Fortinet Community

Hello,  I recently installed my newly obtained Fortigate 61E, and updated to 7.0.3. I setup an IOT VLAN for my IOT devices. All of the devices can connect to the internet just fine, except for one exact device. After rebooting the device, that device will connect to the internet for a little while, then appears to lose connection. The entire time, the device can be pinged on the LAN with it's DHCP reservation. Looking for any recommendations, as I'm a bit new to this.  Thanks in advance!

I had tried to setup VPN connection. Using the latest version client and firewall. In windows During the login time it shows"VPN Server may be unreachable (-14) " . Status shows 80% complete. BUT it works in ANDROID..!!! Anyone resolved this ?  

I am getting this error when trying to do Firewall upgrade:"Image Upgrade Failed. Incorrect Address Name." while trying to upgrade I am unable to find the KB which has the same problem.How do I proceed with this? Thanks!

I have a user who is attempting to connect to a VPN using the Forticlient Linux CLI client. In order for them to connect, they need to Enable "Single Sign On (SSO) for VPN Tunnel". I don't see an option for enabling this through the CLI. When I view the VPN profile it shows as disabled. Does anyone know how I can enabled this option in the Forticlient Linux CLI?  $ forticlient vpn view MYVPN VPN: MYVPN Remote Gateway: vpn.myVPN.com:10443 Client Certificate: None Authentication: Disabled Single Sign On (SSO) for VPN Tunnel: Disabled Auto Connect: Disabled Always Up: Disabled Save Password: Disabled $ forticlient version FortiClient Version: 7.0.8.0292 ===================================== Engines ===================================== AntiVirus: 6.00282 Vulnerability: 2.00031 ===================================== Signatures ===================================== AntiVirus: 1.00000 AntiVirus Extended: Unavailable Vulnerability: 1.

How to create and Communicate subnet like 10.20.30.0/24, 10.20.28.0/24,10.20.29.0/24 on Fortigate HA firewalls. Whereas access switches are cisco with only by default configurations. Having vlan 1 passed. In current scenario, subnet 10.20.30.0/24 working fine with multiple policies of firewalls.  If we create multiple networks on firewall, How we can control users if static ip assigned to wired pc/nodes while creating security policies, firewall policies. 

hi,I've created secondary IP Address to certain Interface (Internal 2), so we can define on Internal 2 has 2 ip:ip-1, and ip-2can I make:certain host (computer) from ip-1 communicate to specific IP address on ip-2?If different interface, I can make policy route, how about in this case?kindly please advice. thank you

I have a, maybe silly question but maybe someone can answer me.. We have FAC setup with RADIUS clients in a 10.10.0.0/16 subnet, mainly used towards switches for MAB. The thing is we want to configure VPN for a firewall with an IP in the same subnet. Is it possible to configure this as a /32 without it being affected in the /16 subnet policy?

Hello, I am trying to setup a FortiAuthenticator policy for Wireless dot1x. The authentication works but RADIUS attributes (vlan and ACL) is not pushed to client.Here is what I have tested; Added the Remote LDAPCreated a User Group which retrieves user via LDAP Filter (not via imported users).Created a Realm for LDAP UsersCreated a Policy that:WLC as RADIUS ClientAuthentication Type Password/OTP (PEAP and EAP-MSCHAPv2)Identity Source - username@realm - Points to LDAP Realm, uses Windows AD Domain Auth and filters on the groupAuthentication Factors - Password Only and Windows AD computer authentication I have tested with User Group pointed to imported users and remote user sync rule but that does not work either.Does anyone have any idea? I checked the debug logs but cannot find anything interested. Also we havetested this with a local group (MAB) and it works fine.

Hello, dear friends. On my FortiGate, I have created a software switch with ports 4 and 5 that has a segment 192.168.141.1/24 - Wired network. Likewise, a VLAN on that software switch has a segment 10.100.0.1/24. Wi-Fi network. But the Wi-Fi network on my Unifi SW and Wi-Fi gives me Wi-Fi for the devices and assigns me the IP 10.100.0.1/24. I need to create a VLAN to assign the same segment 192.168.141.1/24. But if I create a VLAN with the same segment 192.168.141.1/24, that IP doesn't match the other one configured in the software switch. A separate network is created. How can I create a network that has the same segment and shares the same gateway so the devices can see each other? What step do I need to take?

