Fortinet Community

Hello everyone,My internet service provider has given me a pool of public IP addresses ranging from 193.x.x.2 to 193.x.x.5 with gateway 193.x.x.1.Now I have two problems: basically, the network configuration at the moment is that the router, which is the LAN network from 192.168.88.x, is connected to the wan1 port of my fg100f.Despite having this pool of addresses, I access the Internet as 84.82.x.x and cannot figure out how to access it as 193.x.x.1. The second problem is that I do not know how to directly set the IP address 193.x.x.2 on the WAN1 port of my Fortinet fg100f.Does anyone have any advice on how to solve these problems?Many thanks in advance.

Hello! The issue I'm seeing is that FortiClient will connect from the my home network, but the connection drops immediately.  sslvpn.log says this:20250829 10:08:18.570 TZ=-0400 [sslvpn:DEBG] vpn_connection:3447 Start IO loop20250829 10:08:18.573 TZ=-0400 [sslvpn:INFO] main:1781 State: Connected20250829 10:08:18.605 TZ=-0400 [sslvpn:EROR] vpn_connection:1316 IO write remote failed. SSL error: 520250829 10:08:18.605 TZ=-0400 [sslvpn:EROR] vpn_connection:2290 Error: Disconnected because of error: IO write remote failed.The odd part was I went to random public wifi hotspots...and it was able to sustain a connection. Forticlient on other computers (windows though, don't have another linux one) didn't have a problem from this network. It did work for several months before this issue happened, so it doesn't seem to be something with the network.   I was able to get it to connect once by changing the IP range of the network, i.e. what the DHCP handed out. (192.168.x.x to 1

Hey all, I recently setup an IPSec VPN to replkace our SSL VPN using Entra and SAML. I had an issue with setting an authusrgrp in the phase1-interface and getting it to work with the user groups that are SAML based. Unset authusrgrp in Phase-1 fixed the issue, and the FW groups starting mathcing on the traffic, but since I moved away from PSK and onto Certificates for IPSec VPN the same behaviour came back, but the authusrgrp knob is gone now due to the certificates. Can I use SAML based FW groups to segregate traffic while using certs? More specifics;We have departmental groups setup in the Entra application, and we need to make sure their access is restricted as such. I'd prefer to only have a single Phase-1 interface that's a 'catch all' for all SAML users (single IP range for all) and let the FW determine who can access what by the SAML groups, if possible.Any thoughts on what might be causing the FW groups to not match on traffic? 

Hi all,   We have 2 X 100D Hardware Appliances running firmware version 6.0.4 (build 0231 GA) in NAT (Flow-based) Mode (HA: Active-Passive).They primarily protect our wireless network which is open to use by staff and visiting members of the public. In general we do not do full SSL inspection.However, I have been testing 'Full SSL Inspection' on a few devices. I have downloaded the Fortinet_CA_SSL certificate from the firewall appliance and installed it on my test platforms (Windows & Android).On the whole, most things appear to work fine except Google Play Store on the Android device, it just won't connect to Google Play at all. If I revert to default SSL Certificate Inspection everything works fine.My Web Filter Policy blockes sites categorised as Advertising and Web Analytics. My Application Control Policy also blocks Google.Ads and Google.Analytics. It should be noted that when I allow these applications Google Play still doesn't work with Full SSL Inspection enabled.My We

We're currently in the process of migrating our FortiManager and FortiAnalyzer VMs from one host to another. We've thoroughly verified the configuration migration from the old instances, but we have some uncertainties regarding the licensing aspect of this transition.Specifically, we’re concerned about the implications of reactivating our existing licenses on the new VMs. Does Fortinet provide a grace period that allows us to run both the old and new VMs simultaneously during the transition? We want to ensure that we can safely shut down the old VMs without encountering any licensing issues.Any insights or suggestions on this process would be greatly appreciated. Thank you!

Hello, I am encountering an issue with my configuration that I am unable to resolve. I have two sites connected with VXLAN over IPSEC. On each of my sites, I have two VLANs (VLAN 10 and VLAN 20).  Here are my tests: SITE A / VLAN 10 successfully pings SITE B / VLAN 10SITE A / VLAN 20 successfully pings SITE B / VLAN 20SITE A / VLAN 10 successfully pings SITE A / VLAN 20SITE A / VLAN 20 successfully pings SITE A / VLAN 10SITE B / VLAN 10 successfully pings SITE A / VLAN 10SITE B / VLAN 20 successfully pings SITE A / VLAN 20SITE B / VLAN 10 successfully pings SITE B / VLAN 20SITE B / VLAN 20 successfully pings SITE B / VLAN 10However, SITE A / VLAN 10 cannot ping SITE B / VLAN 20SITE A / VLAN 20 cannot ping SITE B / VLAN 10SITE B / VLAN 10 cannot ping SITE A / VLAN 20SITE B / VLAN 20 cannot ping SITE A / VLAN 10Do you have any idea why? Thanks for your help!

