Fortinet Community

Hi Everyone, I plan to implement Fortisandbox to ensure file uploads by users on the website are safe from potential threats. I would like to ask:1. How is the topology or architecture of this fortisandbox position placed.2. Is there a best practice or similar implementation reference that I can learn from. Thanks in advance for you help!

FortiGate running 7.4.2 This is probably going to sound weird but I setup my first ZTNA ssh proxy and it works.  However, in the firewall policy I have defined a few tags that can use the policy.  The tags are different ActiveDirectory Groups our EMS has picked up. So I have a tag for the Operations group (which I am a member of) and a tag for the QA group which I am not a member of.  Then we have a tag called EXAMPLE which is our entire AD domain.  All users in our domain are a member of this tag. When the firewall policy only has the tags Operations and QA with a match ANY I get a deny for this policy.  If I add the tag EXAMPLE to the policy I can use it. My question is is there a diagnose command I can run to see how the FortiGate is going through the policy and trying to determine if a users tag is a match or not?

Hi guysSpecifically, I would like to confirm whether the FortiWiFi-40F-3G4G supports tracking bandwidth usage per IP address and, upon reaching a defined threshold (e.g., 10 GB), can automatically suspend network access for that IP address or a group of IP addresses that exceed the limit. I would appreciate any guidance you can provide. Regards

Hello,I want to implement a FortiGate 600F HA Active-Active cluster, with the ISP’s equipment in bridge mode, providing a WAN IP via DHCP. Can you tell me if a router is needed between the cluster and the ISP’s equipment?

Hi,If I summarize correctly, we have 2 sites A and B.On site A, we have the fortigate which is a NAT router and the ISP's internet connection is connected to the fortigate.On site A, we have the fortigate which is a NAT router and the ISP's Internet connection is connected to the fortigate's WAN port.On site B, we have a 2nd Fortigate, and have connected port 1 of Fortigate1 to the WAN1 of the second Fortigate.On the Lan of the second Fortigate, we've allocated the CCTV cameras, and we'd like to view them from our site A.Fortigate1 LAN IP address: 172.20.100.1/24Fortigate 2 LAN IP address: 192.168.1.1/24Fortigate1 WAN IP address: 10.1.10.1Fortigate2 WAN IP address: 10.1.10.2

Hi all,  I hope you're well.  Hopefully you can help me, I have security-fabric running across multiple FortiGate firewalls and I have noticed that we receive no alerts from triggered automation stitches on our downstream firewalls. At present, I have the set configuration-sync set to local but I have seen documentation mentioning that this must be set to default. config system csfset status enableset uid "ed76b59ad28e4b088e9626a7f32dfc89"set group-name "<name>"set configuration-sync localset fabric-object-unification local My main concern is that I do not want to break anything, I want to keep the set fabric-object-unification local as I do not want to synchronise firewall objects and addresses to downstream devices I would only like the automation stitches to be handled by the root FortiGate and for the triggered automation stitches to alert accordingly.  Can anyone confirm that changing this to 'default' will onl

We have had FortiClient deployed without our business by a 3rd party and is managed via EMS.This is mainly for remote access, which is working fine. Though we have the situation a number of our users have additional user certificates beyond our standard user certificate due to the nature of some of their work, most are issued by 3rd parties for dedicated secure applications.So we have the issue of these users attempting to access services away from our estate and failing, as FortiClient defaults to the wrong certificate. Is there a way to set which cert the client should have selected? Rather then having them having to select the correct one?

Hello,I'm experiencing a limitation with my FortiAP 231F. I’m unable to add more than two SSIDs on the same radio (either 2.4 GHz or 5 GHz).Is this a restriction due to the current configuration, licensing, or a hardware limitation of the FortiAP 231F model?What is the maximum number of SSIDs supported per radio on the FortiAP 231F?

