Fortinet Community

Hello,  I have downloaded the correct Firmware checked the configuration but this is the error I'm getting. H   Image Received.Checking image... Wrong image type.  Please power cycle. System halted.  System will auto-reboot after 49 se Thank you 

Need to shift traffic on MPLS when Packet loss & latency has been increased.Currently when both the link get down traffic is being shifted but we want to shift the traffic when packet loss & latency has been increased.

I have a Cluster FG100F running 7.4.5 security Profile with SSL/SSH Inspection Read Only applied to Internet Policy. When the Server certificate SNI check is enabled, the firewall blocks most websites. When I disable it, it works. any idea  thanks 

Hello,I have weird issue where if "device identification" is enabled on interface and Fortigate gets hostname information from kerberos traffic it adds some spaces after the hostname. It can also be seen from 'diagnose user device' command like this:vd root/0 54:e1:ad:xx:xx:xx gen 390881 req 0created 7078125s gen 83715 seen 1637670s SW123 gen 15618ip 192.168.10.123 src arpos 'Windows' src http id 1444 weight 130software version '10' src http id 1444 weight 130host 'PC-TEST123456   ' src kerberosuser 'test.user' src kerberos It always seems to add spaces so field is 16 characters long.Is this issue with Fortigate or something with way Windows communicates through kerberos? Haven't been able to figure this out myself.

Hello, I have the below configured as a rule for my Virtual Wire Pair Policy.config firewall policy edit 23 set name "VLAN13 Restricted DNS" set uuid 4f872b7a-3a70-51f0-ffbb-6d2a411e5d70 set srcintf "internal4" "internal5" "internal2" "internal3" set dstintf "internal4" "internal5" "internal2" "internal3" set action accept set srcaddr "VLAN13 address space" set dstaddr "VLAN18 address space" set schedule "always" set service "ALL" set utm-status enable set dnsfilter-profile "sample-filter" set logtraffic all next endWith the above configuration, all DNS traffic is broken. I cannot even do the below dig command (192.168.100.1 is the IP address of this FortiGate, which is running a DNS server.dig @192.168.100.1If I remove the DNS Filter profile from the above, all DNS queries work fine. My DNS filter looks like this. All I did in the GUI was to set "example.com" to Allow

I'm facing an intermittent issue with FortiClient SSL-VPN where connection doesn't work properly, even though everything appears correctly configured. I’ve tested several FortiClient versions, but the issue persists randomly.Issue Summary:FortiClient connects successfully.VPN routes are installed correctly.Traffic (DNS + ICMP) is visible on the FortiGate.Wireshark on the client confirms replies (ICMP + DNS) are reaching the VPN adapter.Despite this, ping and nslookup hang or fail. And every other traffic...This issue happens roughly 1 out of every 10 VPN connections — seemingly at random.Tested FortiClient Versions:7.4.37.0.97.0.6Issue appears intermittently across all versions.What I've Checked:FortiGate policies are identical for all users.Split tunneling behavior is consistent.DNS server (10.0.0.11) replies are seen in Wireshark but not accepted by the OS.Disabling Windows Firewall and antivirus doesn't consistently solve the issue.MTU tests with ping -f -l show no consistent fragme

I have already enable radius on fortigate and fortinac and then the connection is successiful.But when guestusers authenticate from wireless NAC radius log  show like as below i have attached   

Hello team! I hope you are fine!Recently a user reported me a problem, after some troubleshooting, I find something new for me:This is one of these enents, in SSL section: date=2025-06-04 time=09:56:47 eventtime=1749041807646108870 tz="-0300" logid="1702062101" type="utm" subtype="ssl" eventtype="ssl-negotiation" level="warning" vd="root" action="blocked" policyid=25 poluuid="916a1a8a-ab4a-51ef-8238-c0f79567272e" policytype="policy" sessionid=234042452 service="HTTPS" profile="certificate-inspection_Alumnos" srcip=10.1.1.35 srcport=50274 srccountry="Reserved" dstip=104.21.96.1 dstport=443 dstcountry="United States" srcintf="VLAN1" srcintfrole="lan" dstintf="wan2" dstintfrole="wan" srcuuid="bc5355aa-c400-51ed-6f23-4fa5e520c8f9" dstuuid="5a9b4e2a-bf4c-51ed-dc50-e448f485ac50" proto=6 eventsubtype="encrypted-client-hello" hostname="cloudflare-ech.com" msg="SSL connection is blocked." The certificate inspection profile, is the following: config firewall ssl-ssh-profile&n

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, A FortiGate firewall Restarted around couple of weeks ago. Is it possible to find why it was restarted? I know it wasn't done manually and there was no power outage.  Thanks.