HelloWe manage all fortigates from FortiManager, I want to prevent or forbid any changes directly on Fortigate, changes need to be done from fortimanager. How can I reach this goal ? Any suggestion will be welcome.Thanks

HiOn a Fortigate 200E running 7.4.7, I see interface errors when watching the boot from the console after restoring a saved config. All interfaces still work, but I want to eliminate the errors. diagnose debug config-error-log read>>> "edit" "byod wifi" @ 35095:system.interface.Temp Mail DMZ 2:command parse error (error -61)>>> "next" @ 35097:system.interface.Temp Mail DMZ 2:failed command (error 1)>>> "edit" "PIE" @ 35146:system.interface.LANTrunk:command parse error (error -61)>>> "next" @ 35148:system.interface.LANTrunk:failed command (error 1) I'll be removing the spaces from interface names during the edit. How do I interpret these errors? For example, the first one. Nowhere in the config does "byod wifi" interact with "Temp Mail DMZ 2". There's no config involving both of those interfaces. They don't exist next to each other anywhere in the config, so there's no missing "next" that would make them run-on in the config.The only ov

Hi,  I am deploying 2 FortiSwitch 3032E as core/Tier1 and Multiple FortiSwitch 2048F as distribution/Tier2. 3032E are now manage by FortiGate 3701F, when I am adding the 2048F I connect the port using 100G transceiver to 3032E. There was no LED light indicating that is not physically connected correct? And on the FortiGate side, I cannot see the serial of the FortiSwitch. What do I need to do next. thanks.

Hello, I would like to know if there is a way to set a Signal Strength level so that when a WiFi client reaches that level, it tries to roam on the AP.Example, I would like whenever the client reaches -66dBm, try to switch to an AP with a better signal, lower than -66dBm.Is such a configuration possible?

Hello, due to a domain change/migration I have to "clone" over 600 firewall adress objects (Type FQDN), keeping them in their policies and also their firewall address groups, as well as also the original object, so that we have them both active until the migration period is over and then we can delete the old ones. (e.g. srv-01.prod.domain.net -> srv-01.test.domain.net) In the past, when we had about up to 30 objects or so, we solved this by the "find and replace" function on the FortiManager GUI, as it automatically also considers the objects membership in groups and policies and you were able to replace the object with itself and the new, modified one. I am looking for ideas how to automate this process, so I don't have to click and replace hundrets of objects manually. Are there any suggestions how to do this?  Thanks a lot in advance.

I may have to edit the Subject once I have a better idea of what is going on. We successfully configured our IPSec Dial-up tunnel last week and we were able to successfully login and get assigned IP addresses. Now today I tried to login and I put in my Entra credentials, and it says it successfully logged me in but nothing happens. I just see the VPN Name and the Disconnect button. No metrics or my assigned IP address like before. I verified that I did not get assigned an IP address and the tunnel is not showing up. My coworker proceeds to sign-in and it works just fine.I ran the debugger and compared my connection to his and I found only one difference between our logins. After we get the response back from Entra his logs show the following:    __saml_auth_cache_push-New auth cache entry is created, user='{randomNumbersSet01}', saml_user='{username}', expires=1756916400, SAML_server='{SamlServerName}' Now mine is a little different:    __saml_au

Does anyone know how to disable ICMP timestamp replies from FortiAPs? My FortiAPs are connected to my LAN, and I have Fortiswitches. Polices do not seem to work - my guess is because the traffic is being routed by the switches and not going through the firewall? 

Hi, I have 2 Q regarding to Fortigate A/P. Now I have my 901 FG with a dedicated port for HA. I will make this port for Heartbeat. And I do have 2 fiber links as well for HA with normal ports. Is the best practice to keep the HA default port for heartbeat sync, and use the 2 extra fiber ports for session sync only? Or there is no way to segregate between heartbeat and session synchronization, so I have to keep all of them in the heartbeat option? The second question is, I have enabled the HA with no license on my firewalls when I want to add the license for my firewalls. Is the correct way to remove HA back to standalone mode and then enable the license on each box and return to A/P mode? thanks 

hi,i'm trying to document our FG. how do i view/check the configured pre-shared key string?can this be viewed in the GUI or via CLI only? where in the GUI or what command to use?

