Fortinet Community

Hey guys I’m planning on taking FCP core exam Fortigate Administrator (formerly NSE 4) soon as i’ve been working with fortinet fortigate for the last six months and been studying for the exam from time to time. Some topics i didn’t set up on work but i tried to use an emulator to practice. I wanted to know if the practice questions reflect somehow the exam level or? What i prepared so far:studied the courseworked with fortinet fortigate for six monthswent through the practice questionsI’m just doubting if what i prepared is sufficient or not…

what are the causes of SSLVPN failed login ?user reported after enter MFA pin, encounter permission denied -445 error.could it be wrong password or AD account locked.our users is authenticated through radius server.

how do i generate a report for failed for the past 3 months from FortiAnalyzer ? 

I have two Fortigate devices: FG1 and FG2. There's a tunnel between them, with a computer connected to the LAN port on FG1 and a file server on FG2. I would like FG1 to resolve the domain to an IP address, which is why I set up a DNS server on FG1. Now, the question is: what should I enter in the DNS Forwarder, and should I check "authoritative"? I don't know what that means, but I think I should check it because I don't want the query to go to the internet, but rather to stay within my network. The DNS forwarder is set to 8.8.8.8, and it works, but I don't know why. If I set the DNS forwarder to 8.8.8.8, I understand that addresses not found in the local database will go to the internet. But why does it work if I'm setting up a new zone? Shouldn't this option be in DNS Service on the interface, not in the DNS database? And when I add a second zone because I want it to resolve another domain, what should I enter in the DNS forwarder? When I leave it blank, everything still works,

I have a problem with FortiClient VPN 7.4.0.1658 versionI need connect to the VNP server in local network.My computer with the client do not have internet access.When I am trying to connect I can observe warning message in FortiVPN_1.log:fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: No Internet.In state: TunnelConnectAbortedI do not need internet to connect to the VPN, because the server is in local network.During startup I can observe in this log:fortivpn::INetworkAvailability_impl::Get LAN is available, Internet is not availableIs it possible to configure the client to not use the internet, but only local network to connect to the VPN server?

Is there a re-release of this? I only have compressed logs with me at the moment, I need this program to uncompress it according to numerous threads and articles. Thanks!

Hello everybody, we are actually using on a Fortigate (running 7.0.x OS) the SSL Offloading Feature for checking inbound-Traffic (!) to an Web-Server located in our dmz:  config firewall vip edit "Loadbalancer SSL www.example.org" set comment "for IPS on SSL" set type server-load-balance set extip 1.2.3.4 set extintf "wan1" set server-type https set monitor "192.168.1.22" set extport 443 config realservers edit 1 set ip 192.168.1.22 set port 443 next end set ssl-mode full set ssl-certificate "www_example_org 03-23" set ssl-client-renegotiation deny set ssl-client-session-state-type disable next end config firewall policy edit 99 set srcintf "wan1" set dstintf "dmz" set action accept set srcaddr "all" set dstaddr "Loadbalancer SSL www.example.org" set schedule "always" set service "HTTPS" "HTTP" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "my_certificate-inspection" set ips-sensor "my_protect_server" set application-list "my_app_protect_server" se

Hi everyone, thank you for taking some of your time to read this. We switched ISP a couple months ago for a Bell Gigabit Fibe Ethernet. They gave us a HomeHub 2000 that I had to put in bridge mode to stop it from acting as NAT router (first problem). I then setup the WAN1 connection using the Bell credentials in PPOE and I could not get any signal.I called Fortigate support and we setup a DNS using fortiguard effectively creating a domain name linked to our static IP. Is this correct ?  I found two similar threads but neither mention if they have static IP. Ultimately I would like to remove the fortiguard DNS server causing latency.  - Fortinet 40f PPPOE connection fail on bell canada - Fortinet Community   - Technical Tip: Bell Fibre configuration directly o... - Fortinet Community 

Hi,I have below requirement Have 2 WAN linksNeed to steer the O365 destinated traffic by default from WAN1. If the WAN1 link was hit 90% percent of the bandwidth, need to be fail-over to WAN2. After the WAN1 utilization become fine need to fail-over again to WAN1.Can we do this in SD-WAN?

Hello, on my FortiGate I have two users as super-admin. Now I want to delete the one named "daniel" - but I cannot do this. There are no references in the GUI visible, and after searching via full-configuration on the CLI there is one entry. But I do not know how this settings came in the past to this, and also this is not visible in the GUI - or, at least, I did not see this yet. Anyway, I have no chance to get this entry changed so that the user is free to become deleted. Please see attached screenshots. Any idea for this? FortiGate 40F (FortiOS 7.6.3) Regards,Daniel 

hello everyone,i'm new to the forum and was wondering if it was possible to achieve what i asked in the subject.to summarize...The will is to have a captive portal, on fortigate, with local authentication, that allows me to steal the public source ip of the user, which will then be enabled, in some ad-hoc policies.the most likely use, would be to access the firewall configuration interface, where in the policy a specific user is identified, who has just authenticated on the captive portal, coming from the internet...another situation, the possibility of accessing other devices, such as video devices, with the same system...thanks.

Good day to all.We have FortiGate 200f and its license had expired some 3 months ago.I want to confirm if we renew it say we purchase one year enterprise license will the new license be activated after the date it is purchased and expire after its duration (say one year)  is reached ?Regards. 

