Fortinet Community

Hi, Ever since the Microsoft update issue of April 2025 we have been encountering BSOD issues.All the fixes and updates are in place but we now find that Windows 11 24H2 with the Forticlient free VPN installed are still experiencing the BSOD. 24H2 machines without the vpn are ok. Uninstalling/re-installing the vpn from problem machines makes no difference. BSOD debug show NetIO.sys is at fault. Latest and previous versions of the vpn have been tried and all drivers updated.Anyone else seeing this issue or have advice to resolve this?

Hi everyone,I wanted to ask a couple of questions in case they sound familiar to anyone:1- Question:I log into my AP through Managed FortiAPs and see that it has a MAC address. On my laptop, I have NetSpot installed so I can see what SSIDs I'm receiving and what MAC addresses they have. I see that the MAC address of the SSID I'm receiving isn't the same as my AP (although it is associated with FORTIGATE), although it's very similar. How can I see the MAC address that AP is sending and that it matches the one NetSpot analyzes?2- Question:How can I see the actual power in dB transmitted by an AP?Thank you and best regards.

When I started up "FortiManager 410G" and checked the "Storage Status" LED, it was off.However, in the "Storage Status" LED description in the public document "QuickStart Guide,"it states that "Off" means "No power to storage device,"and that "Blue" means "Storage device location"When in normal conditions, is "Off" or "Blue" correct?Also, if "Off" is correct, under what circumstances would the "Blue" come on?

hello support,  I have two FortiPAM VMs, one with 5 users and the other with 15 users. My question is: how can I configure HA, knowing that I am trying to install the VMs on two different sites?  

Hi allAfter upgrading Fortigate 200G from 7.2.8 to 7.4.8,I get the message "[180] load_tpm_key: Failed to load." on the console.Does anyone know the answer?

Hello everyone After a series of upgrade from fortiOS 5.6 to 7.4.8 on a FG101 cluster, i can't enable SSL Inspection anymore. Every policy where i have SSL Inspection + (Web filter or Application control), web pages end up with a 'ERR_CONNECTION_RESET' in the browser and a SSL Error is logged    If a choose a 'non-inspection' profile, no issue.If I disable 'Server certificate SNI check' in a non working SSL profile, the error is gone too. Any advice or experience ? Thank youAymeric

Hi Is it possible to replace the fortinet login page by our logo and color to fortigate?  Thank you

Hello - New to the Community and Wondering if Someone had some thoughts that I am missing. I have a branch that uses an HA Pair in Active-Active mode running through the Primary Adtran Switch of a Four Switch Daisy-Chain. I have taken over for an MSP and Previous Admin that are no longer hired by the company and our current MSP is unable to resolve the current problem and neither them or myself are able to login to the current switch to review the setup used for the HA. The switches are old and need to be replaced since they are End of Life. I have attempted to establish the new switches with an HA configuration for the HA pair and all looks good, except that I now have packet loss and dropped packets about every 20 packets. The HA was in Active-Active Mode and I have the ISP Connected Ports Trunked with LACP enabled along with one respective connection to each FortiGate (A and B) that are also LACP Enabled. STP is setup and Loop Protection disabled. I have rev

Hi Team,I was trying to edit an existing BGP route-map via FortiManager but cannot save the configuration. I am getting this notification while doing so.Error: rule/1/set-priority : out of range - prop[set-priority]: value 0 out of range (1,65535).But I don't see any attribute or priority to set in the route-map configuration dialogue box. Please do let me know what am i missing here.Warm RegardsFortiManager FortiGate 

Hi EveryoneWe have a Fortigate 80F currently configured with WAN1 only.There are many MIPs configured with this current Class C under Policy Objects -> IPv4 PolicyWe are migrating to a new ISP provider and have a new Class C.I am hoping to be able to configure this new ISP on WAN2 and create new MIPs  using the new Class C.Is this possible without bringing down the current WAN1?This is a production FW so causing a routing issue will be a disaster.The current WAN1 will be disconnected once the new WAN2 is tested successfully.Any help or direction is GREATLY appreciated!

Recently I have recieved this email from forticloud:-------------Start-----------------Dear Customer,We are reaching out to inform you about an important update regarding FortiGates provisioned to FortiGate Cloud without active subscriptions.To ensure robust security posture of your devices, starting Feb 28, 2025 FortiGate devices without an active FortiGate Cloud subscription will be required to upgrade to the latest firmware patch within 7 days of patch GA release.This change ensures enhanced security, reliability, and compliance with the latest features and updates provided by FortiGate Cloud. FortiGate Cloud will provide notification and prompts for upgrade when new patches are available on the web portal and the option to configure the upgrade time/day window of choice within 7-day schedule for convenience. Please note that cloud access and log upload to FortiGate Cloud can be restricted if not upgraded for devices without subscription.What does this mean for you:1. To maintain un

Hello Everyone, Does FortiWeb ML Based Bot Protection need a javascript to be injected ? I am asking if it can be used for API traffic as well  Does FortiWeb ML Based Bot Protection need a javascript to be injected as from what I have read from FortiWeb Bot Protection: Machine Learning based Protection  it seems that the Biometric Based and Deception based Bot features would need this but I see no reason for ML/AI to need it. Outside of that I wonder if during DOS attacks normal urls start returning 5xx (Nginx returns 503 during DOS) or does not respond will this cause false positives as FortiWeb needs to be aware which urls were returing normal 2xx or 3xx responses and not to block the user with Bot protection?    

