Fortinet Community

I noticed that the firewall logs did not show the up-to-date hostname of the user's device. However, by running the command:execute dhcp lease listI was able to retrieve the current DHCP leases, which included the correct hostname information for the device. This confirms that the DHCP lease information is current, even though the firewall logs do not reflect the updated hostname. Additionally, the hostname shown in the DHCP lease list differs from the one recorded in the firewall logs.How can I update the device's hostname in the firewall logs without causing any disruptions? I'm using a FortiGate 81F running firmware version v6.4.16.

Can we send the log to syslog only for specific category? Example send log to syslog for '**bleep**' categories.

HiI'm asking because I have a question when I do okta certification at Fortigate. Diagram is ScenarioWhen users on INT side access SRV, they must obtain okta certification to access it. Policy1.INT > SRVS : SSO, User IPD : Server IP 2.INT >  EXTS : User IPD : ALL This way, I can access the server after being authenticated. However, ALL is not available in Destination.So I made okta FQDN and trial.* as destinations, but the authentication screen doesn't show up. Do you know how to set the destination for Okta authentication? Also, I would like to know what traffic flow okta authentication is done when users access the server. Thank you.       

I know Fortinet has their own EDR, but we are a CS shop and like it. I have heard there is some integrations with CS and curious how good it is and if there will be a tighter integration down the road?Using the CS client but having it talking and working with the FG firewall would be a nice solution IMO. A partnership would be good.

I have a Fortinet device that has been decommissioned by my company. I use it at home for lab work and study, but the licenses have expired, even for firmware updates. Is it possible that there is no home lab evaluation license for those who use it outside of a professional enterprise environment? I would be willing to pay for it, but only at a reasonable cost.Thanks

We are new to the FortiVoice community and so far everything seems to be working fine except our CallerID. We have looked at the Caller ID modification hierarchy, and to my understanding, the Caller ID that is specified in a user's extension page should be the highest priority. For us, however, this doesn't work. Despite having something entered in that field, it continues to show the Caller ID being sent by the Survivability Gateway. As far as I can tell, nothing changes what called ID is being sent. It is always what is listed on each site's Survivability Gateway. I even attempted to set a DID Outbound Number Map (which according to the hierarchy, should be high priority than the Survivability Gateway) and it still overrode that with the information on the Survivability Gateway.  Any help on what may be causing this would be very helpful.. 

Hi EMS adminsI wonder if anyone noticed if FortiClient could detect the latest critical vulnerabilities that affect driver and firmware of Dell laptops with Broadcom BCM5820X series chips, I mean all of these vulnerabilities:CVE-2025-24311, CVE-2025-25215, CVE-2025-24922, CVE-2025-25050, and CVE-2025-24919.More information here:https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053If your FortiClient has detected them (or not), then your feedback would be appreciated.

Hi all,I was wondering if this is just a local thing, or that starting from this year, you all need to pay for Lab licenses with one year validity? Starting this year it seems to be impossible to get those licenses via a partner SE? We’ve been using them for 5 years and could basically ask for everything that’s a virtual appliance. You cannot get any support on these appliances, but that’s not really an issue. It’s gaining experience before heading into production that counted the most. What are your experiences?

Hello All,I’m working on a case and would like your input on the best approach to resolve it.The current setup is as follows:FortiSASE is configured as a spoke to a FortiGate “Hub” via SPA hub-and-spoke.Two branch FortiGates are connected to the Hub through IPsec VPN tunnels.My goal is to allow FortiClient users connected to the FortiSASE to access resources located behind both branch FortiGates.Do you have any recommendations or best practices on how to implement this? 

HiI'm working on a new design and I need to know if this is possible or not.Currently, we have 2 server rooms in separate buildings. In each location we have a core switch with a L3 routed connection between them. We have stretched vlans between the rooms, using VRRP on the core switches. This allows us to vmotion VM from roomA to roomB, without changing IP details. Each of the server vlans are using the VRRP ID from the switches as their gateway. We also have a Fortgate HA cluster in A-P mode. The active member is in roomA with the passive member in roomB. What I want to do is move the server vlans behind the firewall. Is this just a simple case of moving the VRRP configuration to the Fortigate cluster? How would this work, if there are servers on the same subnet/vlan in each room but there is a passive fortigate cluster member in the room? Or should the cluster be changed from A-P to A-A mode? I'm just trying to work out how the traffic would flow. ThanksRoy

Hello, First time here.Im seeing ZTNA being part of FortiOS 7.0 and beyond is free, I take this free version is quite basic and have its limitations. I would like to know what are the features in this free ZTNA version, like, what ports and protocols are supported, bandwidth limits? I do understand that a full ZTNA implementation would require the EMS license, right? Thanks

I've inherited a FortiGate 60F running 7.6.1. This is my first exposure to Fortigate as previously its's been Cisco Firepower and Palo Alto. It currently has an IPSEC VPN allowing users access to one of the internal interfaces. Auth is currently carried out via LDAP.  Is it possible to allow access to a different internal interface as the same time using a different credentials? If so how?

