Fortinet Community

While we've been running FortiManager for years, we finally took the time to setup it up to fully provision a firewall using Provisioning CLI Templates. We built around 17 individual CLI Templates that configure various sections of the config, and once we could fully provision a firewall running them one at a time, we grouped them up into a CLI Template Group and were so disappointed when it immediately failed.  It appears that regardless of how you arrange the individual scripts in the Group, when you execute the script, it doesn't execute them sequentially, it consolidates all of the configuration and pushes in whatever order it feels like. In our case, the very first config it tries to push has a dependency on an interface that hasn't been created yet. I opened a support ticket reporting the Provisioning CLI Templates are running out of order and asked how to fix it. The answer I got was to run some of the CLI Templates independent of the Template Group, to ensure the

After upgrading our FortiGate cluster from 7.4.7 to 7.4.8 yesterday, our ZTNA is no longer working. I don't see any external connections under ZTNA in the logs. Internal traffic with EMS tags is still working as expected. We are using the cloud version of FortiEMS. Has anyone experienced a similar issue after the update?I'm struggling to understand the issue, as there are no visible error messages. The EMS server appears to be functioning normally — all connections are established, and clients show as connected  https://routerlogin.uno/ .

Good evening everyone,I hope this message finds you well.I’m currently working with a FortiWiFi-60D-POE, running firmware version v6.0.12, build0419 (GA), which I intend to configure and connect to my internet box.I created a WiFi SSID interface with the following settings:A DHCP address rangeCaptive portal enabledMAC address authentication enabledAfter completing the setup, I tested the captive portal connection. I was able to obtain an IP address, but the captive portal page does not appear.I’ve tried accessing it over HTTPS using ports 1000 and 10003, but without success.Additionally, I’ve noticed that this device is running an older firmware version.Could this issue be related to a bug in this version?If anyone has experienced this or has a solution, your help would be greatly appreciated.Thank you in advance!   

Every once in a while our users will get told that the certificate is not private but if they accept that they are able to login and 2FA against our SAML. The certificate that shows up as "not private" is a certificate we purchased from GoDaddy.  Every browser should have the GoDaddy CA to validate the cert so I am not exactly sure why we are getting this error.  The SAML server is ADFS running in AWS.  The ADFS hostname is a different domain then the cert ZTNA is complaining about. So I do not know if thats the problem or not.  However, this only happens once in a while and not to everyone and even before ZTNA we never had an issue with ADFS cert. Anyone have any ideas?

Hi, is there any way to disable the time zone automatic daylight saving time, or alternatively set a fixed timezone (e.g. UTC+1)?My requirement is to have fixed local time all year round (without daylight saving), in detail I'd like to set UTC+1. Thank you for any help.Best regards,Lars

Hi, I do not know if anyone has tried this or that I'm implementing this wrong;I have a customer with 2 sites with 2 Fortigates, connected with a site-to-site IPSec VPN connection. At the office:At site A i have a Domain Controller, users can access data on site B, everyone at the office is happyAt site B i have a Domain Controller, users can access data on site A, everyone at the office is happy Now users who are outside the buildings:What we want is that a user connects remotely to site A (using the VPN Client on a Windows system) can access data at site B.For now they disconnect site A and connect to site B, but can this be done without this step? I hope you understand what I mean by this? I've already searched these forums in hope to find anyone with the same setup but am not able to find any cases..

Hi I have a customer that has given me VPN access to his network. The customer is using FortiClient VPN. I want to run the VPN on a private virtual machine (running Debian 12) without a graphical user interface (neither X11 nor Wayland). Following https://www.fortinet.com/support/product-downloads/linux I was able to install it. With "forticlient vpn edit" I was able to create a new profile and with "forticlient vpn connect" I'm able to start the VPN connection. However for this particular customer I always get "X509 verify certificate failed" error and need to explicitly allow the connection. On my main desktop I started the GUI and saw that in the settings there is the option "Do not warn Invalid Server Certificate" but "forticlient" cli does not have a sub command to set the settings. Even executing it as root, I cannot find a way to set this option. I managed to log in on my VM via SSH with X11 forwarding. I can execute stuff like "xterm" even as root.

