Fortinet Community

Hi,we are planning to buy some 70G - now I have learned that they only support version 7.0.Is there any ETA for version 7.2/7.4?Thanks. Jirka

 Two Cisco firewall in active passive mode. Suppose I put two Fortigate firewall ha pair one on each side inline behind the Cisco firewall for monitoring. How do I detect the Cisco firewall switched it's active one and therefore will switch to the correct active side on the Fortigate?Can link monitor accomplish this? If so how?Will changing Fortigate HA to active active help with this or cause more problem?Will breaking the Fortigate HA pair so both units are standalone work?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi all,I’m running Windows 11 24H2 (Build 26100.4061) and recently ran into an issue:I need to connect to two different Fortigate units at the same time for work purposes. Up until now, my workaround was to use both the FortiClient from the Microsoft Store and the standalone FortiClient VPN application. This allowed me to have two VPN connections active simultaneously—each to a different Fortigate.However, after updating to the latest Windows 11 release, this setup no longer works.As far as I know, this was the only way to achieve dual connections on one Windows device.Is anyone else facing the same problem?Are there any alternative methods or solutions to establish two concurrent VPN SSL connections to separate Fortigates from a single Windows 11 system? Or is there an official workaround from Fortinet?This setup is critical for my workflow, as I have to manage resources on both networks at the same time.Any advice or insights would be greatly appreciated!Thanks!Andreas

We've recently upgraded firmware on our 901G to v7.2.11 (from v7.2.8) and since then we're experiencing random internet slowdowns across our sites. Memory and CPU usage are running at normal levels and it appears there is plenty of available bandwidth on our primary Internet Circuit. We use proxy based inspection, with SSL certificate inspection selected. I have found today that if I change certificate inspection to no inspection on the policy that we have had no internet slow downs since. Has something changed between 7.2.8 (where performance was fine) and 7.2.11 where we are seeing these issues? It is worth noting that due to a GUI bug I wasn't aware of the FortiGate ignored the recommended upgrade path and went straight to 7.2.11. I have seen this article How to fix 'SSL connection is blocked... - Fortinet Community however we are not using flow based. I am also seeing floods of "Server certificate is re-signed as untrusted, certificate-sta

Hello,I'm new to FortiGates, moving off of SonicWALL. I'm trying to set myself up for success, and not setting myself up for failure.I have a FortiGate 600F, and 2 web servers that are hosted internally. These web servers are accessed by many users daily, across many different countries, so I'm concerned about security.Since we operate two web servers and our websites are customized for a wide range of clients, we manage numerous unique URLs. To streamline this, we use a wildcard domain certificate.. Right now, I have a basic policy. Incoming WAN interfaces to VIP, with HTTP/HTTPs services, and NAT enabled, no security profiles. I think its wise to setup at a basic, IPS and WAF security profiles. As default, SSL inspection "no-inspection" is selected, and gives the standard message " The no-inspection profile doesn't perform SSL inspection, so it shouldn't be selected with other UTM profiles or features that require SSL inspection."What is the correct approach to configu

Hello experts,I have configured interfaces x1 and x2 on the FortiGate as an aggregate interface, and on the other side, a Port-Channel on a Cisco Nexus switch.I am experiencing ping loss from the FortiGate to a specific IP address.Could you please help me troubleshoot this?Below is the configuration.Switch  Firewall:

I have a question regarding blocking the Cloud flare warp app on our application control in the firewall settings.I have blocked all proxys and VPN's in the generic filters and the app is inside those blocks. However the app still seems to run and bypass all filtering on the firewall. When I run a scan I can see that the app is working and bypasses the application control settings.Anyone know what this problem?Is it a tunnelling problem or a port?I can see it uses the MASQUE protocol.

 Hi,Guys, I am facing a problem that is difficult to identify the reason;SW CORE VLAN 248 is delivering dhcp;VLAN 248 passing in the trunk to SW2;TRUNK from SW2 passing VLAN 248; VLAN 248 created on the fortiswitch, but when I put the vlan on an access interface I get these alerts in the log and obviously it doesn't deliver dhcp.what tests can I do to try and identify the problem?

