Fortinet Community

After upgrading the firmware FortiOS Fortigate 60F from version 7.4.7 to 7.6.0, only the native VLAN is available for use. Allowed VLANs no longer function on the FortiSwitch ports.Ports with two "Allowed VLANs" configured are not working or are unavailable. Only the "Native VLAN" works. Later versions 7.6.1, 7.6.2, 7.6.3 don't fix it. I have to downgrade  to firmware version 7.4.7 for it to work successfully. I will wait for a correction to that Bug.   

HelloI have a 10.x.x.x/8 network with several FGT clients that are managed in FMG. I cannot access the FGT clients through Remote Access in FMG. What should I analyze to find out why Remote Access is not working?

Hi guys! We are currently experiencing some issues trying to transition from SSL-VPN to IPSec Dial-Up using SAML with MS Entra ID.We are using FortiOS 7.4.8 and FortiClient 7.4.3 1790 VPN Only Version. As far as the authentication via SAML goes, it all works perfectly, we followed the official guide on how to set it up and as long as we use UDP as transport, it all works just fine. The problem comes because we were having some stability issues using UDP (FortiClient randomly disconnects while actively working over the VPN) and we wanted to try TCP transport to see if that change would impact stability.  In the original setup, we had two tunnels configured, one for each WAN connection, with the same following config:edit "VPN-IPSec-Iplan"set type dynamicset interface "wan1"set ike-version 2set peertype oneset net-device disableset mode-cfg enableset ipv4-dns-server1 192.168.2.88set ipv4-dns-server2 192.168.2.90set proposal aes256-sha256 aes256-sha512set ip-fragmentat

I've got a cluster of 601Es running 7.4.7 that I need to move the internet port from port 1 (copper) to port 9 (sfp) and I was dreading doing it manually (delete policies, addresses, objects, then interface and then recreate everything on new interface) and noticed something "new" (to me) called Integrate Interface.  Does anyone have 1st hand experience in doing this?  Just wondering if there are any "gotcha's" or things I need to watch for.  Thanks in advance for anything tips, tricks or advice.

Hello,i need to configure a vpn ipsec access for a few users through the implementation of fortiauthenticator cloud, fortitoken cloud and EMS.These users should be locally created on the fortiauthenticator cloud, associated with the fortitoken cloud and then, with the EMS, i need to check their compliance.I've correclty deployed the ipsec vpn with local users just for test and it's working, now i need to use the FAC cloud, how can i create the users on it and let them visible in the authentication process?I thought to add the FAC cloud as radius server but obviously it's doesn't have an ip being a saas solution.Did anyone face a similar implementation?The scope of this scenario is to let the users connect via vpn to the remote resources and when a new user needs to grant access it should only be added on Fac cloud with its fortitoken cloud.Thank youRegards

Hello team!! I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point thi

Hi, We have a web filter profile which is named QA_WF and it has a 3 hours time quota for category 25 (Streaming Media and Downloading) and category 37 (Social Networking). Quota keeps counting incorrectly even though no activity has been performed in this category. Version 7.4.5 QA_WF has quota config;config quota edit 1 set category 25 set duration 3h next edit 2 set category 37 set duration 2h next end In the SS_1.png file, you can see all category 25 logs. The first log was recorded at 2025-04-30 11:05:28 and Quota Used:0. After that, there is no recorded log until 12:13:48 in this category and the user just opened-closed that tab (a Youtube video and Facebook page same for both (not tested Facebook in screenshots but we tested it)) and shutdown the machine. But as you can see in the SS_2.png file, the actual time is shown in the bottom right and the user has 56 minutes left at 13:08. So once this user's quota starts counting, it keeps counting even though no ac

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. From the FortiGate, I can ping the ISP gateway successfully.However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.Here’s what I’ve checked so far:Ping is enabled on the WAN interface (set allowaccess ping is configured).The interface is up, IP is correctly assigned, and the cable is physically connected.No local-in policy is blocking ICMP.No trusted hosts are configured under the admin settings.Subnet and default routes appear correct.and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

I have played with FortiWeb trial VM and the demo center (FortiWeb Demo) and after reading some docummentation and watching (9) FortiWeb API Protection: Overview - YouTube and (9) FortiWeb - Machine Learning Based API Protection - YouTube I see that FortiWeb has ML for API discovery but what about discoverying if API endpoints don't enforce authentication or authorization or using weak authentication? The traffic could be legitimate but the devs in some cases by mistake don't enforce API autentication/authorization on some API endpoints or a forgotten old version of an API URL endopoint (shadow API). Can FortiWeb see the requests and still after time with Anomaly detection make suggestions for API security improvement even if all the requests don't have authorization header (not a deviation but still a security issue) ?

Hello,  I played with fortiweb trial Evaluation limitations | FortiWeb Private Cloud | Fortinet Document Library and demo https://fortiweb.fortidemo.com/ and I also watched FortiWeb API Protection: Machine Learning based Protection but it is not clear if FortiWeb can  generate swagger or openapi file based on ML/AI learning of the API traffic? Maybe if not the on-prem appliance (vmware or in a cloud like AWS/Azure) if the FortiWeb cloud can ?

