying to browse DN, but is is always says invalid LDAP Server. Note : Windows is successfully authenticated to users.  

I have 3 sites and 6 FAC vms  , 2 fac in HA(active-passive)  in each site is deployed.  one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Dears Appreciate your support to advise with the needed co to solve below issues:High121010TLS Version 1.1 Protocol DetectionHigh17367Fortinet FortiGate Web Console Management DetectionMedium157288TLS Version 1.1 Deprecated ProtocolMedium187315SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)Medium51192SSL Certificate Cannot Be TrustedMedium57582SSL Self-Signed CertificateLow153953SSH Weak Key Exchange Algorithms EnabledLow10114ICMP Timestamp Request Remote Date Disclosure