Fortinet Community

Hi Guys, I wanted some guidance on how can I become a Firewall Engineer. I have 3 years of Exp in IT but I had to left my Job in March 2025. Now I am trying to swicth my skill. I wanted to know that What are the things I need to learn before appplying for a job and how much time it will take to master it. I have started from Basics and so far I have learnt IP Addressing, Subnetting, Routing(Static, Dynamic, OSPF, BGP), Swicthing(ARP, Vlans, Inter VLan routing, HSRP, VRRP), ACLs, NAT(Static, Dynamic, PAT). I have started learning Fortigate from basics and I wanted to know is there anything else I should learn parallely? How much time will it take to land my first job as a firewall engineer. I am also thinking of learning Cloud in future and will dive into Cloud Security.

Hello,  My question is can fortigate autoquarantine AD users based on the number of IPS virus violations they do?  I see that under the article https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/148620/config-system-automation-action or the video https://www.youtube.com/watch?v=3vLdto9Yx0U  that I can block bad hosts based on Mac address or source IP address but nowadays users use different computers, so my question is can I make an automation that can automatically block the source AD user (after fortigate authenticates the users) if the users does too many attacks in a specified time frame that trigger the IPS or virus detections?

Hi Experts, I'm trying to setup a Virtual FortiManager on my EVE-NG platform. I have performed the following configurations on it through the CLI:config system interface     edit "port2"         set ip 192.168.1.200 255.255.255.0         set allowaccess ping https ssh http     next end My workstation IP is 192.168.1.14 and I'm am able to ping it successfully.C:\Users\Arpit>ping 192.168.1.200 Pinging 192.168.1.200 with 32 bytes of data: Reply from 192.168.1.200: bytes=32 time=119ms TTL=64 Reply from 192.168.1.200: bytes=32 time=211ms TTL=64 Reply from 192.168.1.200: bytes=32 time=307ms TTL=64 Reply from 192.168.1.200: bytes=32 time=389ms TTL=64 Ping statistics for 192.168.1.200:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 119ms, Maximum = 389ms, Average = 256ms However, whenev

Hello,IS any solutions or workaround to allow guests to type in and send login and password immediately - not waiting for approval? It's quite problematic to explain to guests that they should wait until request will be approved, especially they can see form to put these credentials..Perfect scenario would be when guests can type in credentials, sent them immediately and wait for approval.Thanks for any help

Hi Guys,I’ve been using a FortiGate 60E in my homelab for about a year now, and it’s been working great. However, I’m considering upgrading to something more powerful with additional ports. I recently came across a good deal on a FortiGate 100E for around $100 USD.Before making the purchase, I’d like to hear from others: is it worth upgrading to the 100E, even though support is scheduled to end in 2026?I don’t have the budget to buy one of the newest models that’s I am looking at older models.

HiCan i use the same ip range for multiple tunnels in ipsec remote access vpn. thing is i make three tunnels for the same group of people but with different internet links. Can i assign a same ip ranges for all three tunnels for clients to get when they connect to tunnel or is it gonna lead to ip conflicts and i have to assign three different ip ranges for each tunnel?

there is problem when i config IPSEC in my forticlient mobile in android an ios and i use IKE1 but there is problem when connected (Could not establish session on the IPsec daemon) and the other problem in ios when i config IKE1 there is not open phase1 or 2,how i can solve it :)  step by step in fortigate and forticlient plz

We have switched from Sophos UTM to Fortigate and we used to have DNAT rules to redirect all internal traffic to any destination with specific service to secific internal IP.  scr.ip ANY > dst.ip ANY > dst.port tcp-udp/123 > dst.ip 10.20.30.40 > dst.port tcp-udp/123src.ip ANY > dst.ip ANY > dst.port udp/53 > dst.ip 10.20.30.50 > dst.port tcp-udp/123I only can find DNAT via Virtual IP - but there is no option to create rules like above.Can anyone help me out or open my eyes to find the way to go. Thx and greetingsChristian 

How to Create Subnet at FortiAnalyzer when want to generate reports.For example, User Top 500 Websites by Bandwidth->Settings->Subnet 2: All Subnet & Specific Subnet.  Select subnet.. -->Include Subnets -> Click Select I want to choose 10.168.230.0/24 But no button to add subnet. Please Help me   

