Fortinet Community

Hello Dears we need to setup QOS service for MS-team meetings , any suggestion for implement that on fortigate 201F firewall ? Bests

Hello EMS adminsFortiClient EMS 7.4.0 with FCT Agent 7.4.0 on Windows 10 client.Enabled the "FortiClient telemetry connection key" option in EMS settings.When registering a client with invitation it doesn't prompt for telemetry connection key.Did I miss something or is this a normal behavior?

hi I am planning to configure the following setup, but I would like to know which of the latest FortiGate models currently available in the product lineup support internal hardware switches.Configuring SD-WAN in an HA Cluster Using Internal Hardware Switcheshttps://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/931221/configuring-sd-wan-in-an-ha-cluster-using-internal-hardware-switches I found information about older models in the following link, but I would like to know the support status for internal hardware switches on the latest models.I also checked the "Feature/Platform Matrix" mentioned in the link, but there is no "Hardware Switch" section in the materials from v7.2.1 and later, so I am unsure which models support internal hardware switches.Compatibilities of Hardware Switch with FortiGatehttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Compatibilities-of-Hardware-Switch-with-FortiGate/ta-p/231298 

Hi, Is there someone having the offline installer of VPN client? i'm trying to install forticlient 6.4 (latest) but it's showing unable to access image servers. OS: windows 7 Professional 64 bit Thanks.

Hello Team,                 From the links below, I can understand that there won't be support for the SSL VPN tunnel any more starting from software version 7.6.3.Does this include all platforms? my firewall model is 1801F, we have not deployed the VPN yet but planning in the near months.and what about countries that do not allow using of the IPsec VPN?TIA

Basic Information: Device: OPPO Reno4 Z 5G Operating System: ColorOS V12.1 (latest version) Android Version: Android 12 (latest version) FortiClient VPN Version: 7.4.2.0179FortiGate Version: 7.4.7 Issue Description: When using the campus SSL VPN, the connection is successfully established, and an IP address is obtained after entering the username and password. However, after exiting the FortiClient VPN application (APP) and opening other applications, the SSL VPN connection is found to be disconnected. Attempts to resolve the issue, including using different accounts, reinstalling the APP, and configuring the APP to run in the background, have been unsuccessful, with the same issue persisting.

Hello Dears How can i create a report for web browse a fortigate 100f when you dont have any susbription to forticloud or fortianalyzer ?

Hello,  The Windows version of the Forticlient has a setting for IKE Version 2, but the OSX version does not. Any idea how to set IKE2 on the OSX version?

Hello,I have installed forticlient vpn 7.4.3.1790 (version free not EMS). The IPSEC VPN connection is not working. The error message is as follows: "Timeout while connecting to 217.xxx.xxx.xxx".With Forticlient 7.2.3.0929 the same IPSEC VPN connection works fineFortigate 400E FortiOS  v7.4.7 build2731 (Mature)Can you help me?

Hello and sorry for my english, We want to configure VPN IPSEC and MFA for my users on fortigate. For that, it is neccessary to have Fortiauthenticator or not ? thanks a lot  

When downloading and installing FortiClient VPN for MACOS (FortiClientVPN_OnlineInstaller.dmg) the installer indicates that it could not connect to the update server. Can anybody provide me  with the offline installer perhaps? 

Hi Everyone,I'm deploying an application running as a Docker container on a VPS for a client. The application needs to read data from a database hosted behind the company firewall, so I must create a site-to-site VPN tunnel.The client uses FortiNet as a VPN provider. I spent half an afternoon googling for a solution. Gluten seems to be a popular solution for creating VPN tunnels with Docker, but I'm afraid it's not compatible with FortiNET. So, now I have no idea how to make it work. Can anyone point me in the right direction?Thanks for any help.Sig

hi all, I have a fortigate 1100E and need to set up two WANsI need WAN1 to handle internet for users and WAN2 to handle the traffic for  applications that are accessible from the internet.the problem is that the users and applications are all in the same LAN and the default route in the fortigate goes to the WAN1.how can I force the reply of  traffic that came from WAN2 to LAN(application data) to not use the default route that goes to the WAN1 and use the WAN2 Path?

Commit failed: Minimum psksecret length is 6  I'm  deploying ipsec vpn Template from Fortimanager, I get this error when I make Install Config:Commit failed: Minimum psksecret length is 6 but, my psksecret is more thant 6 Fortimanager 7.6.2, Forigate 7.4.5It work on anothers Fortigates Maybe someone knows some solutions ?

 The issue is that from time to time, all of our FortiGate firewalls under the Motorad *ADOM* prompt us to verify and accept the FortiAnalyzer serial number. Even after clicking "Accept" to verify the certificate, this prompt keeps reappearing periodically across devices. This is highly disruptive for our customer, who must either contact me each time or manually confirm it himself — something that understandably causes frustration. Additional context: - These FortiGates were previously connected to a different FortiAnalyzer instance and were migrated to this current (newer) FortiAnalyzer setup. - In our past experience, once the FortiAnalyzer serial number is accepted and verified, the prompt should not return. - However, that is not the case here — the verification message keeps appearing across multiple firewalls.