Hi. About Fortinet FortiGate or any other products,1. After inputting License key (Activation), is there any way to remove that license?2. Is deregistration and deactivation of License the same thing?3. What are the steps to follow if I want to deregister or deactivate a license in FortiGate? After deregistration or deactivation, will the configuration of the FortiGate erase?

It was happening because Fortigate's license expired.When I check the config-error-log during the Fortigate check.I mistook the log that came out when the license expired as the log that came out now.Normal operation after license renewal.

Hello, I will generate CSR, create CA certificate and import it to the FortiNAC-F. After that, I will distribute it to clients. The clients connecting with dot1x and I want to check if the client joined to the domain then it can connect to the network. I added "User-Name=DomainName\*" attribute but I want to add certificate attribute for checking if its joined. How can I do that?   

Hello, i've deployed vpn access with fortitoken authentication, now while logging i'm prompted both to insert the forticlient two factor authetication code and to confirm the push notification i'm receiving on the smartphone.If just accept the push notification i'm not able to login, is there a fix to receive only the push notification instead of the token code request as per screenshot?Forticlient version is 7.4.0.1658 and fortigate is  7.4.7 

Hi,Lately, we migrated from FG500E(7.2.8) to FG1800F (7.2.8). After this we encountered with clients disconections problem from our WiFi infrastructure (FAP431G(7.4.3) with 802.1X).It seems like they are roaming all the time between APs, some client even when they are sitting same place. During connections/disconnections ping is time-out or there is general failure. RegardsM. 

Hi community, I am going to implement many FortiSwitches as access switches. I have read that FortiSwitches supports MCLAG but not stack. Then, my first question is: 1. I am thinking of configuring them as independent switches, not MCLAG, because when they work as access switches the advantages of MCLAG are not so evident. I still need IP for every switch, users will be connected to only one switch, not dual home as servers, and the high-reliability offered by MCLAG I think is good for data centers and servers, but not needed for campus access switches. What do you think? By the way, they will managed by FortiGate/FortiLink.https://www.qsfptek.com/qt-news/switch-stacking-vs-mlag.html Second doubt:2. I have read in the following Fortinet link:There is a maximum of two FortiSwitch models per MCLAG.Is it a typo? Does it means two FortiSwitch units? Only two?https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/860027/mclag Regards,Julián

Dears , For what's use this license (Fortivoice Enhanced Call Center Service)? Do I lose call center features without it?  BR,

Hi,I am trying to apply a pbr that will send all tiktok traffic via different isp.I have applied the pbr and in the "Internet Service" i can see enteries for various things but i do not see one for tiktok etc. basically i want all raw video stream traffic to be sent via differnet ISP.I have selected Google Web, Google RTMP, Google-Other and able to divert all youtube related traffic via different isp. Need guidance how to make use of internet service in pbr ?Thanks

 Hi Community, We are facing persistent BGP flapping over IPsec tunnels configured between our FortiGate and AWS Transit Gateways (TGWs). Our setup is as follows:2 AWS TGWsEach TGW provides 2 public IPsResulting in a total of 4 IPsec tunnels (established successfully)BGP is configured for dynamic routing (local ASN 64520, remote ASN 64513)Issue:Although all 4 IPsec tunnels remain stable and up, BGP sessions reset every 40–60 seconds across all neighbors. The session uptime never exceeds 1 minute before dropping with the following message: Notification Error Message: (CeaseUnspecified Error Subcode) Troubleshooting Done:Verified and matched AWS-supplied BGP configuration (hold time, keepalive, remote ASN, etc.)IPsec tunnel selectors, Phase1/Phase2 settings are as per AWS VPN guideKeepalive/hold timers: 3s / 10s (as required)Disabled asymmetric routing to prevent ECMP/return path issuesRoutes are being exchanged successfully during session uptime (e.g., 10.9.0.0/16)De

