Fortinet Community

If i have 2 internet link how we can configure sdwan policy to fullfill my below requirement- group 1 use link1 and will be switch to link2 if link1 have high latency or packet loss.- group 2 use link2 and will be switch to link1 if link2 have high latency or packet loss. in shortway i want to use best quality but also load balance. If we use only best quality for all users there will be bottleneck for one link and no traffic for another link.

FortiOS 7.6.4 released on 2025-08-21.I'm listing here some very interesting new features: 945633You can now use both FortiSwitch network access control (NAC) and 802.1X authentication on the same switch port. After a device is successfully authenticated with 802.1X authentication, the NAC user policy checks if the device is assigned to a specific user group. If the device matches the NAC user policy, it is assigned to a specific VLAN.1106711The FortiSwitch controller now supports generalized Layer 3 switch configuration for hybrid L2/L3 networks. This includes Switched Virtual Interface (SVI), Routed Virtual Interface (RVI), Virtual Routing and Forwarding (VRF), DHCP Server (with minimal configuration for isolated L2 domains), and IPv4 static routes, enhancing network management capabilities.1058743Auto speed negotiation on the 10G Base-T interface now allows the 1G/10G copper ports on the FGT100xF to automatically handle both 1G and 10G speeds and duplex settings, eliminatin

Hi,I am trying to install FortiClient 7.4 onto my Mac (OS 15.6.1) for the very first time.After downloading the dmg file and double clicking on it, the Installer window pops up.After double clicking on that installer to download the app, I keep getting an error saying, ''Can't connect to update server''How can I fix it ? I tried updating software, uninstalling and reinstalling the dmg file but it just doesn't proceed.Any help is appreciated Thanks a lot !

I had FortiClient VPN on my device - Windows 11. Since it was not connecting successfully to my VM today, I thought of uninstalling it and reinstalling it. The FortiClientVPNInstaller.exe file is downloaded successfully from https://www.fortinet.com/support/product-downloads#vpn, but running it as or not as administrator, it retrieves the image list successfully but fails to download the image at 13% or 21%. This takes at least 30 to 45 mins and it has been failing consistently since morning. The installer can't be download even if my device is connected to mobile data (change in networks doesn't help I mean). The same image file got downloaded on my colleagues devices in 2 mins (he is located in Mumbai and I am in Pune).The errors received is error in downloading image. Is there a solution to this problem? Is there an offline installer for FortiClient VPN only?Note: I had turned off firewall or antivirus to verify if the installer goes through, but it did not.

Hello all ,  I am using Fortigate 60F for homelab as below diagram. I want to connect all Wife users and LAN users using the same 192.168.0.0/24 network . How can I do Fortigate bridge mode for LAN and WAN Interfaces , if yes hhow can i achieve it . Thanks in advance for some valid reference.   

Hello,We’re running a standalone FortiGate 60F on FortiOS 7.4.7. Our setup has two WAN links:ISP1 = backupISP2 = primaryOur goal is to:Force all Microsoft Teams voice/media traffic (UDP 3478–3481 for STUN/TURN and UDP 50000–50059 for RTP) to always use ISP2, with ISP1 only as a backup.Make sure Teams voice traffic has higher priority than all other traffic on the network so call quality isn’t impacted during congestion.Since this is a standalone 60F, I know some advanced SD-WAN features may not be available. What’s the best practice on this platform for:Steering those specific ports to ISP2 (router-policy vs SD-WAN service match).Ensuring return traffic stays symmetric on ISP2.Setting QoS / traffic shaping so Teams traffic gets top priority.Any config snippets or guidance would be appreciated!Thanks,

hi,i'm moving an IKEv1 config from ASA to FGT.the crypto ACL or interesting traffic have 3x "inside" source loopback IPs (object "NETWORK_3") and 1x "outside" public IP 46.3.2.1, i'd assume this is the public WAN IP of the remote device/FW. access-list CMAP_ACL extended permit ip object-group NETWORK_3 host 46.3.2.1  <<< CRYPTO ACL/INTERESTING TRAFFIC crypto map CMAP match address CMAP_ACLcrypto map CMAP set peer 46.3.2.1  <<<crypto map CMAP set ikev1 transform-set TSET123 my questions are:1.do i configure in FMG phase 2 tunnel quick mode selector local and remote subnets as 0.0.0.0/0 and then configure the 3x "inside" loopback IPs and 1x "outside" public IP in the VPN FW policy in/out rule?   2.do i  still need to configure a host route for 46.3.2.1 to hop via virtual/phase 1 tunnel and also its blackhole route?  