Dears,Is there is away to force all the internal-vpc subnets to be through the fortigate,the setup is like this:external-vpc with a external-subnet and there is a default routing 0.0.0.0/0 pointing to the internet gateway.internal-vpc with two sebnets backend-subnet and backend-subnet pointing to fortingate internal interface ip address.Is there is away to force backend-subnet and backend-subnet to communcation through Fortigate. since they have a default route to commnicate directly right now.Kind Regards.

Maybe someone with a deeper understanding can shed some light on this.I've set up an IPsec VPN using certificate-based authentication and tested it with a small user group — it works great.I then handed it over to software delivery. They did what they usually do with the SSL-VPN profile: extracted the config from the registry and bundled it with FortiClientVPNSetup_7.2.8.1140_x64.exe.Now the issue after deployment:The IPsec profile appears in FortiClient. The user selects it and clicks Connect → Status shows Connected.However:Bytes received: 0 (remains at 0)Bytes sent: $somenumberOnly working fix so far:Uninstall FortiClient and remove all registry traces. & install FortiClient and manually add the IPsec profile.What doesn't work:Uninstalling and reinstalling FortiClient, then manually adding the IPsec profile — still connects, but no incoming data.Adding the IPsec profile under a different name. So it seems there is something in the registry that messes with IPSec exclusively

Hello team, I have configured VPN IPSec from PA to FGT but the pahse1 still down.I have enabled the debug from fortigate's CLI and following the results: debug commands:diag debug resetdiag debug console timestamp enablediag debug application ike -1diag debug enable debug output:ignoring IKEv2 request, no policy configured The peer from FGT is a public ip configured on WAN interface directly. Do you have any suggestions? Thanks for the supportBR 

I've been setting up SSO with SAML for our IOS devices and I've set it up on a completely different port and WAN IP than the IPsec for our Windows machines (which are working fine). I've got the SSO working to the point that the SSO asks to login and and then passes back to the FortiClient and this then starts connecting but then after a while errors saying "the VPN session failed to connect in a timely manner" so I've checked the FortiAnalyzer which shows it's an issue with "Peer SA proposal does not match local policy" so I've confirmed all the settings are correct on both sides and they are however the problem is that when I've setup IPsec on these before and there's a mismatch the FortiAnalyzer still shows me which VPN tunnel the endpoint is trying to connect to so I'm ok troubleshooting the VPN issue itself but as I've checked the settings are correct then why does it show as N/A and not the IPsec name I've given it for the IOS devices (in case it's related to the cause) ?Hope tha

After FC v6 was released, the free version of FortiClient removed the options for the "Auto Connect" and "Always Up" checkboxes. If you try to check them in the free version, it states you need a paid version. It now sounds like I need to purchase licenses (I'm guessing VPN/ZTNA at minimum), stand up an EMS server, configure it, and set up VIPs for it to be accessible to remote users and then point FC to it just to get those 2 options back. Is that correct or is there any way to avoid setting up and managing an EMS server?

FortiClient version (7.4.2.0179) which was installed on android version14 that was not successfully connected. It still shows connecting problem to SSL VPN. That problem occurred in all android devices in my organization which was using mobile internet SIM-network. All android apk are updated in google play store. But FortiClient version (7.4.0.1658) which was installed on window 10 tablet with the same mobile operation SIM-network, that was successfully connected SSL VPN client. What is the problem?  Best Regards,Johnie Zaw

Hello, Regarding the fortigate webfilter, I can use wildcards, but does it include multiple subdomains?If I use wildcards, can I have any number of subdomains with a singleasterisk? example:Domains defined with wildcards : *.example.comincluded? 　　　　　　　　　　　  :aaa.example.com, bbb.aaa.example.com, ccc.bbb.aaa.example.com 

Hi I have a problem with spanning tree and ports being disabled. I don't know what to do and it is annoying me at times and prevents me from working. Maybe someone has an idea for further debugging. My client (macOS) is directly connected to a FortiSwitch (124E), which in turn is directly connected to my 40F (trunk). There are some VLAN configured. Occasionally, the port (port20) my client is on gets disabled every few seconds and I lose connectivity. FortiOS is on 7.0.8 and FortiSwitch 7.0.5. The network setup is very simple.  +-----------+ +-----------+ +---------+ | +--------------+ | | | WAN +-------+ 40F | TRUNK | 124E +--------------+ MAC | | +--------------+ | | | +-----------+ +-----------+ +---------+  The error messages are as follows: primar

"I don't know how to use it properly when both the web filter and DNS filter have Category-Based Filtering features. If I enable Category-Based Filtering in both the web filter and the DNS filter, will there be any conflict?"

Hello there,I have fortigate 201G and i configured 4 wan links on fortigate.4 wan links are added in virtual wan link and configured the sdwan rule as IP based.Now i have no traffic shaping is enabled in my fortigate but i am facing issue regarding link speed as download speed is to much slow like one Mb and upload is 90 Mb, i have 100 Mb links. Manual static routes are also configured in FortiGate no route is configured with virtual wan link all four default routes are configured with the their respective interface. Kindly help! i have checked everything there is no traffic shaping, no MTU mismatch, every policy is well configured with the outgoing as virtual wan link and incoming as my lan i cant find anything which restrict the traffic for outgoing