Hi, Our network consists of 26 access points, a combination of FAP431G, FAP433F and FAP431F, it is pretty much perfect since it was installed 6 months ago, accept for one odd issue. Every now and then one of the APs will decide it no longer like Apple devices at which point none of the ones we have (A brand new iPad and several generations of MacBook) simply won't connect, it's just happened again now with the tablet reporting an incorrect password. When this is happening if the devices are taken in range of another AP they work just fine and android / Windows devices continue to work just fine on the AP that is not working for the Macs. We have a number of SSID's, one using Radius authentication and the rest standard password auth and it effects both. A restart of the effected AP resolves the problem. Any ideas on what might be the cause of this are welcome. Thanks

Hello, I have a strange issue on FortiNAC-F. The switch is Aruba 6100 AOS-CX. The credentials are correct and the RADIUS configuration has been set up for example on two ports. It's working properly but the problem is that for ports that are not connected, it assigns the default VLAN 116 and its updating the config as "vlan access 116". However for ports that have performed "port-access-security" with MAC authentication or dot1x auth, it doesn't assign the "vlan access x" value. It stays as "vlan access 1" but the authentication has been successfully performed, meaning there isn't an issue here. However, unlike the default VLAN, it does not update the VLAN access ID on the port as 'vlan access x'. Then although the host connected to the port is listed in the MAC table, I cannot see it on FortiNAC. As you can see in the first screenshot the port is indeed active. When I disable and re-enable the port, for a while (even though 'vlan access 1' is still shown on the switch), I can see the

In the Fortinac self-guest register, user registration is done, facing issues like "Failed to detect a change in your network settings." So I fixed this issue by enabling RADIUS-COA on Fortigate. Fixed on Android, but this issue is still on the computer window machine. How to fix this issue. 

hello everyone. I have public domain (like https://www.x.ae) and I have local server (192.168.1.10)How can I create link between public domain and local server (I have FortiGate 40f)best regards 

I have a question:We have Fortigate on AWS, and the WAN IP is delivering the AWS public IP:  However, a LAN IP is configured on the Fortigate interface:  To set up an IPSEC VPN, I obviously have to point to “WAN IP” 54, but how will this communication work if the WAN interface has a LAN IP? Do I need to enable the secondary IP as 54..?

Hi, we migrated the firewall from checkpoint to fortinet last week. Now the users complained the browser Edge and Chrome were  automatically changed to other country language. It seems related to fortigate firewall config. Can you someone please advise the possible cause? thanks. 

Hi, Bit of a newbie, please be kind :) In our office, we use IPSec VPN for users to tunnel into our office network, to enable users to WFH. We have a few users who have reported that their FortiClient VPN clients (Windows 10 clients) credentials have started disappearing randomly. What I have narrowed down so far -1. Client attempts a connection, but cancels the attempt before the OTP is keyed in (or before the connection is completed)2. Client either shuts down or restarts their computer while the VPN connection was "ON".3. Client system's Windows update happens and it restarts the laptop or desktop even though the VPN was disconnected, the VPN client loses the user credentials.4. In a few random instances, it just disappears for no reason what-so-ever. We have upgraded all the clients to use FortiClient v7.0.2.0090 for connecting into the office, to reduce any cross-version compatibility issues.FortiClient installation path (C:\Program Files\FortiClient) and Forti

Hi,  I’m trying to use FortiAnalyzer (FAZ) to monitor IPsec tunnel down events in a large-scale SD-WAN.Event Handlers are in place and SMTP email alerts are configured, but I’m seeing:IPsec down events don’t always generate alerts.FAZ is at HQ. When the branch-to-HQ IPsec tunnel drops, FAZ doesn’t trigger the down alert. I usually get a “down + up” alert only after the tunnel comes back up, which isn’t useful.If this isn’t a valid use case for FAZ, what’s the recommended way to achieve timely alerts? Can FAZ generate a “device disconnected” or “device down” event when a FortiGate loses connectivity to FAZ? That would be more meaningful once the tunnels drop.

