Fortinet Community

I am looking at setting up Performance SLA on Fortinet which i have done on Fortimanager, however what the requirement is for this is over the network report on this within the FAZ if possible. What I need is a list of the devices that are on the network then along with this a count where it may have failed the various SLA targets, so for example.Device     Ping     ICMP80f-1 -      3              0So I am only interested where the SLA has breached my target of say 20m/s on a monthly basis across the various SLA's not every single one. Is this possible at all out of the box as can only see a handful of reports that can provide some kind of SLA but this a generalisation across the board.

Hello, I have a FortiVoice 200F8 verison 7.2.1 running a VOIP trunk with fax setup. T.38 is enabled on the trunk SIP profile. I took a packet capture of an inbound fax and this is what I found (I am the client). Maybe I am misinterpreting the packet capture, but it looks like my 200F8 is trying to use T.38, the sender ignores it, and then the FortiVoice hangs up. What I find interesting is this setting under Fax: The packet capture shows multiple attempts at T.38, doesn't fallback to G.711, and ends the call. What constitutes T.38 failure for this setting to work? 

Hi i have a problem to ativate double stack for  vpn ssl   config vpn ssl settings set dual-stack-mode enable end Response in cli mode   set dual-stack-mode enableTo enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.node_check_object fail! for dual-stack-mode enable    I have only one vpn policie. do you have an idea ? Regards

I have the following situation: I have a website that in our config is allowed per cathegory due to FortiGuard rating. Now  we want to temporarily have webfilter block that site.So I added a web rating override to a local cathegory that is set to action block in our webfilter profiles.However that site does not get blocked. It does get blocked if I do it via static url filter. It also does get blocked (but without blocking page) if I deny it by a policy.Then tried the same with www.ccc.de and it was blocked by webfilter due to the rating override correctly. For debugging I had the webfilter debug log running while I tried to access the site: Log says this;[334@2136]urlf_query_fgd: id:1187 sess:2136 action:2 error:0 src:1 host:myurl.com url: rate_ip:0 ssl_exemption_query:0[334@2136]ips_urlf_add_query: id:1187, queue:1, ssl_exemption: 0[334@2136]urlf_query_fgd: session:2136 suspended, query id:1187 for www.cccc.de it says this: [334@2128]match

Hello guys , I have a problem with reports from FortiAnalyzer.  I'm gonna explain my 'topology' the best way i can.Firstly, there is a standalone EMS that pushes the logs of the hosts to the FortiAnalyzer. I can see the logs in Fortianalyzer , so we are sure that we have them in the right place and there isnt a conneciton problem. It seems that when i run a report (new or old) it's contents its the same almost every time and there is only one host in its results. I use the default report editor (i have tried use different choices in the graphs but no desired result). Also i give it a try with and without  the extended log filtering and checked all the options (device , source ip, dest ip, endpoint id....). Enable High Accuracy Caching also checked in case there is a problem with the number of logs.  FortiAnalyzer uses ADOM (the correct one selected) , version v7.6.3 build3492 (Feature)

We are doing evaluation of cloud DR solutions.one of the recommendation is to create same subnet/same ip address in the cloud DR so that in the event of DR, we can swing over to cloud once local data centre is confirm not accessible.Question, can we do ipsec tunnel with same local and remote address in the phase 2 selectors?eg. local address - 172.16.0.0/24 and remote address as 172.16.0.0/24. 

I have scenario :My SDWAN rule contain 2 member, ISP-1 and ISP2, have 2 performance SLA, and the strategy using Best Quality with Latency Criteria.Since there are 2 performance SLA, when the sdwan will switch the connection? Is my understanding below correct? SLA1 meet & SLA1 meet = not swicthedSLA1 not meet & SLA1 meet = swicthedSLA1 meet & SLA1 not meet = swicthedSLA1 not meet & SLA1 not meet = go to other sdwan rule. 

I am having issues with SSH access on Fortigate.When I log in via LDP, it works correctly.However, when I use a "local account," I get the following error on Fortigate after entering the username:Administrator pam login failed from ssh(XXXXX) because of blocked IPI should mention that I am using the "Restrict login to trusted hosts" option with the correct IP already configured, and the IP shown in the log as failed does not match the one I am accessing from. Could you help me understand what is happening?

