Fortinet Community

Hi there, i need to change the vm size of my FortiGate in Azure. Currently we're using DS1v2 for a small firewall. Can i switch to an ARM-based VM size like "Standard_D2pls_v6" and follow the KB article Technical Tip: Resizing an Azure FortiGate VM instance or do i need to stick to Intel-based ones? I don't want to reconfigure everything, but configuration restore would be OK, if needed for the architecture switch. 

I recently upgraded to 7.4.10 M build.I also have 2 S148FP switches running 7.6.4.1114,250821 GA release.All is stable.Is anyone running the latest code of 7.6.x, and if so - any issues? Not used to all the CISC alerts on this product line but do keep up with them and make adjustments as needed. 

Hi,I'm testing the FortiClient EMS solution on a trial license. After updating to version 7.2.6, the system detected the PHP CVE-2024-11236 Out of Bounds Write Vulnerability. Is there a way to report this to have the vulnerable application version updated?

Hello all,I need your help with problem.I have central location and few branch locations.All branch locations have internet routed via IPSEC vpn established with central location.The problem is that devices at branch locations have internet acces while Fortigate itself doesn't (for license updates etc). So what I'm missing here.  Branch office IPSEC phase 2 remote subnet is set to all (so devices can access internet). Ping and traceroute from branch office fortigate doesn't return anything, firewall isn't blocking (or at least logs doesn't show anything) anything related to fortigate directly.Central location is fortigate 70G while branch locations have 40F if it does matter.It is probably really simple solution but couldn't find solution yet :)Thanks!

Hello everyone,I have a Fortigate 60F device running Fortios 7.6.4.I can't use NPU for my internet exit rules. The CPU is 100% busy. I can use NPU for local traffic, but not when exiting to the internet. What could be the reason?I look forward to you

Hello,We have EMS running v7.2.12 and were prompted that FortiClient v7.2.13 is available and have upgraded a small group of clients.  I see that v7.2.13 of the EMS server software is available for download on the support portal.  Usually we get a prompt when logging into the server and on the dashboard that a server upgrade is available and are given the option to upgrade directly in the server's web interface.  That doesn't seem to be happening. Is this update only for the forticlient software itself?  When should we expect the upgrade to become available via fortiguard / in the webUI of FEMS?

Hello Everyone,We have two FAC VMs in our company that are HA together.The problem I encountered now is that I enter the API token in the parameters related to the HTTP in the SMS Gateway configuration, but it does not work it , but with username and password parameters, it communicates well with the SMS provider and the SMS is sent and received , but it doesn't work with API token.I wanted to know if the FAC with version 6.6.2 supports API Token in the  HTTP Parameter or not.Or is there an alternative solution to enter the API token in the HTTP parameters or not.thanks a lot.  

  I  downloaded  VM  from fort iCloud  Sit  and I cant make evaluation LIC when I put my mail and password get this massage in  CLI  for FortiGate  FortiGate—VM64 login: Requesting Fort iCare Trial license,requesting Fort iCare Trial license, proxy : (null)

Hi,we use SSL-VPN with FortiClient via Entra ID SAML. We have 3 Entra groups for accessing SSL-VPN. The IP range for all clients on SSL-VPN is 192.168.15.1 - 192.168.15.254. Strangely, when a clients gets the assigned the IP 192.168.15.1, FortiClient connects but there's no network access. Bytes sent / received in FortiClient is only a few kbytes. When I view the logs, I see that the Client mostly only does DNS / LDAP requests to our domain controller. But no SMB to our fileserver or whatsoever. When I try to run ICMP to the domain controller, I get a timeout. Wierdly enough, under forward logs I see "PING ACCEPT (240B / 240B) - so from FGT's perspective, it replies to the ICMP request done by 192.168.15.1. I also ran Wireshark on the client and there it gets eaven crazier. When I monitor the SSL-VPN interface, I only see the ICMP reply from the domain controller to the client but not the ICMP request leaving through the SSL-VPN interface. This happen

Hi,Im trying to obtain firmware for my FortiWeb WAF Azure and AWS VM, which is on a PAYG license.The FortiWeb is registered in FortiCloud and shows as one of my assets.When I go to Firmware Download section and select FortiWeb as my product, I get a message indicating that I do not have a contract for this product?Opened a ticket with Support and first they said, with a PAYG license I can download firmware from Azure/AWS market place, with a link directing to the page when you want to purchase and deploy a FortiWeb VM. Not the actual firmware to upgrade my current FortiWeb.After pointing this out to, support came back and said I need to go to VM images, select my product and download the image, but when I follow those steps I see that these images are for New deployments and not for firmware upgrades.Can someone please indicate where I need to go to download my firmware, and is it possible that there might be some sort of registration issue with my FortiWeb? It does show that its licen

Do you GeoIP filter? If so, how do you handle Microsoft adresses?We do GeoIP filtering, basically allowing traffic to US and a few other countries IPs, while denying everything else. Recently this has started to become a significant problem, specifically due to addresses in Microsoft datacenters.It seems that either these sites are being bounced to data centers around the globe, or Fortinet's GeoIP database is miscategorizing addresses as being in countries that they are not.We're having valid traffic suddenly blocked because the Microsoft IP was supposedly in an obscure-to-us country. How are you handling this?

