Fortinet Community

Hey everyone,In some FortiSwitch models, certain ports are indicated as FortiLink ports. My question is: if, for some reason, I want to connect port 1 to a FortiGate firewall, is that label just for indication purposes, or is there some configuration that needs to be done with console cable on the switch to make FortiLink work through port 1?Also, some models, like the FortiSwitch 424E-FIBER, don’t have any FortiLink port indication at all. Does that mean that every port on these models can be used as a FortiLink port?

Hello, My FortiMail VM 7.4.6 was working perfectly until a 403 Forbidden error appeared for the administration GUI.Some additional network interfaces and routings have been added but none of the administrator users have setup trusted hosts. The Webmail interface is hosted on the same network interface and it is still working.The only admin access is on CLI mode via the ESXI console.   Have you some ideas ?  Thanks

Hi, I have two single VM FortiGates in Azure.Each FortiGate is in a different region. They were both configured with the default three subnets within a vNetI have peering between the local vNets and each local FortiGates vNet So traffic between each regions vNets and the local FortiGate routes correctly.The FortiGates also have a IPsec P2P to on-premise FortiGates and traffic also routes correctly. What I'm trying to achieve is routing from either Azure FortiGates SSL-VPN to the other regions FortiGate and local vNets. I have the SSL-VPN configured with its own subnet and all the required policies to allow the traffic. I have setup peering between the two Azure FortiGates vNets and even set a UDR routing it to the remote FortiGates internal ip x.x.x.68 I've set these two options on the peering.Allow 'Region1_FTG' to access 'Region2_FTG"Allow 'Region1_FTG' to receive forwarded traffic from 'Region2_FTG'Allow 'Region2_FTG' to access 'Region1_FTG"Allow 'Regio

FortiGate appears offline in Forti Manager. Both Internet connections are online, but if I disconnect and reconnect the LAN cable between the FortiGate and Forti Switch, it shows as online in Forti Manager. However, after a few hours, it goes offline again.

Hello! I just got this firewall used.I am wondering if it is possible to get the WAN1 port to give internet to the internal LAN ports.Is this possible? I haven’t been able to get it after hours of trying. Thanks!

Hello, I had Virtual Fortigate in Azure VM02, Version was 7.2.5Then I did upgrade up to 7.4.0 and now see this message: And I can't disable. Even if I'm trying to click "Begin" I can't do any migration, but If I click "Later" Fortigate is working as normal.  Very annoying message, how I can disable it?

Hallo, last week I updated the Fortigate to the new firmware. We use Fortinet and 2FA with Tokens. After the update no VPN-Token worked anymore. Noone could start a VPN anymore. I had to create new Tokens for everyone. Then it came into my mind, what if the Tokens for the Admin-Logons would not work anymore either. Would we be screwed or is there a possibility to logon without 2FA?

We have recently been provided with the free version of FortiClient 7.4.4.  After installing the software and importing our VPN config, we noticed that the VPN list was still empty.   We have uninstalled 7.4.4, manually removed any FortiClient folders and registry entries left behind. After a restart and reinstalling the software, the same issue occurs, and it's the same if we manually create a VPN.   Registry locations show that the VPN config has been successfully imported, and when we export the config from 7.4.4, it shows the same VPNs.  Right-clicking on the software in the system tray also does not show any VPNs to connect to. Is this a bug? Screenshot after the config import or a new VPN is manually created.

I've installed forticlient VPN client and opened the app and got white blank screen FortiClient 7.4.0macOS Sonoma 14.5

Hello! I wanted to ask for people who are using fortinac for authentication with radius and mac traps alongside persistent agent. How long does it take for a user to go from isolation vlan to production?

For C9300-48T-E with NM-8X connected to the Fortinet 401FSFP-10G-SR-S is compatible on both the sides?Both firewall and switch side....

Hello, I have a Zabbix Monitoring Server, and various Fortinet Products. All I can find is a FortiGate template. I can't find templates for the below: FortAuthenticationFortiMailFortiManagerFortiAnlyzerFortiWeb Does anyone have the relative templates or have successfully monitored the devices using Zabbix?

Hi All We have successfully integrated with RADIUS, and all user authentications are working fine. However, we need to import user groups from Active Directory into FortiSASE users and groups.The RADIUS Group ID value is required for this. Could you please let us know where we can find this value?   Thankz 

Hello,We are using FortiGate 60F with SSL-VPN (tunnel mode), running FortiOS 6.4.14 build 2093 (GA).VPN connects and assigns IP, but users cannot communicate with LAN devices.What GUI settings should be checked to allow VPN users to access LAN?Thanks.

