Fortinet Community

 Hi everyone, I've been struggling to get an IPv6 address from my ISP (KPN in The Netherlands). Despite following several tutorials on how to set this up, I haven't been able to receive an IPv6 address over the PPPoE tunnel interface. However, I can successfully obtain an IPv4 address on the same interface. Here are the tutorials I used as guides:KPN Community Forum - FortiGate 60F SetupNetwork Dynamics - IPv6 SetupMy SetupRouter: FortiGate 60F (7.2.10)Switch: FortiSwitch 108F-FPOE (connected via FortiLink)Access Points: Two FortiAP 231FWAN Interfaces:WAN1 (connected to KPN ISP)WAN2 (connected to a second ISP)Both WAN1 and WAN2 are configured as members of an SD-WAN zone.Current ConfigurationFor simplicity, I’ve removed WAN1 from the SD-WAN zone for testing. This ensures SD-WAN settings don’t interfere with IPv6 troubleshooting. Physical Interface (WAN1):  config system interface edit "wan1" set vdom "root" set type physical set

I have a zone on the FortiGate named "VPN Zone", which includes both SSL-VPN and IPsec.We are now testing a ZTNA appliance that is connected via the X1 interface -> VLAN 101.I added the VLAN 101 interface to the existing "VPN Zone" and included its subnet in the existing rules.As a result, LAN clients can communicate with devices inside VLAN 101. However, devices inside VLAN 101 are being blocked by the FortiGate from accessing LAN.FortiAnalyzer reports that the traffic is blocked by policy ID 0, showing the source interface as "VLAN 101". This makes sense, since there are no explicit policies referencing that interface, only the zone.and idea why the existing permit rules for the zone do not trigger for VLAN 101 outgoing? but incomming is fine?FG200F v7.4.8

Hello,I have two VLANs connected via FortiGate 40F:VLAN 40: phones, PBX, and PCsVLAN 10: serversThe network is working fine in general. However, after replacing two old phones with new Grand stream models GRP2602P, I started facing the following issue:Scenario 1: When I call an old phone from a new phone, only I can hear the audio, but the other side cannot hear me.Scenario 2: When the old phone calls the new phone, both sides can hear each other without any problem.Scenario 3: When I call between the two new phones, everything works fine (two-way audio).Scenario 3: when I Make call for outside calls everything fineSo the issue only happens when calling from a new phone to an old phone.Could you please advise what might be causing this problem and how to solve it?some people say this problem from FortiGateThank you.

I have a FortiAP-221E that appears to still be bound to FortiCloud. and I don't have access to the FortiCloud account.When I press and hold the reset button, the device only reboots instead of performing a factory reset.I connected to the console CLI and I can run commands such as cfg -x—but the device only reboots.My goal is to remove this FortiAP from FortiCloud and manage it locally from my FortiGate controller.

Hi, I'm experimenting a new weird issue with an IPSEC dialup VPN created on a FortiGate 100F with FortiOS 7.6.4. The thing is that I can reach a connection with the FortiClient v7.4.3.1790, and my connection is able to send Bytes but it's not receiving any Bytes. I've been trying several configuration using the IKEv1 and IKEv2, and unfortunately, using IKEv2 is not connecting and using IKEv1 I was able to have a connection but only is sending Bytes and not receiving. Any idea or solution will be are welcome... One more thing, I already reviewed the article ID 352403 posted by Stephen_G, about a similar situation but, my configuration of the FortiClient is the same to the configuration suggested in that article, and it's not working... Please see the snapshots below... Thank you in advance for all your help...

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8).  I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine  certificates.  We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side? I've been spinning my wheels on this for awhile now.  Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2?  When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit. Thanks! 

Dear All, I would like to check on the options available to restrict devices connecting through the Mobile Hotspot feature in Windows OS at the gateway level. In an AD environment, this can be controlled using Group Policy. However, in a non-AD environment, apart from relying on an endpoint protection tool, what other options can we use to manage this? FortiGate FortiNAC FortiClient FortiSwitch 

HelloWhen updating FortiGate to version 7.4.8, I noticed that the performance history of a Performance SLA was reduced to just one minute. Previously (in version 7.0.13), the SLA performance graph showed a 10-minute history. Is it possible to increase this time to 10 minutes in FortiGate 7.4.8? If not, what are my alternatives? 

Hello Team, I created a new module, saved it, then clicked the Publish All Modules button. After waiting a while, it reopened and didn't show any errors on the screen. However, I couldn't find the module anywhere. My account has admin privileges. When I checked the account's audit logs, I saw the “Publish Failed” error. {“error”: “Command `doctrine:schema:update --em=default --force` finished with code: 20”,“status”: “Failure”,“message”: []} How can I fix this?Best regards.

hi everyone,running fortios 7.4 on fortigate 70g with sd-wan across three wans (all have fixed external IPs):isp1: cable internet (docsis, static config, no dhcp passthrough)isp2 & isp3: two separate 5g connections (fixed external IPs, but dhcp passthrough to the firewall, ip/netmask/gateway set automatically)the problem:isp2 & isp3 work perfectly — they show dynamic 0.0.0.0/0 routes and are fully used by sd-wan.isp1 needs manual ip/netmask and a static route. it shows “up” in sd-wan but carries no traffic unless both 5g connections are disabled.routing table shows isp2/isp3 dynamic routes at the top, while isp1 sits static and is ignored.isp1 says enabling dhcp passthrough on their docsis modem is too much work and would break their provisioning, so they won’t change it.questions:any supported way to make sd-wan handle static-only wan links?any cli tricks to make sd-wan treat that static route like a dhcp one?would upgrading to 7.6 help, or is this just a hard limitation?need