We have a FortiClient VPN access to several customers. I try to update the FortiClient version on my machine by downloading a new version from https://www.fortinet.com/support/product-downloads#vpn (download "FortiClient VPN-only" for Windows).This does not work: a form is shown where I enter my contact data and click "Download". The button changes to "Submitting...", and after some time it reverts to "Download" again, without any download coming up.  Does anybody have an idea on how to get new FortClient versions? To my understanding, this component is free to download? Best regards Wolfgang

Our application regularly does GETs but the problem happens for PUT/POST also. 7.4.x and 7.6.1 respond with little delay (HTTPS or HTTP). In 7.6.3 and 7.6.5, each and every REST call responds exactly 200 ms later. I can see this capturing the traffic and loading into Wireshark, and it is also observed in the system log (REST API calls) where it is generally at the process rate of 5 per second.After downgrading back to 7.6.1 and no other changes, everything speeds up again. Anyone else notice this? This is not good.(I did not try 7.6.2 or 7.6.4, and this is KVM VM version.)

 We are experiencing issues with the FortiGate 40F wireless FWF40F equipment, which has internal antennas. The problem is as follows: in FortiManager, the international antennas do not show an online status; only one internal antenna appears online, the others show an "Unknown" status.Has anyone else encountered this problem? I have an open TAC (Technical Assistance Committee) and I've created a TAC for the DEV team to investigate, but I would like to check if anyone else has experienced this issue. Evidence is attached. The external Fortiap antennas are showing online status normally; the problem is only with these internal antennas.LOG

After upgrading the foriGate to 7.6.6 this is the prompt .. Why and How to fix this?  

I am trying to download FortiExplorer Go for my Android phone, but I am getting a notice that "This app won't work for your device".   I think I recently downloaded it on this phone, but my phone recently upgraded to Android 15. Does this app not support Android 15?  

I have these issues on some FG80F models, where, after I upgrade from 7.6.4 to 7.6.5, the firewalls won't come back online, and the upgrade was executed remotely Anyone with the same or a similar issue after upgrading to 7.6.5

Hi all,  I have fortigate rugged 70f firewall in this station. We generally configure firewall with IP address ,the data will report to RLDC. Here RLDC is asking to configure IP along with VLAN ID ,when we configured with both vlan and IP address data is not reporting to LDC . Kindly help with this issue 

Do you GeoIP filter? If so, how do you handle Microsoft adresses?We do GeoIP filtering, basically allowing traffic to US and a few other countries IPs, while denying everything else. Recently this has started to become a significant problem, specifically due to addresses in Microsoft datacenters.It seems that either these sites are being bounced to data centers around the globe, or Fortinet's GeoIP database is miscategorizing addresses as being in countries that they are not.We're having valid traffic suddenly blocked because the Microsoft IP was supposedly in an obscure-to-us country. How are you handling this?

Please explain this setting:

My FGT hub and spoke have their own internet connection.Spoke have advpn with bgp enabled to the hub, and in hub i enable default originate.With this setup then FGT hub will advertise prefix 0.0.0.0/0 to the hub with higher AD value.Can we config the spoke to make direct internet connection and internet via hub simultaneously so i can make some users will use internet in the spoke, and some of user will users internet in the hub?I was test steer the traffic to the internet hub via sdwan but the traffic always go to the internet in the spoke. FW01 (Internet) # get router info routing-table details 0.0.0.0Routing table for VRF=0Routing entry for 0.0.0.0/0Known via "bgp", distance 200, metric 0Last update 05:02:58 agovrf 0 10.103.113.1 priority 1 (recursive via MPLS tunnel 192.168.120.1)Routing entry for 0.0.0.0/0Known via "static", distance 1, metric 0, best* vrf 0 10.10.10.10, via wan1, origin 2

The goal is to cater for two types of user accounts which require VPN access; internal staff accounts added to a dynamic group and member accounts used by third-party users which are manually assigned to a group as required.  My question is whether it is possible to set multiple Object Ids in the below config on the FortiGate corresponding to multiple Groups assigned to the FortiGate Enterprise App in Entra. Any alternative suggestions for how this scenario can be handled are welcome. 

We are rolling out the 7.4.11 firmware update to our Fortigates (60Fs). In the GUI, the 7.4.10 still shows as the latest available, so we are manually uploading the 7.4.11 firmware to the Fortigates. Fortigates are on 7.4.9. The 7.4.11 update is successful. However, afterwards, we find the the managed Fortiswitches do not show the 7.6.6 firmware available. Fortiswitches are on the 7.6.4 update. To make matters worse, if we manually upload the 7.6.6 switch firmware to a managed Fortiswitch, the managed Fortiswitches do not restart properly and require a manual power cycle to complete the firmware update. Is this a known issue?  If we apply the 7.6.6 firmware BEFORE the 7.4.11 upgrade, this seems to work just fine.

Hi!I want to use 802.1x MAB to recongnize FortiAPs connected to FortGate controlled switch.So I enabled this setting: "Enable Network Access Policy for Wireless Access Points" Now I found, that Accesspoints, that were found before this setting, are not in Hosts view(this is not problem) and their ports goes to WAP Uplink mode in NAC inventory. After I enabled "Enable Network Access Policy for Wireless Access Points",(and created OUI based profiling rule) this one still keeps WAP uplink "state" and it's OK. BUT:When I now add new AP to another port, Port Connection state is :"Registered Host"And MAC address of AP goes to hosts list. Can I force new APs to go same state, as the first one? I use radius attribute group to return all needed VLAN, so that part works.BR, A 

Hello everyone, in the config wizard I would like to know if the "domain" field has to be a real domain as in the prod domain or do I have to make a subdomain for FortiNAC and config it in my DNS server ? BR,