I am trying a schema as shown in the screenshot.Currently, when the setting is like this, you can access the Internet normally using bridging, but when using the channel, you can obtain an IP but cannot access the Internet. Checking the AP log, you can see DNS-no-resp.There are also policies set. Not sure what went wrong.FG-VM uses the free version.

Hi everyone,Spoiler (Highlight to read)สวัสดีทุกคนฉันกำลังใช้ **FortiGate 200G** รัน **FortiOS [เวอร์ชัน — ใส่เวอร์ชันของคุณที่นี่ egv7.2.8]**เมื่อฉันรันคำสั่งต่อไปนี้จาก CLI:ดำเนินการ traceroute-options source 49.231.244.67 ดำเนินการ traceroute 49.231.244.70 ฉันได้รับข้อความแสดงข้อผิดพลาดนี้:traceroute ถึง 49.231.244.70 (49.231.244.70), สูงสุด 32 ฮ็อป, 3 แพ็คเก็ตโพรบต่อฮ็อป, แพ็คเก็ต 84 ไบต์1 49.231.244.70 <m.lannapoly.ac.th> 0.028 มิลลิวินาทีtraceroute: sendto: การดำเนินการไม่ได้รับอนุญาตtraceroute: เขียน 49.231.244.70 84 ตัวอักษร, ret=-1 มีใครเคยเห็นปัญหานี้มาก่อนหรือไม่?สวัสดีทุกคนฉันกำลังใช้ **FortiGate 200G** รัน **FortiOS [เวอร์ชัน — ใส่เวอร์ชันของคุณที่นี่ egv7.2.8]**เมื่อฉันรันคำสั่งต่อไปนี้จาก CLI:ดำเนินการ traceroute-options source 49.231.244.67 ดำเนินการ traceroute 49.231.244.70 ฉันได้รับข้อความแสดงข้อผิดพลาดนี้:traceroute ถึง 49.231.244.70 (49.231.244.70), สูงสุด 32 ฮ็อป, 3 แพ็คเก็ตโพรบต่อฮ็อป, แพ็คเก็ต 84 ไบต์1 49.231.244.70 <m.lannapoly.ac.th> 0.028 มิลล

Hi there, I'm trying to restore an ecrypted configuration, however, it looks like the Password field is missing in the macOS (14.5) FortiClient VPN (7.4.0.1645)  It would seem that the Windows version of FortiClient (7.4.0.1658) does indeed support this.  Is there a way to work around the issue until it's resolved? Cheers,Attila

Hi,we are planning to buy some 70G - now I have learned that they only support version 7.0.Is there any ETA for version 7.2/7.4?Thanks. Jirka

 Two Cisco firewall in active passive mode. Suppose I put two Fortigate firewall ha pair one on each side inline behind the Cisco firewall for monitoring. How do I detect the Cisco firewall switched it's active one and therefore will switch to the correct active side on the Fortigate?Can link monitor accomplish this? If so how?Will changing Fortigate HA to active active help with this or cause more problem?Will breaking the Fortigate HA pair so both units are standalone work?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi all,I’m running Windows 11 24H2 (Build 26100.4061) and recently ran into an issue:I need to connect to two different Fortigate units at the same time for work purposes. Up until now, my workaround was to use both the FortiClient from the Microsoft Store and the standalone FortiClient VPN application. This allowed me to have two VPN connections active simultaneously—each to a different Fortigate.However, after updating to the latest Windows 11 release, this setup no longer works.As far as I know, this was the only way to achieve dual connections on one Windows device.Is anyone else facing the same problem?Are there any alternative methods or solutions to establish two concurrent VPN SSL connections to separate Fortigates from a single Windows 11 system? Or is there an official workaround from Fortinet?This setup is critical for my workflow, as I have to manage resources on both networks at the same time.Any advice or insights would be greatly appreciated!Thanks!Andreas

