Fortinet Community

Is it possible to send traffic from Fortigate-1 InterVDOM to Fortigate-2 InterVDOM ?. I have LACP routed interface between Fortigate 1 and Fortigate 2, both firewalls can ping each other.Both are running FortiOS 7.4.11. Fortigate 1,all lan ports are LACP with multiple VLAN uplinks from switches. Fortigate 2,multiple interVDOM links created between rootVDOM and cust-1 to 3 VDOMs. interVDOM link interface for rootVDOM is configured as 0. customer VDOMs, static routing & firewall policies are created to respective interlink. root VDOM, static routing and firewall policies are created to Fortigate 1 and other VDOMs on this Fortigate. When i try pinging from customer VDOM to Fortigate-1 VDOMS, it keeps on looping on InterVDOM link of respective customer VDOM. In a nutshell, can’t reach between VDOMS of both Fortigates. I’m using “ethernet” instead of “ppp” and segments from APIPA range((169.254.0.0/16) for interVDOM link. What i’m trying to achieve, is it supported ?.  Am i missing any

I have a FortiGate 600F firewall, and I would like to configure logging and reporting so that all logs and reports remain within my organization's infrastructure and are not stored or processed outside the organization (e.g., in the cloud).What is the easiest and most appropriate solution to achieve this? Could you please explain the recommended approach and provide the implementation steps?Thank you.

I have already completed the configuration of my FortiGate firewall. However, I now need to enable and configure VDOMs and divide the firewall into multiple VDOMs.Will enabling and configuring VDOMs at this stage affect my existing firewall configuration, policies, interfaces, routes, or other settings? Or can this be done safely without impacting the current configuration?Are there any important considerations, best practices, or precautions that I should be aware of before enabling and configuring VDOMs?Thank you.

Has anyone seen this on a 6300F or 6500F? Looking for a cleaner fix than rebooting the FPC.Specifically wondering:1. Is this a known bug in 7.6.x with a fix in a later build?2. Is there any way to reclaim kernel slab memory without rebooting the FPC?We had an incident last night where FPC1 on our 6300F started dropping packets after about 16 days of uptime. The other 5 FPCs were completely fine. Rebooted FPC1 and everything came back to normal immediately. The log message we saw:fw_forward_handler line=788 msg="The system is in extreme-low-memory state. Drop the packet."When we dug into it with diag hardware sysinfo memory we found the problem — SUnreclaim on FPC1 had grown to 22GB while every other FPC was sitting at around 600MB. MemFree on FPC1 was down to 2%. At incident:FPC1 - SUnreclaim: 22,029,000 kB :warning: - MemFree: 692,292 kB (2%)FPC2 - SUnreclaim: 626,632 kB - MemFree: 21,902,960 kB (66%)FPC3 - SUnreclaim: 621,352 kB - MemFree: 21,918,292 kB (66%)FPC4 - SUnrecla

When the device connect to the network and if the persistent agent uninstalled then how we can block the access?I try simulate even the PA was uninstalled the device can connect and PA status showing green in the host.

Hi guys,I’ve been assigned a project where I need to migrate an existing Fortinet SD-WAN environment BGP on overlay to BPG on loopback, and I would like to gather feedback from anyone who has already dealt with a similar scenario because i did not find documentation about this process to be honest.The current setup consists of a dual-hub architecture where SD-WAN is implemented with BGP running directly over the overlay, using IPsec tunnel interfaces.All routing decisions are tightly coupled with SD-WAN members, and the entire environment is running FortiOS version 7.6.7 on both hubs and spokes.The target design is to move away from BGP on overlay and go to BGP on loopabck.Since I have not found much detailed documentation covering this specific migration path, I am trying to better understand the best approach before proceeding.In particular, I am interested in knowing whether it is feasible to have a parallel environment, i have 100 sites, so is it possibile to migrate a couple sites

How do I Configure server to reject HTTP/1.0 requests with "505 HTTP Version Not Supported" status and enforce minimum HTTP/1.1 protocol version?  I am using Fortigate 60f and I need to make necessary changes so that my Merchant Service PCI Compliance passes.  This is the last setup that I need and would like to make the fix with GUI, not CLI.  Any help would be great appreciated.

