Fortinet Community

Hello Experts, We have aaa.bbb.209.136/28 global IP address range by provider. The connection is PPPoE.As wan1 IP address, aaa.bbb.209.142 is set at unnumbered IP. At DMZ, aaa.bbb.209.137/28 is set.Everything works at Fortigate 60E. Recently, we bought Fortigate 90G to replace it with.However, the same IP addresses cannot be configured at Fortigate 90G.When we try to set aaa.bbb.209.137/28 for DMZ, an error message such as"overlapped network with wan1" is shown. How can we solve this situation?For information, aaa.bbb.209.142 can be configured at 90G. Thanks in advance and best regards, 

Hi,I’m experiencing an intermittent internet drop issue with my FortiGate 40F.Here’s the situation:- The ISP says they are not receiving any packets from my firewall when the issue occurs.- The WAN port shows link/ACT lights ON and stable.- When I connect my laptop directly to the upstream MikroTik RB3011UiAS-RM switch, I get internet without drops, so the ISP link and MikroTik appear to be fine.- The FortiGate is connected to the MikroTik RB3011UiAS-RM, which does NAT/routing.- This happens about once a day or every other day. It usually starts working again within 5–10 minutes, but today it did not recover on its own  I had to restart the firewall for it to work again.I appreciate any guidance you can provide.Thank you.   

I have an issue that I would like some advice for. I have 2 sites with Fortigate 40F's and both sites are on a Comcast 1.25 Gpbs x 300 Mpbs circuit.I have built an IPSec between sites and initially it seemed that the speeds were around 40 Mb (measured using iPerf) but they consistently keep dropping to unworkable speeds of less than 1 Mb. Comcast uses some product called "Security Edge" but I have turned it off on both sites. I am trying to work with Comcast to troubleshoot this issue but as expected, the service desk does not really seem to understand what a site to site is.. and speedtests on the network and connected devices and raw speed tests show proper speeds so Comcast blames the issue on the Fortigates and a misconfig on our end. The tunnels are super simple, Ike 2, aes and sha 256 and diffie 14. No inspection or any other things that could slow the tunnel down. Does anyone have an idea as to what could be causing this or what we can do to solve this issue? I don't e

I would really like to get a remote access VPN to my Fortigate network which is connected via Starlink, has anyone been able to make this work? I have a Fortigate 60F running version 7.2.11 Supposedly Starlink CG-NAT network supports SSL VPN (I have read it does not support IPSEC VPN) but I have no luck. I have not found an option for "NAT Traversal" in the Fortigate SSL VPN config anywhere. I have done a packet sniffing session on the WAN interface of the Fortigate and it shows no traffic coming from my public IP while trying to ping or connect via SSL VPN. I have confirmed with support that my SSL VPN config is correct and I am successfully using identical config at sites with Comcast internet connection.

Hello, can you please help me to configure an interface based routing? I understand this to mean the following:  The entire traffic that is to be sent to a specific IP address is sent to a specific interface without any information from a gateway.  Example: 192.168.99.25/32 should be sent completely and without specifying a gateway to the interface port3.  Unfortunately, I have not been able to find this in the routing configuration so far, or I have always had to specify a gateway. Even if no gateway was specified, 0.0.0.0 was entered and thus routed to the default gateway.  I'm using version 7.6.3 Yours sincerely, Markus

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method. We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP

Hello, I lost the software installer for my Fortivoice 100, I can't find where to download. please let me know if there is some link to download the software. Thanks!

Hi there,I've been using FortiClient 7.2.8 so far and just rolled out version 7.2.10 as an update via FortiClient EMS on two test PCs.The clients are running Windows 11 24H2.On both machines, I’m seeing the same issue: after updating from 7.2.8 to 7.2.10, the reboot doesn’t happen. The "Restart now" window pops up, but clicking it doesn’t do anything.After manually restarting, the installation seems to be fine.I already noticed this with 7.2.8 but didn’t think much of it – now the same thing is happening again.Could this be a bug in these versions?Anyone got an idea how to fix this?Back in 7.2.7, everything worked fine...The main issue is that after the update, the user has to restart the PC manually – which probably won’t happen during the day. So the machines remain unprotected in the meantime!

I'd like to ask a question Estimated bandwidth , what's the difference between kbps Upstream and kbps Downstream ? Upstream would be input and Downstream would be output ? in it I put example 80.0Mbps Upstream and limit of my link send message ? would that be it ? 

Dear Colleagues,Our Infrastructure currently utilizes fortigate 60F for network security. We keep receiving waves of phising email directed at individual staff and our general group emailing list. I have had to try antispam feauture of the fortigate 60F firewall to salvage the situation since the email service provider have not been responsive. Unfortunately with all efforts made we still keep getting these spam emails. Its show either i am not doing something right with configurations or its cannot be done unless from ISP side since email server hosted in their datacenter. Kindly advice. Warmest Regards.Ibrahim.

Hi FortiGate Techies, 1). I want know how to check the interfaces bandwidth utilization more than a week and in firewall it is showing only for 1 Week. i want 1 year utilization for the particular interfaces. by using Forti Analyzer also we tried to take the reports but in Forti Analyzer also it is generating total device bandwidth utilization not for particular interface.2). And how to check the how much speed is going on my particular interface per second and this reports also I required for 1 year.  FortiGate  FortiAnalyzer  FortiClient 

Hi, Is it possible to set up FortiGate to authenticate macOS native IPsec VPN clients through Active Directory, without requiring the Macs to be joined to the domain?  Our goal is to remove local user accounts from FortiGate and transition macOS users to centralized authentication using LDAP, just like we do for Windows users.  FortiGate 

I have set a couple of FortiGate VPN connections to AWS in the past and it was with two individual IPsec VPN tunnels with two static routes that had different administrative distances. Each IPsec tunnel required me to enter a /30 CIDR IP Address rather than 0.0.0.0, which affected the static routes Gateway IP through the VPN tunnel. I wanted to see if it Is possible to create an Redundant Aggregate VPN tunnel to both AWS VPN Tunnels rather than two individual sets of IPsec VPNs (2x IPsec tunnels, Firewall Policies, Static Routes, etc.).Creating the two tunnels and joining them into the Aggregate tunnel is simple enough, but I need clarification when it comes to the static route(s) and the AWS 2 IPv4 CIDR Addresses. Original configuration required manually adding /30 IPv4 CIDR for each tunnel which updates the Gateway IP for each static route. It seems that an IPsec-Aggregate only allows one entry from 0.0.0.0/0. 