Hi to all, I am quite confused because I have asked the support  department to help me to protect our VoIP system at home. The first agent told me that the FortiGate can not protect against SPAM calls and that the best approach is "to disable SIP ALG on the FortiGate, as it may interfere with VoIP signaling and is not required in most modern deployments".  Then, the ticket went to another agent (I do not know why) and this one told me the following:  "Please note that, to protect your VoIP services, the best approach is to use the Fortigate SIP ALG inspection feature". in addition: "With the above configuration, you will not have ghost calls nor unwanted call forwarding nor spam calls". So, one says Yes SPAM and No SIP ALG and the other one, the opposite: No SPAM and Yes SIP ALG. The second agent asked me to run the following: 1. Delete the SIP Session-Helper: config system session-helper delete 13 end  2. Set the ‘defaul

Hi everyone,I am finalizing a network deployment and looking for validation on my topology design to ensure I amfollowing Fortinet Best Practices for High Availability. My Environment:Management: FortiGate (FortiLink mode).Core Layer: 2x FortiSwitch 1024E configured as MCLAG Peers (ICL link is up and healthy).Access Layer: 2x FortiSwitch 100 series (Standalone access switches).Current Physical Topology: I have connected two separate access switches to the Core pair in a "triangle"(dual-homed) topology. Here is the exact cabling map: Access Switch 1:Port 23 -> connects to Core Switch A (1024E) Port 10Port 24 -> connects to Core Switch B (1024E) Port 10Access Switch 2:Port 23 -> connects to Core Switch A (1024E) Port 11Port 24 -> connects to Core Switch B (1024E) Port 11(Note: The 100-series switches are not stacked/ringed together).The Goal & The Question: My primary objective is redundancy: if one of the Core switches (1024E) fails, the Access switches must ma

Hello fellows, I just want to get your feedback on an ongoing issue I've had for years.I often log in to FortiCloud, use 2FA, and work on multiple support cases, download firmware images etc.While I have several browser tabs open in FCloud, I often get silently kicked out for being "idle".I am not! For the life of me I cannot find any idle timer setting. Getting kicked out several times a day not only costs time but nerves. Q to my fellow mates (power users for sure): do you experience this as well? Is it an issue during your day-to-day work?and a question to our FTNT team: is there any way to make the idle period longer, or better still, make the software aware that one is working while being logged in, just not in all open browser windows at the same rate? Best regards

Logs from FortiGate firewall is not getting forwarded to syslog server and when checking the route, it is going to wrong firewall port no. After clearing the session for the syslog server as destination, the issue gets resolved. This is an intermittent issue but need a clear suggestion for this behavior.

I know it's the neglected middle child of the Forti stack, but I'm getting ready to bump our FortiAuthenticator VM from 6.4 to 6.5. Reason being: We've stopped domain joining Macs and started using Entra Platform SSO and my internet lurnings have led me to believe 6.5's "Use for FSSO" checkbox on a remote oauth server is the secret sauce that makes it work.Question: Has anyone done this? I'm fine jumping higher than 6.5 if needed I'm just very conservative when it comes to FAC because we're SSOMA everywhere and it's literally the only thing that can actually break our network.

My phone keeps telling me the server for google.calendar.com is not trusted. The certificate is apparently valid through 2056. What is going on and how do I prevent this message from recurring endlessly on my iPhone? 

We have recently upgarde the fortiswitch and fortiswitches are managed by fortigate, after upgrading fortiswitch and it got rebooted, we have observed that HA got out-of syn for sometime. is this a normal behaviour ?? FortiGate FortiSwitch  

After upgrading my OS from version 7.2.11 to 7.4.11M. All users are facing a NET error page when accessing some sites. Especially with Microsoft Edge browsers. Support has recommended I download the Fortinet CA Cert and import into my trusted root certificates. But in an enterprise environment how do I get it onto the PC for all users. Attached is a screenshot of error.   

Hi,can some one check if have this same problem like me, with fortiguard servicesi check in 2 different network and FG 6.4 find only one fortiguard server and there is large ping about 700~900 msdiagnose debug ratingLocale : englishService : Web-filterStatus : EnableLicense : ContractService : AntispamStatus : EnableLicense : ContractService : Virus Outbreak PreventionStatus : DisableNum. of servers : 2Protocol : httpsPort : 443Anycast : EnableDefault servers : Included-=- Server List (Fri Jul 9 10:48:18 2021) -=-IP Weight RTT Flags TZ Packets Curr Lost Total Lost Updated Time173.243.140.16 0 352 DI 0 2323637 0 4497 Fri Jul 9 10:46:44 20212620:101:9000:140:173:243:140:16 0 0 D F 0 4443 4443 4443 Bleblas

Been witnessing an issue where spoke to internet traffic via hub would see excessive latency via Tunnel 1 (WAN 1) despite the rule failing over to Tunnel 2 (WAN 2) based on SLA metrics.Traffic between spoke and internal subnets behind the hub is fine as those do switch to Tunnel 2.Traffic from spoke to local WAN 1 internet break out is also fine.Anyone familiar with this issue?

I just purchase a FortiAthenticator cloud and i want to integrate it with FortiGate using Radius for VPN users authentication. I have the AD on Azure. How do I integrate for a seamless authentication process