Fortinet Community

Hello, Can i deploy FortiGate VM on Huawei private cloud? is it supported and compatible ?  And could you please advise what are the supported hypervisors/platforms on Huawei private cloud for the VM Deployment? And does this one ( Huawei Cloud EulerOS 2.0 64 bit - CentOS 7.9 ) supported for FortiGate VM deployment ? Thanks in advance

By default if we enable MFA on fortinac for accessing web admin then the token will be expired only in 1 minute.I think 1 minute i’s to fast if we have problem with delay when we receiving the token by email. Can we increase the token expiration example to 5 minutes? 

Hi, community Forti. I have a fortigate 100D but a WAN port broke down; now ot only gives me 10 mbps instead of the normal speed. So I want to use a LAN port as a WAN port but a I have some questions.The Lan port can fuction properly? The speed is 100 mbps The Wan port can be repaired?I know that I need change policies and more things. All for the LAN port.

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

I've been brought in to help an organisation with a large branch network get proper value from their FortiManager. It was set up by someone else and never became the single source of truth. They want to push policies, templates, firmware and switch and AP settings from FortiManager, with no policy mismatches and no per-firewall changes. It's a live environment, so any approach has to avoid outages.EnvironmentFortiManager VM 7.6.x in HA, with several ADOMs100+ FortiGates (mixed 60F, 40F and 100F class units) all on the same FortiOS 7.4.x buildA large number of FortiSwitches and FortiAPs through FortiLinkHub-and-spoke SD-WAN, which works fine and is out of scopeWhat I found (read-only access)Far more policy packages than makes sense for the number of devices, and many devices have a package to themselves. This looks like cloned packages instead of meta variables and dynamic mappings.A number of devices show Modified config status, concentrated in one ADOM, and I haven't seen any Synchron

Hello,we currently use several FortiExtenders as WAN extensions in combination with 5G, SIM cards an IP passthrough. While this seems like the optimal solution we randomly encounter issues because the ISP assigns random CGNAT subnets through DHCP within 10.0.0.0/8. This seems completely random and may or may not conflict with our internal networks.I have thought about using the FEX in standalone NAT mode so I am able to use deterministic transit networks on the FortiGate. However in that case we lose the nice FortiGate integration & management.Has anyone an idea how this can be solved more elegant? Can NAT mode used while the extender is managed by FortiGate?

Hi everyone,We are experiencing a serious issue with the Automation Playbooks functionality in FortiAnalyzer 8.0.1 following an upgrade from FortiAnalyzer 7.6.x.All automation playbooks were working correctly on FortiAnalyzer 7.6.x. However, after upgrading to 8.0.1, multiple playbooks using different connectors stopped working.Environment: FortiAnalyzer VM: 8.0.1 Previous FortiAnalyzer version: 7.6.x FortiClient EMS: 8.0. 1. FortiClient EMS ConnectorThe FortiClient EMS connector is configured, enabled, and displayed as healthy (green) under Active Connectors.However, running actions such as Get Endpoints or Get Vulnerabilities fails with:Failed to execute task "Get Endpoints":cannot access local variable 'connection'where it is not associated with a valueThe same error occurs when using a newly created EMS connector task.2. Active Directory ConnectorAutomation tasks using the Active Directory connector also fail:Failed to execute task "Get User from AD":cannot access local variabl

I have a FortiGate firewall with FortiGate switches all connected via Fortilink in the firewall.  I have a requirement to now connect 20 PLC devices that share the same ip addresses to our network.  I am not able to re-ip the PLC devices so need to figure out the correct NAT setup for this.  I have setup each PLC in its own vlan (Vlan 3001-3020). Each vlan its own unique subnet as the primary subnet (10.0.2.0/29…..10.0.2.210/29).  I then added the overlapping subnet (192.168.1.0/24) as a secondary subnet to each vlan.  Dnat and Snat ip pools have been setup for each device and firewall rules have been setup to allow the communication. The snat is working I am able to ping from each PLC device to the corp network.  The problem I have is the Dnat ping from the Corp network to each PLC device.  Because of the overlapping subnets the VIP is converting the traffic back to the 192.168.1.1 address and the firewall is routing all traffice back to one vlan not the correct vlan. I have searched

Network Components:2 ISP (SDWAN)2 FW(HA)2 RTR(Redundant WAN)1 SW(L3)Current setup: LAN(L3) → FW(HA) → ISP(SDWAN) → NET                           ^→ RTR(WAN) → NET                          Routing: L3 SWChange to:  LAN(L3)--->FW(HA)-->ISP(SDWAN) →NET                                          ^→ RTR(WAN) → NET                                           Routing: FW(HA) Routing Architecture ChangeCurrently, the L3 Switch performs the routing for traffic destined for the WAN. Under the proposed design, WAN-bound traffic will instead be routed through the Firewall before being forwarded to the WAN Router.Considering the full-mesh redundant topology:Firewall HA: Active-Passive WAN Routers: Active-PassiveWhat would be the best interface design between the Firewall and WAN Routers to maintain redundancy while avoiding routing or loop issues?