Hello Team, i have two FGT-400F.when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.HA status seems ok from cli but secondary appears out-of-sync HA Health Status: OKModel: FortiGate-400FMode: HA A-PGroup: 0Debug: 0Cluster Uptime: 0 days 0:43:2Cluster state change time: 2025-05-05 15:12:06Primary selected using:<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.ses_pickup: enable, ses_pickup_delay=disableoverride: disableConfiguration Status:FG4H0FTXXXXXXX (updated 1 seconds ago): in-syncFG4H0FTYYYYYYY (updated 2 seconds ago): out-of-syncSystem Usage stats:FG4H0FTXXXXXXX (updated 1 seconds ago):sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%FG4H0FTYYYYYYY (updated 2 seconds ago):sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%HBDEV stats:FG4H0FTXXXXXXX (updated 1 seco

Hey all I am looking to disable FIPS mode on a FortiGate 100E, 200E, 500E. Is it as simple as format, load new firmware, restore config? Is there anything in the config that needs to be edited out?    

I want to back up the entire FortiGate device to FTP/TFTP, including all configuration files, hard disk logs, etc. so that I can restore and review the information when needed. Could you please let me know the command for this?

Hi All, I'm having trouble getting new FAP431F AP's online. I suspect a PoE problem but can't find clear information in the documentation to verify. Hoping the community may be able to help clarify PoE requirements.I'm connecting the 431F's to a Cisco 2960 PoE switch (802.3af only). The switch detects the AP, grants 15.4 watts of power, port immediately flaps (up/down) 4 times, then the cycle repeats (logs below).%ILPOWER-7-DETECT: Interface Fa0/20: Power Device detected: IEEE PD%LINK-3-UPDOWN: Interface FastEthernet0/20, changed state to down%ILPOWER-5-POWER_GRANTED: Interface Fa0/20: Power granted%LINK-3-UPDOWN: Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/20, cha

I have a Fortigate 40F. I have been trying for weeks to get DNS Filtering working. The basic setup is simple. When a user goes to a restricted site they do get redirected but the Block Page will not show up as there is a certificate error. (This is understandable since the Fortigate cert does not have the same name as the page the person is trying to go to). For Web Filtering the solution was to download, install and trust the default Fortigate cert. This works for Web Filtering but it does not work for DNS Filtering.I have Googled endlessly with no solution. I have a support case open with Fortinet. So far, they have not been able to provide a solution.If anyone can help with this, it would be much appreciated.

hi Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used? If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.The final goal is to make all connections to a given destination IP on the Internet always go out through the WAN1 interface unless the WAN1 interface has lost communication with the Internet, in which case WAN2 can be used.

Just an info for you all. Upgrading from 7.2.10 to .11 the GRE tunnel in SDWan dropping connection for whatever reason. Downgrade to previous release solves problem... nothing is being mention in the release log.FGT 400F

Hi every one.We use in my company the ForticlientVPN-only software. We use it to access the VPN of our customer. (link https://links.fortinet.com/forticlient/win/vpnagent)On 2 HP laptops, the installation of these software crashes, avec that sequence :- Installator downloads package -> OK- Installator extracts package -> OK- Then a window opens 0.5 sec and close immediately- Then nothing. The installation of the Forticlient licenced software works fine on theses two laptop. Do you have any clue ? Thank you in advance

Hi, Trying to create/work on a physical link and a VLAN under it, but the connection is Down with red arrow down always. Looking at the hardware device nic information, the following is the output:# diag hardware deviceinfo nic port3Admin :upnetdev status :down.....link_status :Down I already checked the cable and LED lights. Anything else which I need to look into? Thank you!

I'm having issues connecting with Forticlient VPN 7.4.3 Running on a macbook pro Sequoia15.4When i click Connect, nothing happens.It says "Connecting" for about 30 seconds, then the button changes to "connect" instead.No windows with logon, no alerts.The channel is a SAML channel which works perfectly on our windows machines.I've removed and reinstalled the VPN client 3 times, and made sure that I didn't miss a "request for access" on the machine.I also tried while the Macbook was still on version 14.x but it gave the same error.Any idea's how to solve this?