We are running Windows Server 2012 R2. We have installed the most recent FortiNet client (vpn only), version 5.2.0.0591. We have configured an SSL-VPN connection. When we click on the " connect" button, the status progresses all the way to 98% and then hangs. We have disabled the windows firewall, do not have any anti virus software installed, no group policies are being applied, and no other applications are running when we attempt to make the VPN connection. Thanks for helping!

 I am trying to edit the below template on the FAC Portal, I want to delete the fields we are not using, but there doesn't seem to be a template for it, any other way please?    

Hello, I urgently need help. My office is moving to a new location.The internet connection is managed via the office landlord.I received information about the internet connection.. I have been given a static public address and a LAN IP address with GW.However, I need to keep the old LAN settings because I have multiple servers in this network. Firewall is FortiGate 81Fnew connectionPublic IP: 87.xxx.xxx.xxxLAN IP: 10.48.200.2/24Gateway: 10.48.200.254 old connection on firewallPublic IP: 104.xxx.xxx.58Gateway: 104.xxx.xxx.57LAN IP: 192.168.2.1/24no DHCP, all clients receive through Windwos DHCP, 192.168.2.1 is GW for clientsIs it possible to use the new internet connection with the existing LAN 192.168.2.0/24?Do I have to apply the new public IP Address for WAN and LAN settings for internal,-> setup route interface WAN to 10.48.200.254-> and then set up another physical interface with LAN 192.168.2.0/24-> set up interface 192.168.2.0/24 route to 10.48.200.254&nbs

Hi, I have cisco switches connected to my fortigate fw at work and I want to remote them through the internet like for example at my home. How to configure port forwarding on fortigate? If for example my office public ip is 1.1.1.1 and my home public ip is 2.2.2.2 and my 3 cisco switch management ip is 10.0.1.1, 10.0.2.1 and 10.0.3.1. How can I configure my fortigate firewall to allow ssh remote connection from my house?

Hi, Ever since the Microsoft update issue of April 2025 we have been encountering BSOD issues.All the fixes and updates are in place but we now find that Windows 11 24H2 with the Forticlient free VPN installed are still experiencing the BSOD. 24H2 machines without the vpn are ok. Uninstalling/re-installing the vpn from problem machines makes no difference. BSOD debug show NetIO.sys is at fault. Latest and previous versions of the vpn have been tried and all drivers updated.Anyone else seeing this issue or have advice to resolve this?

Hi everyone,I wanted to ask a couple of questions in case they sound familiar to anyone:1- Question:I log into my AP through Managed FortiAPs and see that it has a MAC address. On my laptop, I have NetSpot installed so I can see what SSIDs I'm receiving and what MAC addresses they have. I see that the MAC address of the SSID I'm receiving isn't the same as my AP (although it is associated with FORTIGATE), although it's very similar. How can I see the MAC address that AP is sending and that it matches the one NetSpot analyzes?2- Question:How can I see the actual power in dB transmitted by an AP?Thank you and best regards.

When I started up "FortiManager 410G" and checked the "Storage Status" LED, it was off.However, in the "Storage Status" LED description in the public document "QuickStart Guide,"it states that "Off" means "No power to storage device,"and that "Blue" means "Storage device location"When in normal conditions, is "Off" or "Blue" correct?Also, if "Off" is correct, under what circumstances would the "Blue" come on?

hello support,  I have two FortiPAM VMs, one with 5 users and the other with 15 users. My question is: how can I configure HA, knowing that I am trying to install the VMs on two different sites?  

Hi allAfter upgrading Fortigate 200G from 7.2.8 to 7.4.8,I get the message "[180] load_tpm_key: Failed to load." on the console.Does anyone know the answer?