Hi EMS adminsOn EMS 7.4.3 I was able to configure NTP via OS config files (chrony).But on 7.4.4 there is no access to sh/bash and I can't find anywhere some command to set it up with emscli.In emscli cmd ref I just found this command but nothing said about setting time server.https://docs.fortinet.com/document/forticlient/7.4.4/ems-cli-reference/239339/execute-timeAny useful info would  e appreciated.

Greetings,I am trying to find relevant documentation on how to configure rds nps to communicate with forti authenticator as a 2fa method.Thank you in advance for your support.

Dear Technical Team,I am writing to report an issue regarding TightVNC connections established through FortiPAM when using a guest user account.Issue DescriptionWhen attempting to initiate a TightVNC session via FortiPAM using a configured guest user, the connection fails to establish. "connection has been gracefully closed".Normally we succeeded in web VNC. But we face issue while using TightVNC with guest user.Environment DetailsFortiPAM Version: 1.8Could you please assist in verifying if there are known bugs regarding guest user token lifetimes, or specific configuration policies required to allow guest access for VNC proxies in this firmware version?Looking forward to your guidance.Best regards,Dev Singh KhadayatSystem EngineerGrantha Networks Pvt Limited 

Hi Fortinet Community,I need some advice regarding FortiClient on a Linux server.EnvironmentI am using:OS: Ubuntu Server 24.04 without GUI Use case: connect to an external partner’s VPN The partner only supports clients using Fortinet VPN client Current package: FortiClient VPN-only 7.4 for Linux Previous package: I previously installed the paid FortiClient edition version 7.2 from this page: https://www.fortinet.com/support/product-downloads/linuxPreviously, I installed the paid FortiClient edition, but the VPN could no longer be used because there was no license. Since I only need VPN connectivity to the partner, I replaced it with the FortiClient VPN-only version. I currently connect using a command similar to:forticlient vpn connect vpn-profile -u users-vpn -p -w -a -sThe VPN connection can be established, but I am facing several issues and have some questions. QuestionsImpact from previously installed paid FortiClient Since I previously installed the paid FortiClient version 7.2,

Dear communityI likely have a very specific issue that might be completly "normal", I just want to make sure I have my bases covered... Situation:We have two clusters (four fortigates in total) in two different data centers (dc 1 and dc 2). About a dozen of VLANs are connected to both of these two clusters and we use VRRP spanned over these vlans to ensure usage of both clusters.The first three IPs in each vlan is ours - the .1 is the VRRP IP that is active on the master, .2 is the cluster on dc 1 and .3 is the cluster on dc 2. Now we run into asynchronus routing with a specific use case:There are location specific networks (one for dc 1 and one for dc 2) that access the respective local fortigate cluster and are allowed access to the attached vlans.If you happen to be in the location where the VRRP master is, then everything works. You can access the local fortigate cluster (which is vrrp master) and access the hosts in the vlans. No Problem.If you happen to be in the other

My organization has been using FortiClient free version for the past 5-6 years. I have been following the semi-official deprecation of the free version for the past few months. We have been using 7.4.3 now for a few weeks.Now FortiClient 8 has been released and I see no free version (what I assumed would be the case).Quantum Cryptography is becoming front and center in planning for our future with Google and Microsoft saying they should be fully or mostly using PQC by end of 2029. Naturally, FC 8 has PQC support.I wonder what everyone else who is or recently was using the FC free version is planning to do.I know we could get a license for on-prem EMS (but that would be another server to setup and maintain for our small team and there were just two high profile vulnerabilities in it just a couple months ago), or get Fortinet Hosted EMS (but not sure of the price with that), or drop FC altogether and go with a different VPN solution or SASE option etc.We have two dialup IPsec tunnels rig