I've been attempting get IPv6 prefix delegation for longer than I want to admit. And I'm close, but no cigar.So I request a /56 prefix from ISP.Got: delegated-prefix iaid 1 : 2600:8800:ab81:a100::/56YES, it works. So on the LAN I have SLAAC and DHCP Stateful server running. I have a network IP checker, and it looks like Macs, Android, and others are getting it. For this Mac:fe80::10e9:87a:620c:eeda2600:8800:ab81:a101:edf6:9551:c99f:6228 So it LOOKS like its working, but its not.  So if I look at the IPv6 addresses my Mac has it has several with this prefix, but it also has several others.  See attached below.  But I have no idea where those ab81:4a00 are coming from, but all my computers are using those addresses and they are not externally routable.  So no external web site can see my IPv6 address.  Does anyone know where these other IPv6 addresses are coming from, or maybe more important, how can I get rid of them.  I've come so far, but n

We are deploying Forticlient VPN ver: 7.2.4.0138 to about 400+ Chromebooks and Chromeboxes.We are trying to push out a Managed configuration with the deployment from Google Workspace.The managed configuration requires a JSON file. We can find no reference for field/key names required for this nor what fields/keys absolutely have to be present for it to work. We have experimented with field/key names based on an export of a forticlient vpn from a windows machine with no success. We continue to receive the following error on our chrome devices. "Discarding policy for component app:com.fortinet.forticlient_vpn due to data validation failure: The JSON blob dictionary value doesn't contain the required Value field"  The client deploys without issue, the actual VPN works without issue when manually configured. We are not Fortinet customers, we have a 3rd party vendor who provides the VPN but has refused to help with the JSON configuration. Can anyone provide a reference/doc

Hi, I’m trying to delete multiple users in FortiMail using a script, but the command config user local doesn’t work. What’s the correct command to delete users via a media script? 

I am trying to generate a CSR on the Fortigate and getting the message "etc/cert/local/root_"certname".key: Read-only file system".I have full super-admin permissions on the Fortigate. Has anyone seen this before?

Fortigate + Fortiswitch + Fortiap, wired and wireless NAC work fine on their own. But how to configure nac for bridge ssid configure for a vlan created under Fortilink. Briefly there is Vlan 10 under fortilink. When I apply Fortiswtich port nac mode, wired users are successfully logging in and getting ip. How do I apply this to wireless users. How do I ensure that both wired and wireless users get ip from the same network and are included in the same vlan.

Pid: 02023, application: fnbamd, Firmware: FortiGate-120G v7.4.6,build2726b2726,241210 (GA.M) (Release), Signal 11 received, Backtrace: [0x7fa186367c] [0x00c9b6a4] [0x00c9cfb8] [0x00c8c8f0] [0x00c8cab0] [0x02b2c80c] [0x00caaaa8] [0x0044eaac] [0x004543bc] [0x00454944] [0x004575f8] [0x004580fc] [0x7fa1b12f24] [0x0044a550] [0x0044a550] System event i got but reason and coot casue i am not able to get?

I have tried to setup two FortiAnalyzer 300G in Geo-Redundant HA. Version 7.6.2The devices are on two different locations and have identical hardware and setup.It always failed to sync the initial config.On secondary FAZ I only see this logs:FAZxxxxxxx, dvm, dvmcmd control, Unregistered device xxxx_FG201F add failed, Add device, xxxx_FG201F, Unregistered device xxxx_FG201F add failedFAZxxxxxxx, fazsys, system, Unable to accept logs from Device (FG201Fxxxx 10.xx.xx.x) due to internal error, errcode=-1002.,Receive logs, Fail to receive logs.First time I have solved this problem by exporting the logging device list and import it to secondary before setup of HA. But after Upgrade to 7.6.2 this has not worked anymore.I was just before creating a support ticket, but then I got the idea with certificate.We have an internal PKI and have installed our own certificate for FAZ.SAN is correct, CA and chain Certs are installed. All look good.So I had used the certificate from PKI in the config of H