Fortinet Community

Hello,I've been working on setting up an IPsec VPN on our FG200E after upgrading to FortiOS 7.6.7, mainly so we can take advantage of DNS suffix assignment from the firewall.Our environment has two separate Active Directory domains in a trust relationship: old-domain and new-domain. In the config vpn ipsec phase1-interface configuration, I've defined DNS suffixes for both domains and configured the DNS servers with the old-domain DNS first and the new-domain DNS second.Everything seems to be working correctly for resources in new-domain, but for anything in old-domain, I have to use the full FQDN to access it. This creates a major issue because some of our internal applications reference hosts by short name rather than a fully qualified DNS name.We're currently using Cisco AnyConnect, and it works perfectly—users can access shares and applications using just the host name without any DNS resolution issues.I've already opened a ticket with Fortinet, but I wanted to check if anyone else

Hello, we have several Fortgates, swites and AP. But one of my former collegues. has not written down which Contract Registration Code was used for which device. Is there a way to check which Contract Registration Code was used on a device. w.k.r.Patrick

Hi allI have updated to FortiOS 7.2.3.And then I realized following bad configuration.----FG60F # config system email-serverFG60F (email-server) ## set reply-to noreply@example.comcommand parse error before 'reply-to'Command fail. Return code -61FG60F (email-server) #----By this Document, I can set 'reply-to'.http://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/526019/email-alertssomeone have how to config 'reply-to' in FortiOS 7.2.3?thanks.

Fortigate can block the Tailscale application with policy and application control; it will block both inbound Tailscale sessions and outbound Tailscale sessions. Is it possible to block only inbound Tailscale sessions, and still allow outbound Tailscale sessions on the firewall?

Hello there,I want to update FortiClient EMS signature manually. FortiClient EMS 7.4.7. My deployment mode is airgap. I have downloaded the service updates from support.fortinet.com.Now how I can insert it to EMS server.Kindly help me on this.

This week's updates deliver a broad refresh across FortiSOAR™, spanning Fortinet Fabric integrations, threat response content, and a large set of connector enhancements that strengthen automation across the security operations lifecycle.Several Fortinet Fabric connectors receive updates this week, including Fortinet FortiAI, Fortinet FortiAnalyzer, Fortinet FortiSIEM, and the FortiGuard family (IOC, Outbreak, and Threat Intelligence), deepening orchestration across Fortinet's threat intelligence and analytics services. Core FortiSOAR™ connectors such as AI Assistant Utils, Code Snippet, Utilities, and the FSR Agent Communication Bridge are also updated, improving the building blocks that power custom automation and distributed deployments.The integrations ecosystem expands with two new integrations, ANY.RUN Threat Intelligence Feeds and ANY.RUN Threat Intelligence Lookup, alongside an upgraded ANY.RUN Cloud Sandbox connector. Enhancements to more than a dozen widely used integrations,

Since last week we experiencing a lot of problems with Windows updates (mostly Windows 11, but there was one Windows 10 among them as well), specifically KB5040442. On about 10% of our Windows clients the update would start and go until 96% and stay there for 10-60 minutes, and then after a restart Windows would tell us that something did go wrong and it would reverse the update. This would require multiple restarts and anything in the order of 2-10h. The usual information sources did not reveal anything unusual with this update round, so it had to be some uncommon conditions here. When Windows was back online, it would sometimes (!) show an error code 0x800f0922, oftenly nothing, and on next restart it would try to install it again (and our employees losing again 4-10h with a working computer). First remedy, as described in the error code was to increase the size of the recovery partition to at least 250MB, but that helped only on one computer. No other things related to the code

Hello community, We are currently running Forti EMS Cloud 7.4.3 with several endpoint versions, mainly FortiClient 7.2.11 y 7.0.X on Windows 11 devices.We are working together with the customer and Microsoft support to troubleshoot an issue where Windows Update downloads do not complete and the update process becomes extremely slow or stuck. Issue Description:When endpoints have a FortiClient profile with Sandbox enabled, Windows Update shows the following symptoms:Update download does not completeIf we change the endpoint policy to Default profile (no Sandbox), the Windows Update process completes successfully. Tests Performed To verify this behavior, we performed the following tests: Disabled Sandbox profile → Windows Update completes normallyRe-enabled Sandbox profile → Windows Update fails or hangsWe tested with multiple Windows Update components excluded:TrustedInstaller.exeTiWorker.exe (Windows Modules Installer Worker)DISM.exeC:\Windows\WinSxS\C:\Windows

I have integrated Darktrace Syslog with FortiAnalyzer. When Darktrace sends logs in JSON format, the log messages are truncated in FortiAnalyzer. However, when I configure Darktrace to send logs in CEF format, the Message field in FortiAnalyzer is empty.Could you please advise on the cause of this behavior and recommend the appropriate configuration to ensure the complete log message is displayed in FortiAnalyzer?