Dear All,I tried a lot but unable to register Fortigate with Fortimanager. Please note that I am using Fortigate Version: FortiGate-VM64-KVM v7.0.3,build0237,211207 (GA) and Fortimanager Version : v7.2.10-build1682 250211 (GA). FMG ========================================Fortigate to Fortimanager reachability is fine.FMG # execute ping 192.168.10.1PING 192.168.10.1 (192.168.10.1): 56 data bytes64 bytes from 192.168.10.1: seq=0 ttl=255 time=2.953 ms64 bytes from 192.168.10.1: seq=1 ttl=255 time=3.292 ms64 bytes from 192.168.10.1: seq=2 ttl=255 time=3.024 ms64 bytes from 192.168.10.1: seq=3 ttl=255 time=2.750 ms--- 192.168.10.1 ping statistics ---4 packets transmitted, 4 packets received, 0% packet lossround-trip min/avg/max = 2.750/3.004/3.292 msFMG #FMG # config system global(global)# showconfig system globalset enc-algorithm lowset hostname "FMG"set ssl-protocol tlsv1.0set usg enableend(global)# =========================================================== Fortigate=

i have firewall fortigate 201F version 7.6.3 cannot find SSL VPN configuration tried t

we have implemented a policy in the application filter to block the mobile category and applied application signature android block . However, access is still occurring from mobile devices. please help me resolve th issue 

 Hi,In FortiGate I blocked SSL traffic from outside the EU using local-in-policy. Now I would like to allow temporary access for a single AD user only, without enabling it for others.What is the best way to implement such an exception? Which solution is supported by FortiGate?Thanks in advance for your guidance! 

Hello,first time poster here so have mercy :) I am new to Fortinet but a long time security / networking administrator. I recently acquired a FortiGate 40F, FortiSwitch 108F and a FortiAP 221 to test it out and learn about Fortinet.  I am running into a stupid problem that I can't understand:  I would like to create VLANs on both FortiSwitch and FortiGate so that FortiGate is the gateway and DHCP-server on these VLAN networks. Furthermore, I would like to use the VLANs on the FortiSwitch so that I can use multiple ports on the switch on these VLANs, say port 1-4 has native VLAN accounting_VLAN and port 5-8 has VLAN printer_vlan, etc. I would also like to use 1 or more ports on the FortiGate on these VLANs if needed. But this does not seem to be possible, to create a VLAN and then tag the VLAN on both FortiGate and FortiSwtich ports? From what I can see now, if using VLANs on the FortiSwitch, I can't use these VLANs on the FortiGate ports and use the F

Hi,We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully. We are having a scenario.In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict. We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier. I request the seniors to please help out on this. Thanks

Hi Fortianalyzer VM running on v7.0.3 facing issue related to analytics logs exceeding the configured disk quota. It has been identified that one of our ADOM's is using more disk space for analytics usage than configured. In the Data policy - Keep Logs for Analytics is 60 days & Keep Logs for Archive is 365 DAys. I have enable alert and Delete When Usage Reaches 80%. How can I solve the following case, returning the analytics logs to the maximum configured size?

Hey guys. I've been having a problem with logs disappearing since I updated firmware version 7.0.2 to 7.6.2 for a period longer than a week. When a week of log collection "Incidents & Events > Event Monitor" is completed, the date of the first occurrence returns to 3 days ago, and we have much more logs stored than 3 days ago. I already ran the command to rewrite the sql, I got the logs from February 28, 2025 to March 7, 2025 (exactly one week). I would like to know if there is any way to completely restore from the beginning (I believe it is around May 2022) all the logs, including those from the Event Monitor session and for the logs to remain permanent. Below are some images of the problem.This is the collection after I ran the sql library rewrite command which lasted for 9 days, as in the image below.  Today (March 7, 2025), the problem with showing the logs appeared again and you can only see the events from 3 days ago as in the image 

how do i export the forti token users list in my fortigate?i have about 180 users in the list

Has anyone every migrated a VM based FortiAnalyzer from VMware based VM to something like proxmox? Can you install fresh on proxmox then migrate the data? Can I just do the VM migration and then figure out how to load necessary drivers? I promised I have searched a little and all I find is things about how to install a VM.

Home lab - secondary WAN (set to failover) changes IP address every month or two and Fortigate is dropping the connection even though set to DHCP. If I manually trigger it to renew it does instantly....shouldn't it do this without prompting? I only realize when I see that it's down. Today it may have caused some issues even though the main stronger Wan stayed up throughout.

Hello team, In our company we have two different environments behind two different Fortigates (both on 7.2).Both environments are reachable via SSL VPN using Forticlient. Is there a way to create an installer or deployable package (either .exe or .msi) that already has both Connections configured? So that at first installation the user already has in the drop-down menu both VPN Connections? We do not have EMS license, just firewall. thanks in advanceF.

Hi Everyone.I was looking for this problem involving the "1Password browser extension".Is there a function/method for Forticlient/FortiEMS protected endpoint to catch or block this kind of "Clickjacking"? Thanks in advance.Max 

HI all we have developed a tool using rest-APi for creating documentation on the configuration of a FortiGate. My question is has anyone else done this and if so what did you use. we used Python and API calls to populate a word document the details.  

Solved.