I've cross checked the knowledge base multiple ways on this issue, and I'm can't tell if this is a setting or a firmware issue or just hard coded. Firmware is 7.2.11 on a Fortigate 80e I use the CLI console from the GUI often. Mainly I use it to SSH to switches and work in that manner. I do this because of company policies. But there is a very annoying feature that I can't seem to resolve. If the CLI Console in the GUI is idle for 50 seconds, I lose my connection. I have to press enter to start again. This can be very annoying when I'm connected to another device and trying to work. I've confirmed this with a stop watch and it will end the session 50 seconds after typing has stopped.  Is there a setting for this? Or was this just poor thinking by the engineers?

######Ubuntu 24.04: Forticlient VPN installation##### 1. Additional packages need to be downloaded in order to install Forticlient VPN: ## download libayatana-appindicator1 by scrolling to the bottom and clicking your architecture (amd64)https://packages.debian.org/bullseye/libayatana-appindicator1## download libayatana-indicator7 by scrolling to the bottom and clicking your architecture (amd64)https://packages.debian.org/bullseye/libayatana-indicator7## download libdbusmenu-gtk4 from this linkhttp://security.ubuntu.com/ubuntu/pool/universe/libd/libdbusmenu/libdbusmenu-gtk4_18.10.20180917~bzr492+repack1-3ubuntu1_amd64.deb 2.  Install these deb packagessudo dpkg -i *.deb## install libgconf-2.4 and libnss3-tools by running the shell script on this pagehttps://2h3ph3rd.medium.com/how-to-install-libgconf-2-4-on-ubuntu-23-10-fec6bda8d5f5## download the forticlient vpn deb package fromhttps://www.fortinet.com/support/product-downloads#vpn## install forticlient vpnsud

Recently, I have configured FAC to act as an IdP proxy for Azure for a gate SSL VPN. The primary objective is to use EntraID and EntraID MFA for all company users. In my lab environment, it works pretty well, but on the production endpoint (i.e., with enterprise-enrolled endpoints), it doesn't ask for MFA. It seems to be related to AzureAD PRT and appears to be an issue with Azure rather than FAC problem. However, I found that it is possible to send the forceAuthn=true attribute in the SAML request. Cannot find how to obtain it in FAC.Anyone have already facing the same problem ? Did anyone solve it ? Thx

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.I am at a bit of a loss at what else to look at.

Hello,I would like to ask if there is a proper guide or recommended method for copying the exact configuration from one FortiGate device to another. Both devices are running the same model and firmware version. Will the license differences have any effect on this process? To clarify, the licenses were purchased separately, but they provide the same functions.My plan is to back up the configuration from the source device and then restore it to the target device. I also intend to configure these two units as an HA pair afterward. Before proceeding, I would like to confirm if this may cause any complications or if there are specific considerations I should be aware of.Thank you in advance for your guidance.

Hi, while configuring Tier 1 (Core) and Tier 2 (Distribution )FortiSwitch. I want to test 2 device ping each other, with the same vlan (for example VLAN2). Let say I don't want to mind the FG, only the L2 first. Do I need to set the VLAN2 with IP address to the Tier 1 (Core) and Tier 2 (Distribution) or it will work even if I set only to Tier 2. Thanks

The upgrade order is 7.2.8 > 7.2.9 > 7.2.11, but I accidentally guided the upgrade to 7.2.11 right away. Is there anything that could be a problem? These are 101F and 61F. Thank you

We're facing an issue where traffic shaping on our FortiGate 60F device doesn't seem to be working as expected.Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows strange current-bandwidth (diagnose netlink interface list) when monitoring shaping statistics. Same configurations works well on Fortigate 100E. At same time shared shaping and per-ip shapers works as expected on Fortigate 60F.The only thing that makes shaping profiles work on Fortigate 60F is disabling ASIC Offloading in the relevant firewall policy. But we wouldn't want to do that because all the traffic would go through the CPU.FortiOS version 7.2.9 - 7.2.11The real upload bandwidth is about 8 Mbps, but the system shows as 27kbps 

Hi, I was using FortiGate version 7.2 with SSL Full inspection mode, and all was good. Now I have moved to 7.6.4, the latest version, but I think the configuration goes differently. I have generated a CSR from (Certificate). And sign it through my local CA. Then import it as base-64. Then import it to my FortiGate. Now the certificate appears under my Local CA. When I go to settings, I'm able to use this certificate. But at the SSL/SSH Profile, I'm not able to use this certificate for my SSL Profile. Kindly let me know the right way to do SSL full inspection with a certificate that is signed by my local CA for version 7.6.4 