Hello team! I have a new question about FortiClient EMS.I need to authenticate FortiClient users with an active directory domain and with 2FASo far, I could add the active directory domain in my FortiCllient EMS, and I can use the domain users when I connect a FortiClient (Without 2FA)When I started to search into this, the first option I found, needed to have FortiAuthenticator, but we dont have FortiAuthenticator.The second option that I found, is using Fortigate with the security fabric option, but my fortigate is not in a security fabric, because we havent any FortiManager or FortiAnalyzerI did not found any other method.Is there a way to add 2FA to AD domain users just using FortiClient EMS and Fortigate? Thanks in advance.Regards,Damián 

It appears I am missing some features like log view and in the adom I also dont see options for where to save logs, on which disk. Is it because I am using payg?  

Hi all, I am using Fortigate v7.4 version and calling APIs to get the details of firewall( 1 ) cmdb/firewall/policy( 2 ) cmdb/user/local etc.Above one is applicable for v6.4.15 version also? Could you provide the direct API docs of v6.4.15 version. 

Hi team, I have some doubts about integrating remote FortiSwitches to FortiGate. I have read this document, but I still have doubts:https://docs.fortinet.com/document/fortiswitch/7.6.3/fortilink-guide/801182/fortilink-mode-over-a-layer-3-network This is my topology: SW-1 and SW-2 are not a stack, they are independent switches. SW-1 and SW-2 internal IPs (192.168.1.x) can reach FGT FortiLink IP 10.10.1.1. I will use in-band management for the FortiSwitches (the internal IPs).On the FortiSwitch, will these be the commands for SW-1? config switch-controller global  set ac-discovery-type static  set source-ip 192.168.1.2                  <<<< in-band internal IP?  config ac-list    edit 1      set ipv4-address 10.10.1.1            <<<< FortiLink IP in FortiGate?    next  endend Am I correct? In FortiGate do I

Hi, After reviewing the forti demos at https://www.fortinet.com/demo-center and the documentation and some trainings I wondered what layer 3/4 and expecially layer 7 HTTP auto DOS protections are available without configuring manual thresholds in FortiDDos, FortiWeb, FortiADC ? I mean like by triggering DOS protection based on the web server latency in HTTP responses or web server starting to return more 5xx response codes ? I beliave that only fortiDOS offers auto thresholds as in the HTTP profile I see no manual thresholds like in FortiWeb or FortiADC but if I could get a confirmation?   

Dear, Analyzing the logs on my WLAN I see hundreds of repeated error messages. Failure Details: Action: DNS-no-domain Reason: Server 120.64.11.10 replied "non-existing domain" Message: DNS lookup of from client failed with "non-existing domain" This type of error is displayed for all APs. In "Reason" the IP varies a bit. Any idea what that might be?  Best RegardsAndré

HelloIs there a FortiGuard IP address threat feed? Like C&C, Spam sources, etc, ...I know we can block bad IP addresses directly from IPS, DNS filter & Antispam profile, but is it available from Fortinet as URI to use as external source in IP address threat feed?

Hi, Can someone please help me, I accidently delete my EMS IP on the connect page now I cant connect to my office computer, please help, I do remember my login details but not the IP, many thanks

We have two layer 2 vlans with the same vlan ID but different subnets at two different locations. Site 1 vlan99 10.1.X.0, site 2 vlan99 10.1.Y.0. We want to move a server on 10.1.X subnet to be hosted in the location where 10.1.Y lives without having to re-ip the server so the clients on 10.1.X can still access it and not see any changes. How is this possible to accomplish if possible at all without making other larger changes to subnets/client PCs?

Where do I find replacement 2.4/5ghz antennas that match the white originals? My Google Fu is not coming up a direct replacement option.

Hello fellows, I have the following situation:A FortiGate 61F (FortiOS 7.2.6) with a local DHCP service for the clients in the network and also a local DNS service with a "local.tld" zone. Using the DDNS mechanism, the IP addresses assigned via DHCP should be entered with the host names of the respective computers in the DNS zone.Unfortunately, this does not work in my case. I have made the following configuration, which should be sufficient according to the documentation: config system dhcp server    edit 1        set dns-service local        set ntp-service local        set domain "local.tld"        set default-gateway 10.1.1.1        set netmask 255.255.255.0...        set ddns-update enable        set ddns-update-override enable        set ddns-server-ip 10.1.1.1        set ddns-z

I am using windows server 219 and installed FortiClient 7.4.3. But I cannot see the row about “Security Posture Tags: ” Could you help to check the reason ?

Hello, dears,I hope this message find you well. I am trying to rename a FortiAP Profile, which is not the default one. However, there is no button or option.I also checked the CLI from the profile, but there was no option, at least I could not find one, for renaming the profile. I would appreciate any help. Sagvan Saleem#fortiap #fortiapprofile