Greetings, all. I have 60 site-to-site IPsec tunnels, and in order to create a policy for each one, I will need to write numerous policies due to the varied zones. I am inquiring as to what the most effective practices are at this time. Should I establish Zones or Interface Groups or enable multiple interface policies?

Hi,After upgrading our FortiGates to version 7.4.7, we noticed that the "Bandwidth" tab/section under Dashboard is missing, along with all the previously created graphs.While we can manually add a new Bandwidth dashboard, this isn’t practical since we manage around 100 sites/firewalls. Before the upgrade, all sites had bandwidth dashboards with graphs already populated, but these were lost after upgrading.Is there a way to retain existing bandwidth graphs after the upgrade? We were expecting to gain features, not lose them, especially at scale. Thanks in advance.

After changing the VDOM containing the IPsec tunnel interface on the FortiGate 60F (firmware version 7.4.3) to a non-management VDOM, the IPsec tunnel went down upon reboot. Prior to the reboot, the tunnel remained up.After switching the VDOM back to the management VDOM, the tunnel came back up without any other changes.Is there a requirement that the IPsec tunnel interface must be under the management VDOM at boot time in order to come up?

Hello, I’m looking for a 10G Single mode SFP module to connect a switch and Fortinet routers over a short distance (around 2–10 meters). Could you recommend the right option?Best regards,

Hello, I am currently testing SAML authentication between FortiGate 7.4.8 and FortiAuthenticator 6.5.6 to allow users to access the internet. The user is running Windows 10 and is on the same VLAN as the FAC and FGT.Authentication and redirection work perfectly with Firefox 142.0.1 or Chrome 140.0.7339.81. However, with Edge 140.0.3485.54, I get a loop between the FAC and the FGT. Here is the configuration I use on FortiGate :config user setting set auth-type http https set auth-cert "fgt.xxxxxxxxxx.xyz_2025" set auth-ca-cert "proxy.xxxxxxxxxx.xyz" set auth-timeout 30 end config user saml edit "fac_saml" set entity-id "http://fgt.xxxxxxxxxx.xyz:1003/remote/saml/metadata/" set single-sign-on-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/login" set single-logout-url "https://fgt.xxxxxxxxxx.xyz:1003/remote/saml/logout" set idp-entity-id "http://fac.xxxxxxxxxx.xyz/saml-idp/cc7z1kwrro2em2yu/metadata/" set idp-single-s

Guys, Where can I download the 7.2.8 version of Forticlient VPN for MAC OS? I have this issue trying to download it from fortinet support site...

After the firewall upgrade, a small number of clients occasionally experience timeouts when accessing the HTTPS applications deployed in our internal IDC. When  set policy NPU is disabled, everything returns to normal. Our internal applications are built on LVS. What are the common causes of this issue?

Hello Guys, i want to renew my certificate for ssl vpn over ssh. it worked but now i get the error "Input is not a valid/matched certificate. node_check_object fail! for certificate". Can someone help me pls. I've post the log from my ssh commands. Thanks

I have a issue that’s totally killed my vpn remote workers.So we all know that forticlient is depreciated Ike version one so we’re forced to use Ike version two. I’m fairly new to the Fortinet so bear with me.I’m getting a connection time out on my clients. I think I’ve traced it to the local-in-policy not allowing TCP for IPSEC. How do I resolve this. I’m running version 7.4.7 the GUI does not allow you to add policy for local in.

Hi together,   we started to play a little bit with IPv6. For cost reasons we only use an internet connection with no static assigned address range on branch offices so we have to use prefix delegation. The provider delegates a /56 network which seems to be almost static but if it would change one time it would break IPv6 so we configured prefix delegation.   Linux clients don't configure an address via SLAAC. After some research (with wireshark) we figured out that linux does (RFC conform) duplicate address detection but Fortigate answers any of this neighbor solicitations even if the address is not configured or assigned to the Fortigate. Windows and iOS devices don't seem to to that and seem to configure their SLAAC without DAD. When disabling DAD on linux clients they configure their address via SLAAC. Why does Forti answer any of these neighbor solicitations? We can't disable DAD on each client that would be a mess. Do we have to set any options additionally or unconfigu