I'm running 40F with the latest version, it has FortiSwitch connected to it and managed by the 40F running the latest firmware as well, and 831F access points connected to the FortiSwitch, using the latest firmware managed by the 40F.I understand that the recommended version is 7.2 and we're running 7.6looking at the downgrade guides it says that the configuration would be saved.is there a way to downgrade remotely without losing configuration ? or the only path is to downgrade and re-configure everything manually again ?  

I'm using a WLAN NAC policy to transfer clients between VLANs based on FortiClient ZTNA Tags, but it takes 2-3 minutes before a client is moved from the onboarding VLAN to the destination one. I already did the optimization regarding this doc:  https://docs.fortinet.com/document/fortigate/7.0.0/new-features/527756/fortigate-nac-engine-optimization But I think it's not sufficient. I'm using FG600 with FortiOS: 7.2.11

 Hi all - I have been fighting with the FortiManager API for a while now.  With a Python script, I've been able to:Authenticate to FortimanagerQuery all Fortigates in FortiManageLoop through the devices to find a specific FortigateCollect details from any individual or all Fortigates includingInterface Status, IP address, subnet, vlan and descriptionGrab the Switch Hostname, Serial Number and number of portsI am struggling with figuring out how to pull the switch details for:Mgmt IP addressModel Number (It appears to part of the start of the serial number)I'm pretty sure I can get it pretty easy from the FortiOS directly, but I'm really hoping to pull the details from FortiManager with the same "connection".  I can see the details in FortiManager under FortiSwitches. Any ideas anyone? Thanks,-Todd 

We just received licensing for FortiClientEMS, and I'm not following the documentation for setting this up. 1. The request to build the FortiClientEMS server has been sent, but it will be a few days before it's ready. I don't have the ability to test anything on the server at the moment.2. We want to use Entra ID for the SAML SSO authentication. Do I need to configure SAML SSO on the FortiGate or the FortiClientEMS server? On the admin guide, this is stated: "Communication between EMS AD connector and AD servers: Enables synchronization of AD groups and users with EMS for endpoint management, policy enforcement, and SAML-based authentication." This occurs over TCP-8871, so I'm confused if the FortiGate or FortiClientEMS server authenticates the user. However, on all our FortiGates that are configured to use SAML SSO for administration, this is configured on the FortiGates.3. The FortiClientEMS documentation shows TCP-389/636 for LDAP to the AD servers. We do have on-prem AD server

HI Community  Is there any way to change the time zone setting of FortiSASE generated reports. By default it came from GMT  

Hello,   I would like to ask you for yur opinion on this:   I have two ha clusters:   Cluster #1 has two 400Fs and is active-passive Cluster #2 has two 200Fs and is active-passive   between these two clusters is a link. This is an LACP Aggregate Interface with two ports (2x10G SFP). Should there be a switch in between the two clusters? Can they be connected directly? I could disable the LACP participiation of the secondary node on each cluster to avoid mac address conflicts (since without switch there is no LAGs) which wouldn't be a problem since the secondary node is passive anyways.   what would you say is best practice here?  I found support docs that show it without switch but I also heard ppl say you have to have a switch in here...   So I am unsure now and also wo talk about a load of money (switches with many sfp ports are really expensive).

One of our users have reported everytime they try to connect to the VPN it disconnects them from their network connection.  Does anybody have any potential solutions? 

HiI need FortiClient VPN Online Installer on macOS using .pkg, with silent installation and preconfigured VPN, via ManageEngine Endpoint Central.So, Can I get the VPN-client only .pkg for MAC (not .dmg)? Currently we are using free version of FortiClient.We are using FortiGate at our company and have been using the FortiClient VPN client downloaded from the official Fortinet website. However, the available macOS download is a .dmg file, which only supports GUI-based installation.For software automation purposes, we require a .pkg version of the FortiClient installer (for macOS).If the .pkg version is only available with a licensed product, could you please let us know which specific product or license is required to obtain it?Thank you in advance for your assistance.TIA :)

coding using python to get the log in via API and process the data.. but the question is, when we use the API_Key from Forti, the content is empty, as if the API_Key used does not have authorization to get that Intrusion Prevention data. However, when I tried to use a cookie that was the result of intercepting the API.. there was a result

Hi - Does FortiClient VPN software (paid or free version) has a kill switch feature... meaning if VPN drops the PC should get disconnected from internet until VPN connection is up again.

Good morning!Can I make a usage report for my fortigate interfaces? To receive in my e-mail? If I can also configure something to receive an alert if my link exceeds the contracted limit.

Hi everyone,my colleague and I are working on a migration project involving several FortiGate 50E units that need to be replaced with new 50G models across three different sites. We've already downloaded the configurations from all the existing devices.What’s the best approach to transfer the configurations to the new FortiGates?Has anyone used FortiConverter for this specific model change (50E → 50G)?Any tips, recommendations, or best practices would be greatly appreciated.Thanks in advance!