Fortinet Community

Hi,I'm encountering an issue when trying to add a FortiGate device to FortiNAC; the process fails with the error mentioned in the subject line. However, I am able to successfully establish an SSH connection from the FortiNAC to the FortiGate via the CLI.I have Created an API admin and genereted the key, where it is used? Could you please assist in troubleshooting this? This article didnt help to solve my issue  Thank you in advance!"

Our requirement is just to forward industry standard hardware and network link monitoring parameters to our monitoring tool

We are trying to setup three VDOMS and would like IPSec traffic NPU offloaded between each of them using a FortiGate with a NP6XLite NPU.  My plan was to use NPU VDOM Links with VLANs. (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Difference-and-understanding-between-NPU-Vdom-link/ta-p/212709). The root VDOM has a public /30 address to access the Internet provider while the other two VDOM's use public IP's from a /27 block.  The Servers and PCs VDOM's would have an IPSec VPN to communicate between them. Does anyone have a better way to do this?  I don't want to use physical interfaces between VDOM's (not enough bandwidth on 1Gbps Ethernet) and I want the traffic to be accelerated. Thanks - I appreciate any guidance! edit "npu0_vlink0" set vdom "root" set type physical set snmp-index 36 next edit "npu0_vlink1" set vdom "Servers" set type physical set snmp-index 37 next edit

Hi All,We observed an issue while upgrading a FortiGate-1500D firewall HA pair from 7.0.14 to 7.2.11, with an intermediate step to 7.2.9. Following the initial upgrade to 7.2.9, FW2 came online, but FW1 remained offline for over five hours with no HATALK.After a manual reboot, FW1 recovered to version 7.2.9, synchronized, and became primary due to its higher override setting.However, the subsequent upgrade to 7.2.11 caused FW1 to go completely offline, with its HA interfaces failing. Currently we can not console to FW1 and the below logs are from FW2. From the logs the collected the following can be seen:13012: 2025-05-18 19:15:53 scanunit=manager pid=305: Error: failed to validate av package /data2/mmdb (no13013: 2025-05-18 19:15:53 signature)13014: 2025-05-18 19:15:53 scanunit=manager pid=305: Error: failed to validate av package /data2/avai (no13015: 2025-05-18 19:15:53 signature)13016: 2025-05-18 19:15:53 scanunit=manager pid=305 str="Some AVDBs failed to load."13017: 202

Hello Team,whenever I tried to access to Fortinet support page I see this error page: Hmmm… can't reach this pagesupport.fortinet.com took too long to respond

When I log into FortiCloud I can access the services page, but cannot get beyond that to see any devices. Anyone else having issues?

Hello, We have implemented a vulnerability scanner in our organization, which has detected, among other things, that our FortiGates are listening on port 853 and are presenting themselves with a certificate, which is called "Fortinet_Factory" in the Fortigate web UI. Could you tell me if it is normal that this port is open despite the fact that DLS over TLS is disabled on the device? What other service could be listening on this port? The policy of my organization is to remove all vulnerabilities, so a vulnerability related to the fact that a certificate is not recognized or that a negation has occurred using a set of ciphers considered by the scanner as insecure must be eliminated. Thank you in advance for your help

Hi All, one of my customers has two branches, each one with a Fortigate 40F. Both appliances use SDWAN to balance outgoing traffic between two ISPs each has 2 ipsec tunnels pointing at the other branch and 4 ipsec tunnels pointing at their AWS instances.The routing for th vpns was configured with static routing but I wanted to use SDWAN also for the ipsec traffic, so I crerated new SDWAN zone and members for the tunnels pointing at AWS. I followed this Technical Tip except for the fact that the tunnels were create previously so I just added them to the new sdwan zone and set a performance sla source IP via the cli. Now the new sdwan zone works fine, I've tried knocking down the tunnels one by one and the ping sessions to AWS stayed up perfectly, on both Fortigates. Though if I look at the performance SLA's tab one fortigate shows as if only one tunnel was working, while the other shows as if none of the tunnels worked. I'm posting a couple of screenshots: Performanc

Hi team,Does anyone know how to get the license expiration date by using an API call, either to FG directly or to FMG (with ADOM)?API with the format /api/v2/monitor/license/status/ is not showing the expiration date 

Dear All, Hope you are doing good! Current Scenario:We are using forticlient for dialup ipsec vpn using IKEv1 with Two factor authentication.FortiGate tunnels are authenticated via Radius (PAP) from FAC.Forticlient ---> FortiGate -->(Radius)-> FortiAuthenticator Forticlient version:  6.4Fortigate:                  200E firware 6.4.3FortiAuthenticator: 300F firware 6.3.2 Required Scenario:we need to shift IKEv2 and do following changes in existing tunnel but tunnel didn't connect.set ike-version 2set eap enableset eap-identity send-requestRadius B/w FG and FAC.change authentication method from pap to MSCHAPv2 on FG and PEAP in FAC Radius Policies. (Radius connection Successful) Troubleshooting:IKEv2 VPN successfully connect with local user on firewall.found mismatch authentication method on FAC in debug logs. If anyone have idea about this please guide. R

