Fortinet Community

Hi, We have a FortiExtender 511G that we want to connect to a private 5G solution. To connect to this private 5G service it is mandatory to set the modem to 5G only mode. I have not found this option in the GUI or CLI. I only found a post on this forum how to do this for the FortiExtender 511F ( https://community.fortinet.com/t5/FortiExtender/Technical-Tip-Switching-Carrier-Service-Mode-to-FortiExtender/ta-p/336389 ). However the used AT-commands are not recognized by the modem of the 511G.  The FortiExtender is in LAN extension mode and runs firmware v7.6.4 and the modem runs FEM_20_EM9291-24-01-01-NAM. So is it possible to set the 511G's modem to 5G only? And how do I do this?Thanks in advance.

Hi I want to allow access only to the following URL using a Static URL Filter, and block any subdomains. www.microsoft.com/security/encyclopedia/adlpackages.aspx  here is my setting, but it doesn't workstill can accesswww.microsoft.com www.microsoft.com/security      

Hi Team We have a FGT 1100E That had an issue of a process draining the RAM, it went into Conserve mode after trying to process an extremely large volume of traffic which effectively exhausted resources.Is there separation on the Control and Data plane on this platform(FGT 1100E) for the memory usage as I understand things: Session setup and teardown(State) is managed from the control plane that this process is a part of hence would be contributing to the problem where we see these large influx of traffic requiring session setup, but other products are not affected as packet forwarding is processed within the Data plane .  

Good morning, We have a FortiGate 50G installed at home. The device has been set by the company who sold it to us. The FortiGate is used over 2 routers from 2 different providers. We have asked the company to close all the ports as the use of internet here is domestic. When using nmap in order to check possible open ports, the results are:113/tcp  closed ident2000/tcp open   cisco-sccp5060/tcp open   sip I have used the WAN IP of the Forti as target. Maybe I am doing it wrongly... Here there is the Firewall Policy: The company told us that the ports are closed but here at home we are a little bit worried. Please, could you confirm that the policies are correct in order to close all the ports? If positive, how is it possible that nmap shows open ports (I have done the process 4 or 5 times)?  We are not professional here and our goal is to be completely protected only. Thank you very much. 

Hi everyone,I am troubleshooting a persistent IPsec VPN issue on a specific Windows 11 workstation and looking for pointers on local OS interferences.Environment:Gateway: FortiGate 70G (Firmware v7.4.9).Protocol: IPsec Dial-up (IKEv1, Aggressive Mode).Failing Client: Windows 11 (FortiClient latest).The Issue: Phase 1 negotiation times out with "No response from the peer". The issue is strictly isolated to this specific PC.Troubleshooting & Isolation: I have confirmed the FortiGate configuration and Phase 1/2 proposals are correct by successfully connecting with other devices:Success: Another Windows 11 PC running FortiClient v6.0.0 connects immediately.Success: A MacOS device running FortiClient v7.4 connects immediately.Steps Taken:Verified local Firewall/AV allows the connection (tested with them disabled).Verified no ISP blocking (same behavior on different networks).Since it works on other clients, I have ruled out the FortiGate configuration.Has anyone encountered specific Win

Hi, We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection? I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some o

Hello team,Anyone has an idea when implementing an IPSEC tunnel using ikev2 and eap for user authentication against radius or ldap. Does Fortigate terminate the eap messages, extracts the username and password the performs an access request to the radius server or bind to the leap?Or the eap messages are forwarded to the remote authentication server inside the radius (like 802.1x) or ldap messages m 

On Fortigate 90G faceplate shared ports wan1, wan2, sfp1, sfp2) shows grayed out.There physical connectivities on sfp1, sfp2 and it working fine. We are able to do the configuration  for those interfaces but the only concern is it shows grayed out on gui faceplate.Please guide..

I have a server running multiple services behind a modem that uses port forwarding to redirect ports on the public ip to an internal ip. So for example homeserver.ddns.net:8123 forwards through to 192.168.1.1:80. This works fine for all computers except the ones behind a fortigate device running FortiOS v7.0.12 (GA). The only relevant firewall rule on the fortigate is one say all traffic from the internal device to the external device should be allowed and NATed. The machines on the internal network can connect to any other ip or port on the internet just not the ones behind my modem, they just timeout. Although I do notice there's an option to preserve the source port that is currently disabled. Would that help or is there anywhere else that this type of traffic is being blocked?