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear Community Members,I hope you are all doing well.I am trying to configure an event handler for CPU and memory usage that generates an alert when usage exceeds a defined threshold in FortiAnalyzer version 7.6.2 for connected FortiGate devices. However, I want to avoid alerts for brief spikes or hiccups. Specifically, I want the alert to trigger only if the CPU or memory usage remains above the threshold for 5 minutes or long.Unfortunately, I’m having trouble implementing this logic and would appreciate expert guidance on how to achieve this setup. Please See attached screenshot. Thank you in advance for your support.

Hello,I install Forticlient 7.4.3 on Ubuntu, but I do not get any response from Fortitoken. Nor in forticlient gui, nor in console fortivpn connect. I install all dependensies from https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-install-latest-FortiClient-software-on-the/ta-p/378757. confighandler.log:20250430 14:34:21.482 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250430 14:34:22.883 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.887 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250430 14:34:22.917 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.932 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hi Team,We are implementing Explicit proxy at the customer end with Fortinet Firewall-601F. The scenario is we have two VDOM's i.e. Proxy and Perimeter. The user traffic will pass from Proxy towards Perimeter to reach the internet.For user authentication, we are using FSSO. The challenge we are facing is that in FSSO only groups are calling rather than specific user. Our goal is to apply separate policies on the user. In FSSO, we have fetched the AD user locally via LDAP rather than collector agent. The problem is that we have got four active directory and in FSSO only one of them is allowed to add. A user can land on any of the Active Directory for the authentication whereas if any user landed on the active directory that is not part of the FSSO will not be able to authenticate. So kindly help and advise, how can we resolve and overcome the said issue. Moreover, please also let us know in Explicity proxy what is the recommendation either FSSO is more valuable or Kerberos.

Dear Fortinet Community :) Today I have a quite simple question. I have received a new FortiGate (Fortigate 401F) and a new FortiAnalyzer (FortiAnalyzer 300G). Both are up to date with version 7.4.8. I have connected both devices to each other and authorized the FortiGate on the FortiAnalyzer. Was a simple task and worked easy peasy. Then I have created my interfaces for testing purposes. A WAN interface and a test client interface (LAN). Created my route so that I can browse as client through the web. I have defined the policy in a way that everything should be logged. Now my question: Question: When I want to have a look at the log on the Fortigate I can switch to show the logs from the analyzer. But they are always empty. No results. I can see the logs when switching back to show the logs from the firewall itself. How is this possible? Why do I not see logs when switching to show logs from the analyzer? One thing is different to the production environment. In my produ

Hi everyone,I'm experiencing a recurring issue with FortiClient VPN (version 7.4.3.1790) on Windows 11 Professional.The VPN connects successfully, but approximately 25 seconds after the connection is established, it drops automatically without any user action.Looking at the logs, I see messages like:WSAEnumNetworkEvents FD_CLOSE (10053)Failed to connect to SslvpnDaemonThings I’ve already tried (unsuccessfully):Full uninstall and clean reinstall of FortiClient (including registry cleanup)Disabling IPv6Trying different internet networksUpdating Windows to the latest versionChecking firewall and antivirus settingsIs anyone else facing the same issue or has found a workaround or permanent fix? Any help is greatly appreciated!Thanks in advance!

Requirement :Dc Fortinet Firewall :70FDC Firewall ka WAN IP: 103.62.237.154Public IP Pool (NAT ke liye): 103.62.237.153/30Branch Fortinet Firewall: 2 Wan 1 PPPoe WAN1 and 2nd DHCP Wan2Need Tunnel Between DC aur Branch Branch : Fortinet Firewall 40FBoth Tunnel will UP but Traffice will go depend Primary and secondaryBranch office ke ek system ka IP: 103.62.237.158"What is my IP" site par 103.62.237.158  show   Scenario Overview:You have a Fortinet Firewall deployed at both your Data Center (DC) and Branch Office, and a Site-to-Site VPN tunnel is already established between them. You want internet traffic from a specific system in the branch office to go out via the DC firewall, using a specific public IP (103.62.237.158). That is, when that system browses the internet and checks “What is my IP?”, it should show 103.62.237.158.Network Information:1. DC Fortinet Firewall:WAN IP: 103.62.237.154Public IP Pool for NAT: 103.62.237.153/30 → usable IPs:103.62.237.153 (n