What the heck am I doing wrong here? FortiWifi # config system netflowFortiWifi (netflow) # set collector-ip 192.168.3.197command parse error before 'collector-ip'Command fail. Return code -61FortiWifi (netflow) #

Hey,I am obligated to use Forticlient VPN for my workplace. Unfortunately, whenever I try to open the Forticlient GUI, I get a completely blank screen. The navigation menu on the top loads fine, I can press file which gives me an option to quit the application (and nothing else), and I can press Help which gives me two links to documentation that don't help me in this situation. The program itself doesn't load however.Does anyone have an idea how to solve this issue? I just tried to install the rpm-package from the VPN-only client. I guess it may be specifically designed for CentOS only? If so, is there any way to get it working on Fedora? My terminal output doesn't give me a lot:[sjoerd@lennart ~]$ forticlientFontconfig warning: "/usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", line 6: unknown element "reset-dirs"Platform detected: fedora[ '/usr/lib/opt/forticlient/gui/FortiClient-linux-x64/FortiClient' ]did-finish-loadwindow-all-closedI'm running Fedora Silverblue wi

Background:Fortigate version: 7.4.7FortiClient version: 7.2.4/7.4.1/7.4.2Android version: Android9, Harmony4.2, Xiaomi Hyperos1.0.4.0     1. I selected split tunnel mode, but the logs show that internet traffic is still being matched through the tunnel    2. I noticed that the default route is being pushed to the VPN interface, just like on wlan0, this may be causing internet traffic to go through the tunnel.    3. I tested connecting to another FortiGate running version 7.4.8, and it pushed specific routes to the VPN interface.    4. It might be a bug related to the version7.4.7, but I couldn't find any explanation or fix for it in the 7.4.8 Release Notes.

Hi,  Is it possible to retrieve the ML-KEM keys from an external HSM using KMIP? I've been reading this article, Post-Quantum Cryptography for IPsec key exchange NEW | FortiGate / FortiOS 7.6.1 | Fortinet Document... We currently have the ability to retrieve the IPSEC SA key from an external HSM using KMIP, IPsec SA key retrieval from a KMS server using KMIP | FortiGate / FortiOS 7.4.0 | Fortinet Document .... However it would be great to be able to retrieve the ML-KEM keys as well. Is this supported? If so is there a configuration guide or some guidance you could offer?

Configure Fortinet ZTNA Application Gateway with SAML and MFA using FortiAuthenticator  In this hands-on tutorial, you'll learn how to configure Fortinet’s ZTNA Application Gateway with SAML-based authentication and Multi-Factor Authentication (MFA) using FortiAuthenticator. :rocket: What you'll learn: Step-by-step setup of ZTNA Application Gateway on FortiGate Integration of FortiAuthenticator as a SAML Identity Provider Enabling MFA for secure remote access Creating secure access policies for remote users Testing and troubleshooting authentication flowshttps://youtu.be/zngSdBCOPyY 

Hi there,We use the Fortinet-all_rules rule for our AWS WAF (via AWS Marketplace) and have used it for a long time.Today, we experienced an unfortunate outage due to the SQL-Injection-02 rule falsely identifying legitimate traffic to a critical endpoint in our system.This outage was not related to any activity on our part, and AWS eventually confirmed for us that other AWS customers also experienced problems due to this false positive.Is it the case that Fortinet pushed a problematic update to this ruleset today?  The outage began for us at 2:51pm ET. Does that line up with a deploy to that ruleset?Thanks,Terren

Hi,I have a remote site A (SonicWall NSA) connected to site B (FortiGate) with IPSec tunnel. Site A is sending load balancing probes (over the tunnel) to site B, but it's targeting the WAN interface IP of site A. Traffic arrives on my tunnel interface at site B. Note that site A's probes are implicit and cannot be edited to target one of my local IPs on the local site. On the receiving site the FortiGate drops the traffic due to strict RPF, message as in logs below contains "reverse path check fail, drop". I tried setting up a DNAT with Virtual IP and got pass the initial above error, but still could not get the firewall policy to trigger correctly. When I enable below CLI bash stops working for some reason, so I suspect something is not right. Any idea if this is the right approach and what I should look at? Thnks. Policies are:vipconfig firewall vipedit "vpn-ahg-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.xset mappedip "192.168.10.1"  --> local L