We've recently upgraded firmware on our 901G to v7.2.11 (from v7.2.8) and since then we're experiencing random internet slowdowns across our sites. Memory and CPU usage are running at normal levels and it appears there is plenty of available bandwidth on our primary Internet Circuit. We use proxy based inspection, with SSL certificate inspection selected. I have found today that if I change certificate inspection to no inspection on the policy that we have had no internet slow downs since. Has something changed between 7.2.8 (where performance was fine) and 7.2.11 where we are seeing these issues? It is worth noting that due to a GUI bug I wasn't aware of the FortiGate ignored the recommended upgrade path and went straight to 7.2.11. I have seen this article How to fix 'SSL connection is blocked... - Fortinet Community however we are not using flow based. I am also seeing floods of "Server certificate is re-signed as untrusted, certificate-sta

Hello,I'm new to FortiGates, moving off of SonicWALL. I'm trying to set myself up for success, and not setting myself up for failure.I have a FortiGate 600F, and 2 web servers that are hosted internally. These web servers are accessed by many users daily, across many different countries, so I'm concerned about security.Since we operate two web servers and our websites are customized for a wide range of clients, we manage numerous unique URLs. To streamline this, we use a wildcard domain certificate.. Right now, I have a basic policy. Incoming WAN interfaces to VIP, with HTTP/HTTPs services, and NAT enabled, no security profiles. I think its wise to setup at a basic, IPS and WAF security profiles. As default, SSL inspection "no-inspection" is selected, and gives the standard message " The no-inspection profile doesn't perform SSL inspection, so it shouldn't be selected with other UTM profiles or features that require SSL inspection."What is the correct approach to configu

Hello experts,I have configured interfaces x1 and x2 on the FortiGate as an aggregate interface, and on the other side, a Port-Channel on a Cisco Nexus switch.I am experiencing ping loss from the FortiGate to a specific IP address.Could you please help me troubleshoot this?Below is the configuration.Switch  Firewall:

I have a question regarding blocking the Cloud flare warp app on our application control in the firewall settings.I have blocked all proxys and VPN's in the generic filters and the app is inside those blocks. However the app still seems to run and bypass all filtering on the firewall. When I run a scan I can see that the app is working and bypasses the application control settings.Anyone know what this problem?Is it a tunnelling problem or a port?I can see it uses the MASQUE protocol.

 Hi,Guys, I am facing a problem that is difficult to identify the reason;SW CORE VLAN 248 is delivering dhcp;VLAN 248 passing in the trunk to SW2;TRUNK from SW2 passing VLAN 248; VLAN 248 created on the fortiswitch, but when I put the vlan on an access interface I get these alerts in the log and obviously it doesn't deliver dhcp.what tests can I do to try and identify the problem?

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear Community Members,I hope you are all doing well.I am trying to configure an event handler for CPU and memory usage that generates an alert when usage exceeds a defined threshold in FortiAnalyzer version 7.6.2 for connected FortiGate devices. However, I want to avoid alerts for brief spikes or hiccups. Specifically, I want the alert to trigger only if the CPU or memory usage remains above the threshold for 5 minutes or long.Unfortunately, I’m having trouble implementing this logic and would appreciate expert guidance on how to achieve this setup. Please See attached screenshot. Thank you in advance for your support.

Hello,I install Forticlient 7.4.3 on Ubuntu, but I do not get any response from Fortitoken. Nor in forticlient gui, nor in console fortivpn connect. I install all dependensies from https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-install-latest-FortiClient-software-on-the/ta-p/378757. confighandler.log:20250430 14:34:21.482 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250430 14:34:22.883 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.887 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250430 14:34:22.917 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result: i/o error: No such file or directory (os error 2)20250430 14:34:22.932 TZ=+0200 [confighandler:EROR] vuln:58 Failed to read vuln scan result