Hi everybody Currently, I have an active FCA and FCF certifications, but it is near to expire.I checked the fortinet training pageIn this page, I see this consideration.If your FCA certification is still active, you can extend its expiration date to two years from the date you complete one of the following requirements:Completing the FortiGate Operator course and passing the FortiGate Operator exam.Passing one exam for any FCP certifications.Passing one exam for any FCSS certifications.However, when I took again the Fortigate Operator exam, I can't recertify. Can help me about it?How I can recertify the FCA and FCF qie the Fortigate operator course?? Thanks in advance

As far as I know, When lacp mode passive, it responds when it receives a lacp packet. but during the LAG test, Forti-A was set to lacp-mode passive and Forti-B was set to lacp-mode passive.Both Forti-A send lacpdu and Forti-B receive lacpdu.Is it because there are still sessions we communicated when it was active-passive? 

FortiGate FSSO has been successfully configured and enrolled. However, when applying it to a firewall policy and checking user connectivity, the connection appears to be successful.The issue arises when a user logs into their laptop using fingerprint authentication or a PIN code—under these conditions, the FSSO-based policy is bypassed, and unrestricted access (e.g., to websites like YouTube) is allowed.I would like to understand the root cause of this behavior and whether there is a viable solution to address it.

Hi,I have a fortigate fws a-p mode managed by fortiManager in air-gap environment, all are in air-gap.What i see recently i replaced the passive fw with new unit due to rma. after joining it to cluster, both got in-sync as well.I see the licenses on both a-p are getting revoked, i applied the license file for each unit separately but that does not help. It shows license file succesfully uploaded it will show all IPS, AV in Green with proper expiry date, after 2-5 min it all gets orange with no license.What i observed is that the license section shows License update ip as Fortimanager, do i need to upload the license via Fortimgr ?i tried for active fw license file upload under fortimngr Foortiguard settings > service pack > but that also does not help.

Hi  i have NSE7 certification expiring on July 2025 , i am planning to take the ZTNA exam , would this be enough to renew my certification , or shall i need to take another exams ?   

Hi Community, I have imported the configuration for 1 VDOM into Forti Manager (7.6) and after imported successfully, it's still at "modified" status. I changed Routing objects and BGP directly on the Firewall, FGM and FGT immediately went out of sync, so hence I tried to import from FGT to FGM to get back into a sync status. The policy imports successfully, but why aren't the routing objects such as Prefix Lists and Route Maps, static routes and BGP config are not updating on FGM?  What am I missing here?

If use lacp-mode static because the peer equipment does not support lacp, it seems similar to use h/w switch or s/w switch instead of LAG. What's the difference between Fortigate's lacp-mode static and h/w & s/w switch?

Hello to all,I’m trying to build a single spoke hub & spoke (Dual hub) topology using the overlay template provided by FMG 7.6.3.The architecture is formed by 2 VM fortigate hubs in 7.4.6 and an onprem A/S pair that acts as spoke in 7.4.6.Full internet topology, each hub has only one link while the spoke has 2.All the tunnels are UP, and HUB side I see the advertisement in BGP of the test subnet that I’m using onprem side (192.168.99.0/24). The BGP advertisement has something strange, I would have expected to see the VPNs as next-hop interfaces, instead it uses directly the port 1 (outside of the hub) used by the underlay.I noticed that the templates created by FMG do not assign an IP on the HUB interface tunnels, I don’t know if this is an error.From the hub loopback (172.16.5.252) I can successfully ping the spoke’s Lo (172.16.5.1).

fortigate update without license

Hi Guys,So I am not a FGT guru at all.I run a FGGT60 using 7.2.11 b1740 Here is the scenario, isp has assigned me an IP range up until now I have just been using one. Now I need to use a second and route that IP to a server on port 5. Need that server to have full internet access but not be able to see anything else on the network.Here is what I have done:Created new hardware switch with only member port 5 - 192.168.15.1  Server is on that port/switch is getting correct IP info 192.168.15.2 and has access to the internet Now How do I route my second IP address to that port/switch?Is this a simple routing issue or do I have to add a secondary IP address on the WAN1 port? Sorry for what is probably a simple question but I can't seem to find a definitive cookbook article for this and since I am operating remotely I can't really just cowboy it.. thx John             