Hello and sorry for my english, I want to enable sanbox fortigate cloud, i have licence. When, i enable forti sandbox cloud, i have this message : unreachable or not authorized I am witih multi VDOM, i enable sandbox on GLOBAL VDOM and this alert is on global VDOM. But when i active this functionnality on antivirus profile on external VDOM it seems working.I found this command on documentation : 'diag test app forticldd 3' that say : 'Active APTServer status: unknown'i can ping from global and root : service.fortiguard.net, update.fortiguard.net and guard.fortinet.neti can ping APT server i don't understand where it is blocking... maybe because it try to connect trough root VDOM because it is VDOM management1 have 3 VDOM : external - root - internalthanks for help

Hi,On a standalone FortiGate 60F (FortiOS 7.4.7) with two WAN links (ISP1 = backup, ISP2 = primary), I need to:Force all Microsoft Teams voice/media traffic (UDP 3478–3481, 50000–50059) out ISP2, with ISP1 only as failover.Give Teams voice higher priority than other traffic.What’s the best approach on this platform — SD-WAN service rules or router policies — and how should QoS/traffic shaping be set up?Thanks!

Hi, I have a new deployment for FortiGate as an edge firewall. The latency design involved DC FW acting as both DC and Edge. Now I will implement Fortigate as Edge and do point-to-point with DC FW. The Q is. I do have:- one Internet link with 2 IPSec over the Internet link.- 2 MPLS links. One to Cloud servers with paloalto fw, second for my 10 Fortinet branches. For the internet, I will have only 1 link. And over that will build 2 IPsec (One to be a Load balance SDWAN with MPLS to my branches, Second to be a passive link with MPLS to my cloud service). What is the best practice to build that topology? Should I add all three 3 WAN interfaces under the SD-WAN Zone, and with that ZONE create 2 IPSec? Or I have to keep the 3 WAN interfaces without SDWAN zone as normal WAN interfaces, as there is no Load balancing except the connection with branches. Then create SDWAN for IPsec. Kindly for advice for the best practice solution.

Hi, we have a new FG90G and we want to add another LAN segment to separate the IT dept. So the problem is that I have LAN OLD 10.10.111.0/24 (port1) and LAN IT 10.10.112.0/24 (port3).  Our MPLS network is 10.10.0.0/16 with a route to the MPLS router 10.10.11.1. So my host 10.10.112.135 cant ping 10.10.111.200 though I have a policy from LAN IT > LAN ALL and ANY. Sniffing I see that the FG routes the traffic pinging 10.10.111.200 to the MPLS network since 10.10.0.0/16 gets routed over the MPLS network. So I tried a Policy Route to avoid problems from LAN IT to LAN outgoing interface LAN IT and I tried different options in this Policy Route but I never see that traffic from LAN IT goes to LAN. Both LANs are Sowftware Switch. What am I missing? Thanks!   

Hello community,Since I have configured some mail alerts with the automation in our FortiGate-VM I noticed that the "High CPU" message gets triggerd every day exactly every 8 hours (0:00; 8:00; 16:00). But the cpu spikes only for a very short time, since I don't even see the spike in the CPU widget or GUI process monitor.I tried configuring the generation of the local reports to other times than those 3 times with the CPU spikes, but it still happens.I also looked at the times where IPS and AV database updates (setting is automatic), but it never was at those times from the CPU spikes in the last weeks.Also rotation of logfiles only happens at 0:00 so this does not explain the other times from the CPU spikes. I also run some CLI commands for monitoring the system performance, when a mail alarm is sent, here is the output from it:========== #1, 2025-08-14 08:00:07 ========== FW-SAAS config global FW-SAAS (global) get system performance status CPU states: 83% user 14% system 0% nice

What is the difference between running Fortigate VM Evaluation on KVM and Hyper-V? In Hyper-V during my use I didn't have problems with limiting policies, but in KVM this occurs in any installation I made. In theory, what works in one should work in the other, right?

Hi,I'm new to cybersecurity.I fully completed these two courses. FCF - Introduction to the Threat Landscape 3.0 Self-PacedFCF - Getting Started in Cybersecurity 3.0 Self-Pacedbut in fortinet training institute' dashboard it displays as in progress/resume.any solution for this?