hi,i just moved a new VDOM to a fortigate and observing CPU and other stats. i noticed the 'global' VDOM spikes to above 90% over 10 min period.but it looks 'normal' if it's over 24 hour period.   tried to run some CLI commands as below. can someone advise if what's the "nice" 90% plus meaning here?i also observe "voipd" with a number "95.2" beside it. what does this also mean? is this a voip DOS attack?what other CLI commands can i use to trace other high CPU talker?do i need to go each VDOM and check CPU? (global) # get system performance statusCPU states: 3% user 3% system 0% nice 92% idle 0% iowait 0% irq 2% softirqCPU0 states: 0% user 0% system 0% nice 97% idle 0% iowait 0% irq 3% softirqCPU1 states: 8% user 7% system 0% nice 82% idle 0% iowait 1% irq 2% softirqCPU2 states: 40% user 39% system 0% nice 18% idle 0% iowait 1% irq 2% softirqCPU3 states: 0% user 0% system 0% nice 97% idle 0% iowait 0% irq 3% softirqCPU4 states: 0% user 0% system

Hello, I am trying to find a way to make an auto stitch to trigger and work when a user disconects or connects on a remote ipsec tunnel and send an email. I have it set up but cant see emails comming. Any ideas?  FGT60F # config system automation-stitchFGT60F(automation-stitch) # edit "VPNIPSEC"FGT60F (VPNIPSEC) # showconfig system automation-stitchedit "VPNIPSEC"set trigger "IPSEC VPN UP"config actionsedit 1set action "Email Notification"set required enablenextendnextendFGT60F (VPNIPSEC) #  config system automation-triggerFGT60F (automation-trigger) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-triggeredit "VPNIPSEC"nextend config system automation-actionFGT60F (automation-action) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-actionedit "VPNIPSEC"nextend

HiI cleaned all the website files and update the wordpress and the plugin pleas remove the website go-rilla.mobi from the list  Thank you     

We have an issue with a FortiAP U421E. It fails to connect to the fortigate because of a SN missmatch. ap-sn-mismatchJOIN REQ from WTP is denied due to SN mismatchAP's SN in cert is PU421E3X16xxxxxx, while SN in JOIN-REQ is PU421E3X16yyyyyy. Same behaviour on factory defaults with initial firmware. Has anyone suggestions how to solve the problem?

 Interface error, how to configure update time synchronizationFortiGate time is out of sync.   

Hello. I'd like to add a new entry for the authentication/portal mapping section (VPN->SSL-VPN Settings). Do I need to get the current ssl settings before adding a new entry? Or can I just send a PUT request where the authentication/portal mapping section has only one item for the entry I want to add?Thanks

RequirementThe enforcement is working correctly on laptops with both the web filter and DNS filter enabled. However, on mobile devices, the Chrome browser loads the homepage initially, but subsequent pages are blocked. The expected behavior is that SafeSearch should be enforced right from the homepage, ensuring that even the homepage loads through the enforced SafeSearch..Use case: College, SchoolStep-1Create the loopback interface for enforcing DNS.Note: The IP address should not be configured anywhere else.Step 2: Enable the DNS Database under Feature Visibility.Step 3: Block the P**ography category in the Web Filter and enable SafeSearch.Step 4: Block the P**ography category in the DNS Filter as well, and enable Enforce SafeSearch.Step 5: For the DNS-Loopback interface, enable the DNS Filter and set the mode to Recursive.Step 6: Create the DNS entry for SafeSearch-Google.I.II.CLI commands for creating the DNS entry to enforce SafeSearchconfig system dns-database    ed

Hi, We have set up an IPsec VPN tunnel between our on-premises FortiGate firewall and Alibaba Cloud. Both Phase 1 and Phase 2 show as "up," and the tunnel is passing traffic. However, we are observing: Severe slowness when accessing web applications hosted on Alibaba Cloud.Intermittent ping failures (frequent "Request Timed Out" errors) across the tunnel.Troubleshooting Done So Far:Verified that encryption/authentication settings match on both ends.Confirmed routing (static/Policy-Based) and firewall policies are correctly configuredMay I know if there are any factors that could contribute to this issue?Any insights or best practices to resolve this would be greatly appreciated! Thanks.

In https://docs.fortinet.com/document/forticlient/7.2.1/macos-release-notes/223986/special-notices it is mentioned that Ikev2 is not supported on forticlient but in https://docs.fortinet.com/document/forticlient/7.2.0/new-features/374894/support-for-ikev2-for-forticlient-macos-7-2-3 it does mention support, (and it doesn't mention that it is not available anymore)But when I use Forticlient version 7.2.4 or 7.4.0 it still has the Ikev2 option greyed out for IPSec VPN.Does anyone know if it is still not avaiable or If there is something that I need to change?

hello,are there any best practices to make FortiClient (vpn ssl) more reliable to weak connectivity (like 4G on trains)?I'd like to increase the timeout before it disconnect from the fortigate when there are connectivity issues.PS why DTLS (which may help) is not enable by default on the FortiClient SSL VPN?