Background   We are migrating existing Lacework customers from our current Lacework support portal (Zendesk) to the FortiCare support portal to service all support requests for the Lacework FortiCNAPP product. This migration doesn’t change how you access the Lacework platform—it only affects how support tickets are submitted.   While the existing users of the Lacework support portal have been migrated to FortiCare, they remain inactive by default. To enable support access in FortiCare, the "Master Account Owner" must complete the steps outlined below.   A Master Account Owner account is the administrator for an organization in FortiCare. This account was created for all Lacework customers who had an existing Lacework instance as of February 15, 2025. The Master Account Owner’s email address was provided to Lacework when the subscription was activated.   An Identity & Access Management (IAM) User is an individual identity created within the organization that

Hello, I'm trying to deploy DPI on a Fortigate80F v7.0.17. Right now everything works as expected but one thing, the "Trusted CA List". I'm unable to inspect anything that has a certificate from there and i haven't found a way to ignore the list, so, if i want to inspect packets from YouTube, i'm not able to do so because it has a Google Certificate. I have QUIC blocked from application control and from firewall policies, i haven't found anything that is not related to quic, but it seems like is not the issue i'm facing. Has anyone had this problem? Thanks 

Upgraded FAC from 6.6.2 To 6.6.4 as we need the "Endorsor" option so Guests can type in an email for WIFI approval. everything worked fine before with manual approval. After the upgrade the new feature does not work, but that is not the issue. Now, No Guests can login to the WIFI, they see the portal and register, and I get the approval email and can approve, they show up in the correct group as before, but the credentials dont work. I get the following in the logs: "Local user authentication from (null) with no token failed: NAS not allowed for authentication"Type IdNameSub CategoryCategoryDescription20350Authentication Failed NAS Not AllowedAuthenticationEventAuthentication failed, NAS is not allowed for authentication ype IdNameSub CategoryCategoryDescription20114Authentication Failed without Followup LoginAuthenticationEventAuthentication failed, no successful follow up login. The first error indicates the NAS is no longer allowed? none of that has changed? I do

Hi community, Looking at the following post, it seems FGT-1 sends the SYN to FGT-2 through the LAN switch. https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-A-A-cluster-3-way-TCP-handshake/ta-p/197467 In the following situation, what happens if link 1 goes down? The SYN cannot be distributed from FGT-1 to FGT-2, then does the active-active configuration stop working? If not, what happens?  Regards,Julián

I am using FortiClient software on my Android mobile device to maintain connectivity to my network from outside. Sometimes, the client software disconnects automatically. I want the client software to stay connected at all times unless I manually disconnect it.

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out Our goal:Users connect to Fortinet SSL-VPN.We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.All other traffic should go through the user's local internet connection.Challenge:Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method usin

We're sending all logs from FAZ running 7.4.6 to an external log collector, but we want to not send some traffic, such as NetFlow over tcp port 2055. Under Systems Settings > Advanced, there is a Log Forwarding tab where we've defined where the messages are being forwarded to, and within this area, there is a section called "Log Forwarding Filters." I've been looking into the "Enable Exclusions" section, where it's possible to select a field called "Destination Port (dstport)," but it doesn't appear to be possible that the actual port number can be defined. Can this be done? If so, can anyone offer guidance for accomplishing this? Thank you.

Last week I updated my Fortianalyser 400E from FAZ_400E-v5-build1082-FORTINET.out to FAZ_400E-v5-build1151-FORTINET.out After that the device won't boot at all. I logged a ticket to support and passed two hours trying to make it boot. We formated the boot partition multiple times, uploading  and finally the support offered me an RMA.New device come in, same issue won't pass the booting process.I created another ticket and they issued another RMA.. should have my new device soon. Did this happen to one of you? Is someone can help me getting out my logs from the first device that failed? The support told me this was "difficult" when the fortios don't boot. I'm able to go in the IPMI we console as the server is a supermicro but I can't boot on another operating system, the bios is password protected.  Here what we see from COM port, it stuck after the last line on both devices.Reading boot image 3597061 bytes. Initializing FortiAnalyzer...The disk was no

Hi, Would like to ask what will happen to our billing if the users onboarded exceed to our current subscription of 1000 users? Right now, we onboarded 1200 users. Does this might cause over-subscription and charge us for it?

i am getting this error suddenly when adding FG to Fortimanager desc="Failed to retrieve nonhasync config" user="System" ,Both Fortigtes are in sync , no corrupt config , still can not get the config when adding , when it finishes it pass on everything except retrieving config.Fortimanager running 7.6 3 , Fortigate running v7.4.7 , ADOM 7.4 i have other fortigated added without no problemany idea

I am just sharing the FGT-50G VDSL config for other VDSL users connected via CETIN (the Czech Rep. provider). The config differs a bit in comparison to older xDSL FGT models. And Fortinet documentation does not provide useful samples. Data (traffic) via 802.1Q VLAN that is specific for CR enviromnemt. FortiGate-50G-DSL #FortiGate-50G-DSL # get system statusVersion: FortiGate-50G-DSL v7.0.17,build7592,250125 (GA.M)FortiGate-50G-DSL # show#config-version=FG50GD-7.0.17-FW-build0682-250125:opmode=1:vdom=0:user=adminconfig system interfaceedit "dsl"set vdom "root"set type physicalset alias "isp-physical"set phy-mode autoset tc-mode ptmset annex bset profiles 17a 30aset lldp-reception enableset role wanset snmp-index 6edit "vlan848"set vdom "root"set mode pppoeset allowaccess pingset alias "isp-logical"set snmp-index 12set username "xDSL"set password ENC <pass>==set interface "dsl"set vlanid 848endFortiGate-50G-DSL #FortiGate-50G-DSL # get system dsl statusDSL Module Status: [up]D

Hello,I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"Fortigate version is 7.2.4however, there is another set of FGT firewalls which are working fine.Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.