Hi all,I've not used Peer id's in the past but I have 2 IPSEC tunnels for dial in users and they both listen on the same interface, the first one is TunnelA and then second one (below it in the list) is TunnelB so my understanding is that I can set PEER ID's on the tunnels and then specify the local id on the client and it will only connect to that tunnel that matches so I've got TunnelA and TunnelB and in the "Authentication" bit on the FortiGate side for both of these tunnels in the "Peer ID" section I've put TunnelA on TunnelA and TunnelB in TunnelB. I've also specified the same in the "local ID" in the Phase 1 Proposal bit on the FortiGate tunnels. Then on the FortiClient endpoint I've specified TunnelB in the "local id" under Phase1 so I thought this should then try to connect but only to TunnelB however it's not connecting but on our FortiAnalyzer it's showing the endpoint is trying to connect to TunnelA but then nothing after that ? i.e. I would've thought I would either see it

I am trying to reduce the amount of logs sent from FAZ to SIEM via log forwarding, but would still like to forward all FGT logs to FAZ. I can configure log exclusion and set a field-list, but the field-list options are generic and not as granular as I would like (from what I can tell). Can I create a custom field-list that is more detailed, such as a particular destination IP?I would really prefer the option to exclude based on FGT Internet Service category and destination IP, but am open to nay input.Thanks

We are migrating from SSLVPN to ZTNA on FortiGate 7.6.2.  EMS Cloud 7.4.3 and FortiClients 7.2.9 and 7.4.3. With SSLVPN I am using external browser to our SAML 2FA.  What this means is that the users Browser caches the authentication cookie for about 24 hours so they do not need to re-login and get a new 2FA.  However, I do not see any option in ZTNA to use an external browser.  So every time a user goes some where they need to authenticate with SAML and get a new 2FA. Is there any way to change this?  I would be happy with authenticate once every 8 hours if that is possible.

Hi everyone, I was struggling to get FortiOS config in YAML format into Python. Thanks to this post I found out it's a bug - 976722.System configuration export in YAML seems invalid - Fortinet Community Fortinet fixed the bug in 7.4.8. I updated a device to 7.4.8 and downloaded the config in YAML format. I can now load the config into Python, but I'm facing a new challenge. The object that is created from the file is a Python dictionary with two keys: 'global' and 'vdom'. This is expected. When I select key 'vdom' and load it into its own object, its data type is list. This is where the problem is. The list contains only one of two VDOMs I have in my config. The YAML file contains both VDOMs. Did anyone encounter the same issue? Any idea how to proceed?

Hi all, We're trialling on premise EMS and I'm struggling to get the FortiClient installed. I've got 2 domain joined laptops and I've made sure that all of the ports are open in the Firewalls (and I've tried it with the Firewalls off) and made sure that the EMS server can reach the required folders etc and the laptops back to the EMS server along with making sure the credentials are correct (and i've tried local admin creds) but it keeps failing. It does create the FortiEMSinstaller_logs folder along with the FortiEMSinstaller folder on the laptops and in the logs the only error I can see is this:[2025-05-28 15:57:59.5684027 UTC+01:00] [ info] [service:0 ] [27800:13432] [ 154] [WinMain] installing FortiClientInstallerService service[2025-05-28 15:57:59.5687825 UTC+01:00] [ info] [service:0 ] [27800:13432] [ 34] [orchestrator::service::install_service] service is installed - replacing it[2025-05-28 15:58:00.6898569 UTC+01:00] [ error] [service:0 ] [27800:13432] [ 50] [orchestrator:

I'm using Fortigate 70G with Comcast broadband in WAN1 and a 5G router for backup connected to WAN2. What's the best way to configure failover? I just kind of assumed that I should use SDWAN, but if I'm being honest, I don't really need any of the SDWAN "features." Since the 5G router will have a cost-per-bandwidth, I really only want to use it if/when Comcast is down.Can I achieve this type of failover configuration with SDWAN or am I better off just doing link-monitor?