Hey everyone,We currently have a couple of FortiGate VM appliances running FortiOS 7.2.13 and are using FortiClient SSL VPN tunnel mode for client remote access.I understand Fortinet is sunsetting SSL VPN tunnel mode in FortiOS 7.6.3. the business is not ready to pivot off SSL VPN so in the meantime, they want to know whether upgrading to FortiOS 7.4.x is a reasonable short-term bridge (Fortinet’s lifecycl page says says it’ll be supported until March 31, 2028/November 11, 2028). Questions:1. For those who have upgraded, has FortiOS 7.4.x been stable for production SSL VPN tunnel mode?2. Is SSL VPN tunnel mode supported throughout the 7.4.x branch, including later releases such as 7.4.8 or newer, or is there a specific 7.4.x version we should target/avoid?3. Since SSL VPN is hidden from the GUI by default in 7.4, is it still considered fully supported in 7.4.x, or is it more of a transitional feature?4. Can I upgrade directly from 7.2.13 to a 7.4.x release, or should I follow a specifi

FortiClient VPN 7.4.11.0198 on iPadOS 26.7.1 fails to establish an IKEv2 IPsec tunnel to FortiGate running FortiOS 7.4.12 build 2902 when Phase 1 uses AES256-GCM with PRF-SHA384 or PRF-SHA512.FortiGate accepts the Phase 1 proposal:ENCR: AES_GCM_16, 256 bitINTEGR: NONEPRF: PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512DH: MODP2048 or MODP3072However, FortiClient does not send the subsequent IKE_AUTH request. FortiGate eventually reports:negotiation timeout, deletingconnection expiring due to phase1 downThese combinations were tested:AES256-GCM / PRF-SHA256 / DH15: worksAES256-GCM / PRF-SHA384 / DH14 or DH15: fails after IKE_SA_INITAES256-GCM / PRF-SHA512 / DH14 or DH15: fails after IKE_SA_INITAES256-CBC / SHA384 / DH15: worksPhase 2 with AES256-GCM works correctly when Phase 1 uses either AES256-GCM/PRF-SHA256 or AES256-CBC/SHA384. The problem occurs with both SAML SSO and local username/password authentication, although authentication is never reached in the failing cases.I reproduced the issu

What is the latest recommended and stable FortiOS version for our FortiGate 60F?What is the recommended upgrade path, and could you please provide the step-by-step procedure for upgrading the FortiGate firewall from its current version to the recommended stable version?

I need to know how to configure the policy to provide email access with an attachment filter in FortiMail.

Hello Fortinet Community,We are experiencing recurring FortiClient VPN connection issues with one of our customers and would appreciate your advice.System Information:Device: MacBook Pro (Apple M1 Pro) Operating System: macOS 27.0.1 FortiClient VPN: 7.4.3.4323 (Free VPN Version) VPN Type: SSL-VPNProblem Description:The VPN connection works normally for several days. However, after some time, FortiClient becomes unresponsive when attempting to reconnect.Restarting the Mac does not resolve the issue. The VPN only starts working again after reconfiguring the connection, but the problem returns after a few days.Troubleshooting Already Performed:Verified the VPN configuration. Successfully tested connecting and disconnecting the VPN. Checked Fortinet network extensions and background services – all active. Reviewed FortiClient logs without identifying a definitive cause. Verified that the VPN works correctly immediately after reconfiguration.Our Questions:Is FortiClient VPN 7.4.3.4323 offic

Hello Team,Our FortiClient EMS uses a manually uploaded Let’s Encrypt server certificate containing two DNS SANs.Certificate renewal is already automated through our Salt master. After each renewal, we currently download the certificate and manually upload and apply it in EMS.We want to automate only the certificate deployment and activation steps while keeping certificate renewal managed by Salt. Or happy explore option auto renwal in EMS with two DNS SANs.Please provide the supported API or CLI procedure for importing the renewed certificate, matching private key, and intermediate chain, and assigning it to the applicable Web server and Endpoint control services.Please also confirm the required authentication and permissions, any service restart requirements, and whether this operation can run unattended on our EMS version. Thanks,

Hi Team,We plan to deploy a FortiPortal Scalable Cluster with two nodes in one DC and one node in the other. If the DC with the two nodes goes down, the single node can operate independently per the configuration:config system ha set min_nodes 1endWhat will happen when the two-node DC is brought up? Will it be enough to change the single configuration to a scalable cluster? Will the changes made on the single node during the outage be replicated to the other nodes?