Hi all,I'm trying to move our VPN's away from SSL to IPSEC which I've managed to do for our Windows machines (which are the majority) but I've been struggling to get iPads to work so I've managed to get them working on IKEv2 with a pre shared key as long as i don't enable 2FA (just to confirm the VPN works) but I've found an updated post on Fortinet that due to a limitation on IOS that you can't use 2FA on IPSEC with a pre-shared key and the only option is to use SAML certificates however there seems to be a lot of confusing information on going about this and what exactly is needed.....so....am i correct in understanding that to get iPads to connect using IKEv2 and 2FA that i only need our FortiGate 100F and an identity provider such as Azure ? I don't NEED EMS or anything else to get this to work do i ? Also can the 100F do the IdP part as well instead of Azure etc just so it's all contained on the one box ?I'm just trying to clarify what different devices/platforms i need to ge

 Hello, the tool WebFilter is blocking an internal use web link whose funtcion is recopile call ingress, very useful when we have incidents. nowbeforeNow it doesn´t work, please help

In which architecture is the need to control application traffic becoming increasingly relevant?Question 25 (Select one:)A. Traditional client-server architectureB. Peer-to-peer architectureC. Cloud-based architectureD. Distributed architecture My Answer : C. Cloud-Based architecture but this answer showing wrong after exam complete what should i do now??

sometime it show 5mpdk73202545810641555mpdk

When the application (google drive)upload or sync file, the traffic will trigger the DOS UPD flood as below. itime=1436345294 dstname=tl-in-f116.1e100.net device_id=FG600B3909601201 log_id=18432 subtype=anomaly type=ips pri=alert policyid=0 serial=0 attack_id=285212772 severity=critical sensor=block_flood src=*.*.*.* dst=64.233.189.116 src_port=56355 dst_port=443 src_int=port4 dst_int=N/A status=clear_session proto=17 service=https user=N/A group=N/A ref=http://www.fortinet.com/ids/VID285212772 count=507 incident_serialno=0 msg="anomaly: udp_flood, 2074 > threshold 2000, repeats 507 times" vd=root identidx=0 attack_name=udp_flood intf_policyid=0 date=2015-07-08 time=16:48:14itime=1436345279 dstname=tl-in-f116.1e100.net device_id=FG600B3909601201 log_id=18432 subtype=anomaly type=ips pri=alert policyid=0 serial=0 attack_id=285212772 severity=critical sensor=block_flood src=….dst=64.233.189.116 src_port=56355 dst_port=443 src_int=port4 dst_int=N/A status=clear_session proto=17 se

I have created ADVPN in one hub and two branches with two isp. my issue is one tunnel traffic all are working but when down active tunnel and all traffic going via this tunel but my issue is branch hub connectivity ok but branch to branch not ping. Please see the below.  

DearsI attempted to locate the FortiEDR components under the Products tab in the Fortinet Support Portal, but I was unable to find any items related to FortiEDR.Could you please advise where I can find and download the FortiEDR installation packages

Onsite Hardware Loaner Services3 year 24x7x4 Onsite Hardware Loaner for FG-60FPN: FG-60F-24x7-OHL-R-3YR What is the service as same as a FortiCare PRMA Service4 Hours Hardware Delivery Priority RMA ServicePart No :- FC-10-0060F-211-02-361 Year (24x7 FortiCare PRMA) Both are services are same or any diffrenc

We use Edge site FGT 70G. We have 70 G on 20 and above. It comes with 7.2.8 version. I can upgrade to 7.2.11. Will 7.4.X or 7.6.X be supported for this device? Will it be used in the future.

I want to restrict by allowing some hosts to be can access my fortigate using public IP and block the rest.Searching in the community this can be done by creating local-in firewall policy but in my fortigate there is no local-in policy. How i can enable this?

Hi everyone,I'm currently working on configuring a Dynamic VPN (DVPN) setup using FortiGate firewalls. The topology includes two main hubs and multiple spokes (branch offices). I'm trying to understand the best way to structure the VPN connections.My question is: Is it possible to configure a single tunnel from each spoke that connects to both hubs, or is it required to set up a separate tunnel from each spoke to each hub individually https://100001.onl/

Hi guys, We are using fortinac as NAC and we use mostly laptops with external network adapter, so the issue is if the laptop is registered and someone takes the external adapter and plugs in to his/her laptop, it is not isolating for the new host (Laptop) it gives full network access. and when we check the port, it shows us the new host is registered with the existing user (registered previous laptop). Any solution in this situation?  

Hello , I wanted to ask if it is possible to provide separate internet connections to two Fortigate ports(2 ISPs) and route internal network traffic to one of the internet ports based on the destination address.?thank you

My FG has SSLVPN service configured that gives remote users access with username/password via LDAP with Mobile FortiToken or OTP via email double authentication activated for all users.Some users have reported to me that they can access by simply entering only username and password and is not asked to enter the token.How can this happen if all users have enabled double authentication for access to SSLVPN? Attached the error shown on FG (firmware version 7.0.17).User configuration: # show user local xyzconfig user localedit "xyz"set type ldapset two-factor fortitokenset fortitoken "FTKMOB11016D9D2B"set email-to "xyz@xyz.com"set ldap-server "LDAP"nextend  

I Have WAN and LAN port.But I am trying to create vlans under the lan port, see the picturesThe LAN(port2) network is working fine on my vm's. It works also through dhcp server relay. The ip adresses of my 2 vlans created under the LAN(port2) are not working in my vm's. and they cannot reach my Vm's. I also created firewall policy from the VLANs to the WAN port, but that doesnt work eitherI Am using Hyper-v Environment. Any Suggestions please?