I have 2 firewall connecting using site to site dialup vpn because site 2 is behind cgnat.Now i wanted to configure a port forward to a internal devices behind site 2.I have configured the VIP and policy at site 1 but its not working, is any step i miss out or any other ways to do it ?VIPedit "Test3"set uuid b7def848-4834-51f0-5298-bafc01a19730set extip public IPset mappedip "192.168.2.20"set extintf "any"set portforward enableset extport 34263set mappedport 3389nextFirewall policyedit 17set name "Test3"set uuid c8b54f82-4834-51f0-0ccf-a0367faa8ea9set srcintf "mgmt1"set dstintf "TO_P"set action acceptset srcaddr "all"set dstaddr "Test3"set schedule "always"set service "ALL"set logtraffic allnext

I do 5 minutes speedtest to the internet but why in the traffic shapper the utilization seem very low

How to configure the web filter polyce time range  on  FORTIGATE 40 F 

Hi!So i'm facing a strange issue with wildcard address object (FQDN).If i configure the object as *.learn.microsoft.com i cannot reach anything from my client, not even the "microsoft.com" domain.If i configure it as *.microsoft.com i can reach the website and all the subdomain (lean.microsoft.com included).i've already configured the "config system session-helper" for DNS traffic. If i run "diag test application dnsproxy 6" looks like my FGT cannot resolve the subdomain: I found this old technical tip where its says that wildcard FQDN should not be used in firewall policies.Any suggestion?

Hello, I'm scheduling some reports for my customer and the report filename comes with the serial number. I'd like to know if anyone was able to put the hostname on the Output Profile for the e-mail subject comes with the hostname. Regards, 

Hi all I am trying to setup a ipsec dialup (to replace SSL VPN) on a FGT200G running 7.4.8, and I am using FortiClient (VPN-Only, free version) with 7.4.3.As for authentication, I want to start out with local user (without MFA). Once this works I am going to try with Radius (users on FAC with and without FTM) and from there to SAML. I would like to use a specific interface and a specific (public) IP on said interface (to distinguish that dialup from other dialups).Preferably, I would like to use peerid's (if possible, but I guess that depends?).Additionally, I would like to use a PSK. So that the client needs that before connection and getting to any kind of user authentication with username/password (and potential MFA), if that is possible.(As for split-tunneling and full tunnel, I will try and play around with this, once the first configuration snippet works) The internet is full of examples (officially from Fortinet as well as from all you experts). Unfortunately, I a

Hi allI am trying to setup ipsec dialup (IKEv2) using port tcp/443 on a FGT200G with 7.4.8 and with Forticlient (vpn only version) 7.4.3.Amongst other issues, I am facing a connection block (not negotiation error, I seem not to get that far).My connections requests from my client (and from my IP) are seen on the fortigate (on port tcp/443) as expected, but are being blocked by local-in-policy number 0. I have added one single local-in-policy that should allow ssh, icmp and https (which is tcp/443 in the service object) from my IP address. ICMP works and the FGT replies for my IP, however, tcp/443 is being blocked,As this is all in one single local-in-policy, I have no idea where I went wrong - ICMP works, so why doesn't tcp/443? Thanks for giving me a hint where to lookBest regards 

Hi, I have a Windows Server 2022 RDS Server (Terminalserver Services).I want to install FortiClient as AV / EDR Client. I've created an installer and invitation link for all the AV Modules excluding: VPN and Application Firewall. But the Forticlient does not seem to work well in multiuser envoirements. If a new user loggs into the terminalserver and authenticates with forticlient, another user will logged out. the forticlient also gets out of sync with forticlient ems cloud. Is there any best practise on how to deploy forticlient to a rds server? Thank you for your help 

can we deploy the User Based policies in similar way we were able to do onsite Active Directory integration using SSO. We normally use FSSO agent for that on AD server, how can we do that on Azure. PS. I am not talking about forticlient or VPN usage here but actual firewall rulebase using the User Groups. 

Hello, I'm reaching out as I couldn’t find the proper place to submit feature requests on the Fortinet website (such as support or partner portals). Therefore, I'm sharing this feedback here in the community forum in hopes it reaches the appropriate team. One of my customers operates a network with approximately 100 FortiSwitches, all integrated via FortiLink with FortiGate. Managing ACLs on FortiSwitches in this environment has been extremely frustrating. Here’s the issue:I want to apply ACLs that allow or deny traffic based only on destination service ports, while keeping source and destination IPs as 'any'. This is a very common requirement in real-world environments. However, this configuration is not possible when the FortiSwitches are managed by FortiGate via FortiLink. The managed FortiSwitch ACL configuration lacks the ability to define service ports. There is also no option to disable FortiGate control over ACLs, which means that even if I manually con

Hello,I’m trying to understand the compatibility between FortiClient VPN and different versions/editions of Windows. Specifically, I want to know:Which versions of Windows (e.g., Windows 10, Windows 11) and their editions (e.g., Home, Pro, Enterprise, Education, Home Single Language) are officially supported by FortiClient VPN?Is Windows 11 Home Single Language Edition compatible with the FortiClient VPN (especially for remote access via SSL/IPSec)?Also, what is the minimum and recommended FortiClient version for Windows 11 systems?I would appreciate it if someone could share any official documentation or personal experience regarding this compatibility. Thanks in advance!

Hello everyone, I’m working with a FortiGate 60F (v7.2.11 build1740 [Mature]) and a FortiSwitch 124F-POE (v7.6.1 build1047). I want to set up FortiLink over a trunk connection using ports A and B on the FortiGate and connect them to ports 23 and 24 on the FortiSwitch. My goal is to build a FortiLink trunk for redundancy and increased throughput. However, as soon as I configure the trunk on the FortiSwitch, it stops being recognized by the FortiGate.Am I doing something wrong? Is it even possible to set up FortiLink in this way, using a trunk across two ports? Any help or guidance would be appreciated.Thanks in advance!

In my lab environment i try to use 3rd party DNS server, i already upload the 3rd party certificate but why the certificate is not showing in DNS SSL certificate?

 Iam getting this error, its working on other pcs but not on mine, i even disabled wirewall and windows defender but that also didnt help, i tried connecting to other internet connections, even mobile data, still getting the same issue, the creds are completely working .. working on other pcs