Good morning teams 😊;For FortiClient EMS Trial, I created an IPsec VPN tunnel.However, I cannot export the XML configuration file with the VPN password included.Is there a way to export the VPN XML configuration with a password?What I would like is that when the user imports the XML configuration file (with forticlient) , they are required to enter a password before they can access the VPN.thanks for you support 😊

im having an issue with our FortiClient IPsec VPN randomly disconnecting users. we are running a FortiGate 60F, using IKEv1 with xAuth.The VPN connects and works fine, but sometimes it disconnects after just 4-6 minutes, while other times it stays connected for hours. I've tested this on different Windows laptops with FortiClient VPN-only 7.0.8 and 7.2.14, and both versions have experienced the issue.I've spent quite a bit of time checking the logs and running IKE debug on the FortiGate, during one of the disconnects, I noticed these messagesrecv IPsec SA delete, spi count 1recv ISAKMP SA deleteFrom what I understand, this means the client itself is requesting the disconnect, but I cant figure out why. There was no DPD failure, and Windows didnt report any Wi-Fi disconnection at that timeHas anyone experienced something similar? Is there anything else worth checking or changing in the current IKEv1 setup? I'm also considering switching to IKEv2, but Id rather understand whats causing t

Hello, I would like to use my 300D as some kind of ipsec concentrator.It will be used for a lot of dialup connections. Every connection is authorised by configured radius server. Till now everything is ok and configurated (phase 2 is established). Next thing is to assign ip taken from radius, which is connected to customer's mac address in radius database.Unfortunatelly i have no idea how to configure it. If i change anything phase 2 is falling down. May i ask you to give me advice how to move it forward please? It is my first post here, i couldn't find such problem using search mode :)

FortiGate-VM64-HV Trial Issue on Hyper-VPlatform:- Hyper-V (Server 2019) Gen 1 virtual machine- FortiGate-VM64-HV v8.0.1 build0245 (GA.F)- Trial LicenseIssue:The trial license activation completed successfully and the CLI shows "License Status: Valid". However, after logging into the web GUI, I logged out immediately.CLI access works normally.Network Connectivity:- Can ping 8.8.8.8 successfully- Default route configured via 192.168.1.254 on port1Relevant Output:FGT-VM64-HV-NZVQOU # get system statusVersion: FortiGate-VM64-HV v8.0.1 build0245 (GA.F)First GA patch build date: 260421Current Security Level: HighFirmware Signature: certifiedLicense Status: ValidVM Resources: 1 CPU/1 allowed, 1694 MB RAM/2048 MB allowedHostname: FGT-VM64-HV-NZVQOUOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeCurrent HA mode: standaloneBranch point: 0245Release Version Information: GAFortiOS x86-64: YesRouting Table:S* 0.0.0.

Hello Fortinet Community,I have installed FortiGate-VM64 FortiOS 8.0.0 in my EVE-NG lab environment.The FortiGate VM boots normally, and I am able to access the GUI login page.Current IssueI can successfully enter my credentials and the GUI appears to authenticate successfully. However, immediately after login, I am logged out and redirected back to the login page.In other words:Open FortiGate GUI. Enter username and password. Authentication appears successful. GUI starts to load. Immediately after that, the session is terminated and I am returned to the login screen.EnvironmentPlatform: EVE-NG Device: FortiGate-VM64 FortiOS: 8.0.0 Build: 0167 Image: FGT_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvm.zip Deployment: KVM/EVE-NGLicense StatusThe FortiGate license is showing Up to Date / Active, so there does not appear to be an obvious licensing issue.What I have checkedFortiGate VM is booting normally. GUI is reachable. Username/password are accepted. License status shows up to date. The

Hi everyone,I manage like 30 fortigate devices and I updated them to 7.2.13 when it was released.Since I got users complaining about slow SMB traffic inside IPSEC tunnel s2s. The users are all behind this 101E model and they are thé only ones to complain.Bandwidth is like 300KB/s during transfer in 7.2.13I tried to check ipsec config (encrypt. algo.) Changed and adjust MTU but the traffic is still slow...Since the users told me it started since last update I tried to rollback to 7.2.12. same issue. I remember that I updated 7.2.12 and 7.2.13 a week after. So I checked to rollback to 7.2.11 and now speed is back to normal like it was before 8MB/s.I'll open a ticket but it seems linked to this model. Anyone has the same behaviour ?

I've noticed an extremely strange thing upon upgrading some test FortiGates to the new version 7.6.7: the upgrade goes fine, and the FortiGate is happily online and is routing/firewalling-just fine. However, when trying to load the GUI it is just a blank page.I can see the little favicon loading for the FortiGate login page, but its just blank otherwise. I can SSH in just fine, so that is good. I do not see any settings reset in global settings, and strangely going to the http login instead of https sometimes works (I have https redirect turned on).As the FortiGate seems to be perfectly fine otherwise, I thought I'd see if anyone else has experienced this?Also I have tried multiple browsers with privacy/incognito mode on, so I don't think it is a cache issue.

we are using forticlient v7.4.7, today our users brought down their latest updates. Our VPN users are coming back down the VPN tunnel to download their updates, this maxed out our 1GB line. We have Windows updates set in the forticlient to go direct instead of using the tunnel. We also have the .exe and microsoft domain set to got direct. We are still seeing all this traffic coming down the VPN tunnel and then using our web filtering policies on the Fortigate to go out. Can anyone help with this?

Hello, good evening! I've been having VPN connection problems for a few days now. I've already tried reinstalling and configuring it, but without success. Currently, my connection is timing out and I can't access it. Could someone tell me what might be causing this? Thank you in advance.