I am looking for assistance getting a multiple IPsec tunnel configuration working on a single WAN IP. Utilizing IKEv2 for Entra SAML authentication.  I have two IPsec configurations, each are configured the same with the exception of PSK and Local ID. Forgot one other note: The second tunnel is configured to use IPv4 Split-Tunnel. I can successfully connect to the "primary" one or the employee one I setup first. As long as my PSK/Local ID and DHG/Encryption in my forticlient is set correctly it authenticates and connects. If I attempt to switch to the Vendor intended tunnel and use that configuration, I get through Entra Authentication and it hangs and fails to connect.  Details120G running v7.4.8Using Forticlient free v7.4.3.1790 Hoping someone can point me in the right direction of what I am missing. I was really expecting the Local ID to make this simple to configure. I have tried changing Encryption & DH groups on the second tunnel phase1/2 (o

We are encountering an issue with upgrading our firewalls over cellular. During the firmware update the firewalls wwan connection drops and the firmware push fails. (hangs at 36%)Could this be related to the Modem firmware or is there a setting that needs to be updated to prevent this from happening?Are there any diagnostics to troubleshoot this issue? FGR-70F-3G4G 7.2.6b1575 -->7.4.7b2731LTE Modem EM7565 Firmware SWI9X50C_01.08.04.00 (Generic)Fortimanager 7.6.4 b3579

  Hi All  Just got a couple of the new FAP-23JK access points but I can't get them to connect to the local FGT-80E. SSID is in a Tunnels mode, the FGT-80E is running V7.4.8 and does have default profiles for the AP.After authorising the AP briefly shows as connecting in the FGT GUI then drops to offline. This repeats endlessly.  Other WAPs (FP221E) work fine.  I did a debug on the WAC application using (di de application cw_acd 0x77) and it looks like a DTLs issues but none of the DTLS options on the WTP profile make any difference. Debug output   

Hello. I am standing up a FortiClient #EMS ppliance for the first time, and I have somewhat limited experience with Ubuntu. Our platform is Hyper-V.  The vhdx was properly installed and booted.  I was able to login with user 'ems' and successfully changed the password. So far so good. However, it seems to me that after login, I am now in the 'bash shell', and the instructions for configuring an IP, seem to be based on being in the terminal. None of the commands available in bash seem to allow me to do this. And the instructions here don't work, as they are for terminal.  I tried "execute ls /etc/netplan" but it told me "folder /etc/netplan is not accessible" Can you please help me configure IP? I imagine once that's done, we can ssh into the terminal or maybe even a webpage? Deploying EMS as a VM image | FortiClient 7.4.4 | Fortinet Document LibraryConfiguring the VM IP address by modifying Netplan configuration filesTo configure the VM IP addres

Several IPsec "tunnel-down" per day :FGT ===VPN IPsec tunnel=== ISP box (SFR operator) ==fiber access==> Internet (also many DPD_failure or ESP_error) : reduced by modifying tunnel parameters :NAT-T = forced, DPD = OnIdle, retry=6, intv=45s- no way to customize MTU at tunnel level (FGT GUI)Anyway there are still many "tunnel-down" per day (re-established automatically after:tunnel up). Many LAN users get network outages (Teams, Outlook etc...) - ISP box in NAT traversal mode (ESP encapsulated in UDP 4500)- Many sites are impacted. build = v7.2.11 firmware Support ticket is opened at SFR operator side (SFR box or backbone ?)Could it be a known firmware or configuration issue/bug at Fortinat side ? Thanks

Hi everyone,I recently took the FCP FortiGate Administrator 7.4 certification exam (formerly NSE4) on February 20, 2025. I passed the exam, and I can see my score report in Pearson VUE, confirming the result. However, I haven't received my certificate or badge yet.I've tried to open a ticket on the FortiTraining help desk, but I haven't been able to do so. Since I couldn't find another way to request support, I’m posting here to ask for guidance on how to resolve this issue.Has anyone else faced a similar delay? Is there another way to contact the Fortinet team regarding this?Any help would be greatly appreciated!Thanks!

Hi all,Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?Thanks in advance RegardsFrédéric 

Hi, I have tried using the reset button during operation and also after one power cycle but the reset button is not resetting my Fortigate-100F with FortiOS 7.4.7. I have left the button pressed for more than 30 seconds but it does not make any changes. Is there a specific step I must carry out to reset my device? I have checked on the OS and admin-reset-button command is set to enable so the button should work. Please I would really appreciate your support.

I have a TRUNK-LAG configured for Aggregate mode. This interface contains VLANs 40–48. I want to add VLAN 49 as tagged on the TRUNK-LAG and untagged on SWVL-49. How can I do this?