Hi Fortinet Team, FortiClient EMS certificate not authorized..I am experiencing an issue connecting my FortiGate-90G to an On-Premise FortiClient EMS server via the Fabric Connector. The connection fails with certificate verification errors.Environment Details:FortiGate Model: FG-90G FortiGate and EMS Location: Both devices are in the same local subnet (192.168.2.x). DNS Setup: Configured via a Local DNS Database entry on the FortiGate, pointing the FQDN to the local EMS IP. Pings to the domain name resolve correctly. EMS Certificate: A valid Public Domain Certificate issued by RapidSSL / DigiCert (Domain: winxsfp.com). Symptoms & Errors Observed:The Fabric Connector GUI shows an "Untrusted Certificate" status. I have disabled strict common name checking using the set trust-ca-cn disable command under config endpoint-control fctems, but the issue persists. Running the verification command in the CLI results in the following error output: text FortiGate-90G # execute fctems verify 1

I had automatic updates turned on on my fortigate 60F. After Installation of OS 7.4.12 none of my VPN-Clients were able to login anymore. No idea why. Reverting to 7.4.11 resolved the problem. Does anyone have an idea what exactly caused the problem? I am not an fortigate expert but that a minor update to the os breaks a basic functionality, at least on my device, doesnt make me happy. First thing i learned was turning off automatic updates. But thats not a longterm strategy.  

Hello,we have upgraded our FortiClient EMS Cloud instance to 7.4.7 recently, and we can’t seem to upgrade our FortiClients, because we are unable to choose a FortiEDR engine.The dropdown menu to select an engine version for the FortiEDR feature has nothing to select. Even when dropping down to other FortiClient versions we can’t pick any FortiEDR engine version. The fabric connection between the FortiEDR Cloud and FortiClient EMS Cloud instances are up. The installer is for regular Windows Clients.The same problem goes for our customers FortiClients EMS Cloud instance. So it seems to be a problem with the 7.4.7 version of FortiClient EMS Cloud?Also, the docs page for FortiClient EMS is currently down with the code 500 internal server error. So we can’t even look up known issues for the new FortiClient EMS version.

we have recently deployed a new FAZ300G analyzer to replace our old 200D.For internet traffic for the analyzer, what are the recommended URL or internet service that is required/permitted for the analyzer to work properly.

I've got a user whose IPsec Remote Access VPN won't ping out when connected. It can access a file server via IP address (despite failing to ping it), but it's not able to get DNS, nor can I ping the DNS server or anything external.The FortiGate is a 90G on 7.4.12, using the latest FortiClient VPN Only version (7.4.3.8758). There are a dozen or so other users currently using the same VPN connection, and I've confirmed that the policies haven't changed.As soon as we disconnect VPN, normal web traffic resumes, including the ability to ping.Any ideas? 

 FortiToken Mobile (FTM) push notifications provide a convenient MFA experience, but many organizations want additional controls to ensure push authentication is only available from trusted network locations.A simple way to reduce the attack surface is to route FortiToken Mobile push traffic through a dedicated loopback interface and then control access using firewall policies. This allows administrators to limit where FTM push requests can originate, such as corporate Wi-Fi, internal LAN segments, or approved VPN networks. Step 1: Create a Loopback InterfaceCreate a loopback interface that will be used exclusively for FortiToken Mobile communication.config system interface edit "FTM-Loopback" set type loopback set ip 10.255.255.1/32 nextend Step 2: Configure the FTM Push ServerConfigure the FortiToken Mobile push service to use the loopback address.config system ftm-push set server-ip 10.255.255.1endThis forces FTM push traffic through a dedicated interface that

Trying to get FortiGate VM 7.6.7 registered and controlled by FortiMan VM 7.6.7Cert is used as part of the authentication, the serial number is expected to be in the cert as the CN, but its not  We can see this by using debugs   diagnose debug resetdiagnose debug enablediagnose debug application depmanager 0diagnose debug application depmanager 255diagnose debug enable  Clearly the serial number is required   { "id": 1, "result": [{ "status": { "code": 5, "message": "device serial number conflicted"}, "url": "start\/probe\/session"}]}We can get passed the serial number issue by creating a new cert  i found that i have to use this low key size of 512, anything higher wont be accepted   openssl req -x509 -newkey rsa:512 -nodes -keyout fmg_tunnel.key -out fmg_tunnel.crt -days 365 -subj "/CN=MYSERIAL/O=Fortinet/OU=Lab"openssl pkcs12 -export -legacy -out fmg_tunnel.pfx -inkey fmg_tunnel.key -in fmg_tunnel.crt and now the issue is different  { "client": "\/bin\/dvmcmd:5115", "id": 2, "method