In an era where networks are growing more complex and downtime is costlier than ever, traditional monitoring tools are no longer enough. IT teams are overwhelmed—not just by alerts, but by the sheer scale of infrastructure, they are expected to manage. That’s why the release of FortiAIOps 3.0 marks a pivotal moment for IT operations.   Blending advanced machine learning, deeper real-time analytics and predictive intelligence, this new release goes further—it delivers true operational intelligence offering context-aware insights across wired, wireless and SD-WAN infrastructure. Whether you're troubleshooting intermittent performance issues or preventing outages before they occur, FortiAIOps 3.0 is built to help IT teams move from reactive to proactive, from monitoring to autonomous remediation.   Let’s dive into what makes this release a game-changer!   FortiAI agent – The virtual network expert.   FortiAIOps 3.0 introduces a powerful new feature: the FortiAI Agent—a

Hi,Is there a known issue when using an "Active directory Connector" to query a Windows Server 2025 LDAP ?We have several fortigates (7.4.8) which have 2 connectors: one to query a windows server 2022 and another one to query a windows server 2025.The connector works well with Windows Server 2022 but not with Windows Server 2025...Has anyone managed to get an Active Directory connector to work with a Windows server 2025?  

I have installed windows agent 5.2 but whenver i need access NAS it is accessable but when folder i need to access like \10.10.10.100\folder its fortiauth windows open up but local user isn't working there i tried alot options like . And "no domain" optionHow to do that , i also unchecked option "permit built in password providers"Before un checking it it usually gives option for choose other option but not now it is good for RDP.mFA but for access something ok network creates issue

Hello All, Recently i faced an issue with policy package sync whenever I created a user or any device settings and installed it. after the installation, policy package shows out-of-sync and if I want to re-install it. it shows me to delete the device settings which I created recently.Appreciate your help for this.

On an SD-WAN site with two Inets and SLA configured with Inet1 preferred for a given traffic, when Inet1 stops to meet the SLA what happens with the sessions running at Inet1? From Fortinet documentation I understand that "If at any time, the link in use doesn’t meet the SLA criteria, and the next link in the configuration meets the SLA criteria, the FortiGate changes to that link". Is that just for new sessions? What happens with the existent sessions at Inet1? Those are dropped? Reason behind the question is because sometimes one SLA parameter can be triggered but the link is still usable. Thanks

Hi, we have a onprem Fortimanager and we changed the name of it. no i also have to change the name in the fortinet cloud where we register our devices. We have an entry in our cloud with the name of the manager, but now i could not find it.  Many thanks for your help. Marc

hi everyonei want to acces a local web server which use virtual host for accessing. so it use a local fqdnI want to reach this internal web server with vip configuration . i will use a andress object mapping to the fqdn of my local web server. how to do that. ?

I have FortiClient 5.4.2.0860 on Windows 10 and it will not work when I try to use it through the Wifi at my local library (had this problem once before at a mall also).  When using the library's Wifi, Forticlient gets to 10 percent and then says "Unable to establish the vpn connection. The vpn server may be unreachable". I can establish a Forticlient connection through most other Wifi networks just fine (hotels, Starbucks, airports, etc).    My company's VPN server is set up to listen using port 10443.   I have tried disabling Windows 10 firewall and Windows Defender and it doesn't help. Could the library's network be blocking port 10443?   Thank you, Tom 

Hello, I have configured FortiNAC-F 7.4.1 to use a guest captive portal for self registration. A FortiGate is configured using radius locally on FNAC. This is successfull in the FGT UI. On FNAC I have role based access enabled for the SSID, and the dynamic VLANs. The Guest modelling config also has registration set to enforced. My problem is that any client trying to connect to the SSID doesn't appear to be authorized to register. Has someone come across this issue before and could point me in the right direction?The error is Registration - Access Deny (Post-Auth) and the client will not be redirected to the captive portal.