Hi,I recently implemented FPAM and I have a strange behavior with all the web launching sessions.The FPAM is in a subnet dedicated.My pc is on another subnet and the internal services and external(obviously) are on other subnets.In the middle there’s a Fortigate.I have also an ACL for deny the traffic to the internal services from my pc, so I must traverse the FPAM to reach the services.I launch multiple web launching sessions to multiple sites internal and external and after so much time, I can’t define how much, I receive some ERR_CONNECTION_TIMED_OUT from random sites.If I try to reopen the site, I can no longer access it; I have to wait a long time before it starts working again.From what I've gathered so far, connections are more stable if I use the site's IP address directly instead of the FQDN, but sometimes are slowly(But at least they don't time out.)When I have the reset, the FPAM is capable of ping and resolve the destination internal or external site, seems to be a problem

Hi All Community member and expert. Do want to request whether you guys encounter or experience issue as below: Incident that when request change of FortiSASE POP, the Fortinet engineer change without validating the settings (Which require deletion of Geo Fencing), which have configuration dependencies causing our specific POP down including whole SAML service down in FortiSASE on production. (Ticket 11464065) While providing feedback on same ticket (11464065), the related Fortinet Manager promise to improve the procedure on next time check to check on the Geo Fencing and Fortinet engineer had log a bug in ticket (11398499) that will check whether there is existing Geo Fencing if customer request POP changes before implement. We trusted Fortinet on that at the moment regarding the fix and procedure improvement.Due to we have different Business Unit, we have another FortiSASE need request to change POP, then same issue happen causing production impact, further reported in ticket (114276

Hi,after upgrading our FortiGate HA cluster from 7.4.12 to 7.6.7, we noticed a significant increase in the daily log volume sent to FortiAnalyzer.Environment:FortiGate: 2x FG-200F in HAFortiOS: 7.6.7FortiAnalyzer: VM, currently 8.0.0Logging: FortiAnalyzer​Before the upgrade, our daily log volume was normally below the licensed GB/day limit (15 GB). After the upgrade, the daily log rate increased by approximately 8–10 GB per business day, without any intentional configuration changes on the FortiGate side.For a normal business day we now see approximately: Application Control log: ~10 GB/day, Traffic log: ~9 GB/day​No firewall policies were intentionally changed, and we did not enable any additional logging options manually after the upgrade.We have already checked the following:- no known configuration change was made on the FortiGate before/after the upgrade- application Control logging is enabled as before- SSL inspection is enabled- FortiAnalyzer is receiving logs correctly- The inc

Hi,I’m trying to change default admin account, but after rename command in the cli I have error:fml (admin) # rename admin to admin_disabledCommand failed(-37). Error string:Is not possible to change this account on fortimail?

I've been experiencing a wide array of issues with FNAC lately.I won't get into them all, but one that is really irking me is when I browse to the FNAC home page via HTTPS, I login successfully, I click on any navigation item (i.e Inventory) and then I immediately lose connectivity to the UI and am not able to reconnect. Only via a reboot is the page restored.I also lose SSH access. The only remote access that remains is via console.We are in HA and that does not invoke either. FNAC still responds to ping so presentably that is why.Kinda getting sick of it.

I’m having issues establishing a connection when IPv6 is enabled on the Windows client’s Wi‑Fi interface. As soon as I activate IPv6, the connection to the Fortigate fails. Has anyone experienced this or knows what might be causing it?If you want it more technical or more detailed, I can refine it.

Regarding a FortiGate system configured in an active/standby high-availability (HA) setup,we initially set the Device Priority value for Unit 1 to 200 and the Device Priority value for Unit 2 to 128 (the default).However, even though we hadn’t made any changes, the priority value on the standby unit had changed to 200, the same as the active unit. We attempted to manually change the priority value on the standby unit back to its original value of 128, but an error message stating “The entered value is incorrect” appeared, and we were unable to make the change.The system recognizes the active/standby configuration and no abnormalities are apparent in the HA setup, but what is the cause and how should we proceed?