FortiAuthenticator Cloud – End of Order Announcements                                            2nd July 2026 It has been announced on support website (https://support.fortinet.com) that FortiAuthenticator Cloud (formally known as FortiTrust) has come to End Of Order (EOO) as per date below. Customers are encouraged to move to FortiIdentity Cloud (FIC) for SaaS-based identity solution. Replacement SKUs are as follows: Current SKU Description Replacement SKU Description FC2-10-ACCLD-511-02-DD Cloud-managed Identity User Subscription including 24x7 FortiCare for 100-499 Users. FC1-10-IDCLD-445-02-DD Annual, per-user, cloud-managed FortiIdentity subscription for 25-499 users (includes 125 SMS credits per user and FortiCare Premium Support per year). FC3-10-ACCLD-511-02-DD Cloud-managed Identity User Subscription including 24x7 FortiCare for 500-1,999 Users. FC2-10-IDCLD-445-02-DD Annual, per-user, clo

Environment:FortiManager 7.6.1 FortiGate-VM64-KVM, FortiOS 7.2.0 build1157, Evaluation License (15-day) ADOM version 7.2Issue:When installing a Policy Package from FortiManager to a managed FortiGate, the install fails with:  post_vdom copy error::(errcode)3 - max entry. object: firewall policy. detail: global limit. solution: limit is 3This strongly implies a hard cap of 3 firewall policies enforced during the FMG→device install process.However, this is demonstrably NOT a device-side limitation. Running show firewall policy directly on the same FortiGate via console/SSH shows 7 policies already present and fully functional, created locally without any issue:  [paste your 7-policy output here]This proves the FortiGate itself accepts well more than 3 policies. The limit is only encountered when FortiManager performs the install — meaning the restriction lives somewhere in FortiManager's install/validation logic (or possibly an ADOM/device-DB setting), not in the FortiGate's own firewall

Hello community, Im once again dealing with FortiNAC, as my company is been back and forwards with it.For example using Cisco ISE, we configure 802.1x on the switches, Cisco ISE validates certificate or username (if im not mistaken) and thats usually the way to go with ISE.My question is: whats the equivalent of what I mentioned for ISE on FortiNAC? Does it support 802.1x at all in the same way ISE does? And if it does, is that the common way to go with FortiNAC. If not, well, whats the common way to go?I got that FortiNAC support a lot of protocols, but thats actually what confuses me, it supports so many stuff that I don't know what to do or whats normally done out there in most scenarios (even though no environments are the same :)I guess Im asking for a practical aspect, I would like to know how are the most FortiNACs deployed out there, real case scenario in this aspect based on real world experience deploying/managing this monster.

I have an issue with Fortiswitches 2048 and a Cisco CBS 350 switch. I had in the Fortinet SFP Finisar and in the Cisco i had a multimode SFP Cisco. The link of the two switches is down and i don’t know why. I replaced the Finisar module with Cisco and the result was the same. Also, i changed the speed from Fortiswitch to 1000 and i didn’t see any change.Inside of the interface of Cisco , there isn’t choice for auto negotiation. The config is trunk with specific vlan and native another vlan from 1. Also, i change the STP to RSTP without any result and i don’t believe the problem was with spanning tree because the the issue is in Layer 1 and not Layer 2. The output of the tranceiver of finisar in Fortiswitch is the below:StatusOKTemperature27.109375 CVoltage3.319000005722046 voltsOptions0x000F: TX_DISABLE, TX_FAULT, RX_LOSS, TX_POWER_LEVEL1Options Status0x0008: TX_POWER_LEVEL1Alarm Flags0x0000Warning Flags0x0000Laser Bias5.624000072479248 mAmpsTransmit Power-4.974363327026367 dBmReceive

We required otp through sms and authentication code through Google authenticator or Microsoft authenticator. Pls evaluate and confirmin scnerio of fortiauthenticator as saml idp and forticlient ems and saml sp please confirm