Hi All, We are experiencing strange behavior in our Fortigate 4401F A-P HA environment. During reboot of the standby device, some sessions, which are carried on the active device, are dropped/stucked. Does anyone encountered such behavior? Thank you!   

Hi all,We have just got our iPads to connect using the FortiClient app with IPSEC and SSO and this works fine so the user can log in using their Azure details and then the login window shows that they have successfully logged in and this window then disappears and the VPN then connects however we've noticed that the Windows FortiClient app doesn't have the SSO option with IPsec (correct me if I'm wrong on that but it only seems to be for SSL) so we're trialling the ZTNA with a view to getting EMS (we don't have EMS installed yet though) and found this DOES have the SSO option with IPsec so I've configured it the same as the iPads and it shows we're successfully logged into the SSO but then whereas on the iPads the window disappears, this doesn't happen...the window just stays there and if we close it then the VPN goes from disconnect to connect as though it's just disconnected but if I check the VPN status without closing the window then it's not connected anyway ?I've tried both the i

With just over a year of hands-on experience, I still have great deal to learn regarding FortiGate configuration so I'm hoping to hear from some experts regarding how to use FortiGate as a core switch.  I'm managing about 40x FortiGate firewalls (mostly 200F) at a moderatley sized school board with 40 elementary and secondary schools.  Theconfigurations were setup by one or more predecessors before I took over the responsbility.  For the most part, we only have a single ISP link and a single internal switch link on each FortiGate.  Depending upon the size of the site, we could have anywhere from 1-5 campus switch stacks at each site with anywhere from 2-6 switches per stack.  The largest site would have about 18 switches across 4x switch stacks.  All switch stacks are aggregated with a core switch stack where there is a single uplink into the firewall.  Layer3 switching (routing between VLANs) is done on the Fortigate Firewall.  OSPF and BGP are

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.

Hello,  our "Vulnerability Scanner" detected that libcurl.dll as vulnerable to CVE-2025-0167Vulnerable files are:C:\Program Files\Fortinet\FortiClient\libcurl.dllC:\Program Files\Fortinet\FortiClient\x86\libcurl.dllWe use free FortiClient VPN SSL, so we can't confirm if full paid version is vulnerable too.We've upgraded to FortiClient VPN SSL 7.4.3, but libcurl.dll version is still vulnerable 

Hello community, I tried many ways to configure IPsec vpn to access only a specific subnet, but all have failed.Can you guide to how to configure such connection. Thank you!

Hello Team,We have deployed the FortiGate Firewall-201G in HA (Active-Passive) mode. Due to port limitations, we have connected a FortiSwitch (model 148F) to each firewall. These switches are managed through the firewalls.Currently, we are facing an issue: only the FortiSwitch connected to the primary firewall is coming online. However, we want both switches (connected to the primary and secondary firewalls) to stay online.Additionally, while the firewalls are in HA mode and have failover configured, the switches do not have any failover setup. This means if one switch goes down, traffic cannot switch over to the secondary switch, which creates a single point of failure.We have tried using crossover connections and the FortiLink split interface feature, but were not successful. We also noticed that the MC-LAG option is not available on the FortiSwitch 148F.Could you please advise on the best way to configure failover for both FortiSwitches connected to the primary and secondary firewal

https://youtu.be/SKPrKeKKW4w Starting with FortiOS 7.2.1, Fortinet removed built-in 15 days free evaluation license from the Fortigate VM images. It was replaced with the permanent evaluation license, still free. The steps to get it have changed - you now have to create a free Forticare/FortiCloud account, and use it inside the Fortigate GUI to activate this evaluation license. The license will be generated and added to your Forticloud account automatically.