Working on a branch office to HQ redundant vpn setup.  Each location has 2 ISPs and I had planned on following this: Manual redundant VPN configuration | FortiGate / FortiOS 8.0.0 | Fortinet Document Library just using 2 tunnels (primary ISP to primary iSP, backup ISP to backup ISP) with static routes to force the backup tunnel over the secondary WAN at each location.  Is there any drawback to this approach?  I had considered using SD-WAN for the vpn traffic or possibly BGP but wasn’t sure if either offered a significant advantage in this situation.  The branch office has a single /23 network and HQ has only 3 or 4 networks that need to be accessible.  And the request is for the tunnels to utilize ISP1 as the primary when available.

Good day, everyone.I have been experiencing intermittent SPF false positives in **FortiMail 8.0.0**. In some cases, FortiMail reports that the sender's domain does not have an SPF record. However, after verifying the domain manually using both our internal DNS servers and public DNS servers, the SPF record is available and resolves correctly.I would like to know if there is any configuration or best practice that could help reduce these false positives. For example:* Is it possible to increase the DNS query timeout used by FortiMail?* Is it possible to adjust or reduce the DNS cache timeout?* Are there any recommended DNS-related settings for improving SPF validation reliability?One behavior I have noticed is that multiple emails from the same sender domain, received at nearly the same time, may produce different SPF results. Some messages pass SPF successfully, while others are rejected because FortiMail reports that no SPF record was found.Our environment consists of **two FortiMail

Hello everyone,I am using a FortiGate 40F running FortiOS 7.4.12.I would like to know if there is any supported or unsupported method to prevent the FortiGate from saving Alert, Error, and Critical logs in the local memory.My goal is to stop these logs from being written to the internal log storage, not just hide them in the GUI or change their display.Has anyone found a solution, workaround, hidden CLI command, or TAC recommendation that can completely prevent these logs from being stored locally?Any help or experience would be greatly appreciated.Thank you.

Hi I tried migrating the FAZ-400E config to a FAZ-1000G, but after rebooting, the configuration wasn't applied.but migrating the same config to a FAZ-VM works without any issues.(OS versions are identical).

Can Fortinac do the Revocation List to block certificate was revoked?

My scenario for contractor is they login to the network and get isolation network, then after enter the credential the device will connect to guest network and we must change the Host Role from Guest to Contractor then the device can access to the network.Vlan changing from isolation to guest and to contactor network is working fine except if vlan guest doesn’t have internet access then after credential entered then there are pop up in the browser say ‘Failed to detect a change in your network setting’ but vlan already changed to guest. When guest network have internet access then there no popup.Anyone know what url used by fortigate to detect that change ? My goal is to give internet access on guest network to specific url so the popup will not showing.

Hi, I have FortiGate-VM64 v7.6.7 running on VMware Workstation. When I access the GUI the page loads (no timeout) but it's completely white/blank.In Chrome DevTools Console I see:401 Unauthorized on all /api/v2/ calls Events websocket closed unexpectedly Reconnecting attemptsCLI works perfectly fine, I can login and configure via console. The interface has allowaccess http https ssh ping configured on the management port.VM has no active license (eval). Could this be causing the blank GUI?Anyone seen this before?

Ho we can make endpoint enter to isolation network if the persistent agent have fail result? And how often the persistent agent will doing the compliance scan?

So we recently migrated our SSLVPN users to IPSEC IKEv2 over TCP443, and so far no major issues, been quiet, outside of some small issues that we have been resolving pretty quick.Except a weird one popped up today that was being that I’m drawing blanks on. I had about 230+ users logged in, no problem, then all of a sudden when a user was trying to login for the first time or reconnect, any user who was trying to connect if they were handed the 172.26.2.180 IP, they would connect and then within seconds the Fortigate would delete the tunnel, and I don’t know why. If two people were connecting at the same time, one person would connect because they got a different IP, but the other user would have their tunnel deleted because they got the 172.26.2.180 IP. Makes no sense to me.Ran debugs for multiple users and you could see phase1 came up, phase 2 came up, and then within seconds the Fortigate would delete it only when it has that specific IP. Other IPs in that subnet no problem, no issue