hi,i'm converting cisco ASA NAT and ACL config to FGT.can someone confirm if items below are correct?note i also used forticonverter, but it's not 100% accurate so doing this manually by hand. 1. if ACL has "ip" does it mean i allow "ALL_TCP" and "ALL_UDP" on the allowed services? access-list acl_outside extended permit ip any host 172.16.8.4 2. for static identity NAT, do i use the vip config "arp-reply disable" and "set type load-balance"?refer to link/recommendation.these are used to "un-NAT" or exclude NAT for  the public IP on the ASA. these are for downstream customer device/CPE configured with pubic IP/WAN. https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-creation-with-same-external-IP-and-mapped-IP/ta-p/190588 nat (inside,outside) source static 200.1.1.1 200.1.1.1 edit "nat_vip"set extip 200.1.1.1set mappedip 200.1.1.1set extintf "any"set arp-reply disableset type load-balance 3.for DNAT FW policy, do i use "LAN" for source i

Hello everybodyIn order to anticipate futur end of life of VPNSSL function, i try to make working VPN acces by IPSEC. Actually : 1 fortigate 100f1 wan fiber2 SSO connexions, for 2 different  Microsoft tenants2 VPN SSL REALMS2 SSL PORTAL in tunnel modeIn SSL Settings, i use SSL portal mapping  In forticlient 2 configurations, one per realms, both pointing to the same wan ip/port, juste realms is different. I would like to make the same configuration but with IPSEC.  nowday i make working IPSEC with SAML, but only for 1 tenant.following this guide : https://docs.fortinet.com/document/fortigate/7.4.7/administration-guide/951346/saml-based-authentication-for-forticlient-remote-access-dialup-ipsec-vpn-clients#IKEv2 I don't know how to do this, as my wan link is configured to listen and transfer to a single SSO configuration (saml server).config system global set auth-ike-saml-port <integer> endconfig system interface edit

Hello everyone,I have a FortiWiFi device where I’ve configured 3 SSIDs as follows:veone air: DHCP pool 192.168.10.10 – 192.168.10.254, operating in tunnel modeveone tech: DHCP pool 192.168.20.10 – 192.168.20.254, operating in tunnel modeveone voip: DHCP pool 192.168.30.10 – 192.168.30.254, operating in tunnel modeI’m able to connect to these SSIDs from my computer and complete my tasks without any problems.Today, I received a PBX server that needs to be connected to the FortiWiFi on the internal4 port. The server requires a static IP address 192.168.30.3/24, which belongs to the same subnet as the veone voip SSID’s DHCP pool. This setup should allow me to ping the PBX server from devices connected to the veone voip SSID.However, even though the PBX server is physically connected to the FortiGate’s internal4 port and assigned the static IP address manually, I am unable to ping it from the SSID network.Could someone please advise on how to configure the FortiWiFi or what changes I need t

Hello!  I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering).  One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:config firewall policy edit 117 set name "DNS Filter - Testing" set uuid b4130862-7872-51f0-6074-01eb3ef19f90 set srcintf .... set dstintf "virtual-wan-link" set action accept set srcaddr "laptop wifi" set dstaddr "all" set schedule "always" set service "DNS" set utm-status enable set inspection-mode proxy set dnsfilter-profile "DNS-Filter" set logtraffic all set nat enable next endWhen I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page.  Yet, when I do these

I'm trying to setup Forticlient VPN on an iPad Air 11.Currently I am using IPSEC VPN and Fortitoken for MFA.I have this working on Windows Laptops. the user opens the forticlient. enters the username and password; then clicks Connect.  it connects and asks for the fortitoken. User enters the token and then they are connected. Now i'm trying this on the iPad.  I installed the ForticlientVPN App.  Now I am trying to setup the connection profile.  I gave it a name, and I entered the Firewall IP Address, a port. and a User.After setting up the connection, I go back to the "VPN" screen. I click "VPN and the status is "Connecting"  but then it times out; goes back to "disconnected". I also used "Save Password" but it never asks for the password. There are some differences that i'm not sure where to setup.  For example the Firewall and Windows has a passphrase; iPad did not have a spot to enter this.  I don't know if i'm logging in correctly becaus