Dear All, I have noticed during the Microsoft team call audio gets stuck for few seconds then again gets normal. checked at Firewall No packet loss even latency was normal during that time but what I have noticed too DDOS policy was blocking some UDP packets for inbound connection not outbound connection. Just let me know what has to be done from my side If more than 20 users are connected at the same time for Microsoft team call. how much threshold should I set  and what ports has to be allowed in DDOS policy . Also please share best solution, I had gone through below URL as well.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-The-most-common-issues-with-FortiGate-and/ta-p/190635 Regards,Umesh   

Users are experiencing intermittent video freezing and robotic audio during VC sessions (Zoom/Teams/Webex). Despite having 3x 100 Mbps Dedicated Internet Leased Lines (ILL) and SD-WAN rules in place, the traffic does not seem to be optimally prioritized and is getting errors as "your video is paused due to network problem" Environment Details: FortiGate Model: FGT-400E Firmware Version: 7.4.9 Link Setup: 3x 100 Mbps ILL via SD-WAN. Current Config: Performance SLA is configured for Jitter/Loss.SD-WAN Rule "Lowest Cost SLA with load balancing" is set for VC applications. Traffic Shapers (High Priority) are applied to VC traffic 

Hello TeamIn our environment, we can see only root and other VDOMs. The Global VDOM/config is not visible, and all global user objects (LDAP/RADIUS/local users & groups) are missing, while VDOM configurations remain intact.Due to the loss of all super_admin users, we also cannot access the firewall using PAM.Has anyone encountered a case where the global configuration/VDOM is lost or not loaded, but other VDOMs are unaffected?FortiGate #for

Anybody else having issues with getting the 'free' ipsec client to work?I've been messing around with this for a couple of weeks and so far, with 5 different machines and 4 different clients - only 1 machine will connect.I've already engaged support but since this is the 'free' client - they have exhausted all that they can help with.I don't need all the 'add-on' stuff with the vpn, just need it to connect - stay stable and provide some basic routing (thru it).What happens is that i install, configure, connect - and it hangs.  nothing until the connection drops off a few minutes later. packet captures seem to indicate that 'all' the tcp packets aren't getting sent/received and therefor phase 1 never completed. 

I am getting vulnerability warnings from NIST, which indicate I need to be using version 7.4.4.x of FortiClient, but your website does not provide beyond version 7.4.3.1761 for the VPN only version. Please provide an update for the VPN only version. https://nvd.nist.gov/vuln/detail/CVE-2025-31365

Hi,Has anyone encountered when executing a command below to get this output?Model FSW 124F-FPOE most of them and managed via FortiLink. diagnose switch physical-ports summaryPortname Status Tpid Vlan Duplex Speed Flags Discard__________ ______ ____ ____ ______ _____ ____________ _________prt_switch_phyport_summary: unable to get port1(#1) statusprt_switch_phyport_summary: unable to get port2(#2) statusprt_switch_phyport_summary: unable to get port3(#3) statusprt_switch_phyport_summary: unable to get port4(#4) statusprt_switch_phyport_summary: unable to get port5(#5) statusprt_switch_phyport_summary: unable to get port6(#6) statusprt_switch_phyport_summary: unable to get port7(#7) statusprt_switch_phyport_summary: unable to get port8(#8) statusprt_switch_phyport_summary: unable to get port9(#9) statusprt_switch_phyport_summary: unable to get port10(#10) statusprt_switch_phyport_summary: unable to get port11(#11) statusprt_switch_phyport_summary: unable to get port12(#12) statusprt_

How to Configure Fortigate IPSEC VPN + Google Workspace SAML?

I have a fortiap 231g, which I purchased new and it is still on the 3 months Fremium license that comes with the device. now I want to extend the license to keep receiving firmware updates. I don't need other support options in Premium and Elite licenses. With this can I buy a Forticare Essential license or I have to buy Premium/Elite for the first year and then extend by Essential license later? I receive conflicting info from different sources, including my official Fortinet rep who says I must buy Fortinet Premium for the first year, then extend with Essential from the second year. Any idea what the truth is?

In FortiEDR, there are always quite number of disconnected (Expired) collectors, as there is no policy can help to do auto housekeeping, anyone can share wha

Hi,For some reason, everyone using edge at my company is suddenly getting nonstop notification from FortiClient System Tray Controller saying: "Microsoft Edge" extension policy anomaly detected, please restart the browser.This happens anytime you try to open any websites and they just get stuck in loading until it fails. I restarted the browser and I even shut all Edge operations in task manager, nothing works. I cant seem to find any solutions online so was wondering if anyone was familiar with this issue and if they managed to resolve. Thanks!

I need to replace a firewall, and now have to decide between Fortigate 70F and 70G. The price for a HA cluster is pretty much the same. According to the datasheets, the 70G offers way better performance. However, I got an other G-Series firewall last year, and it was delivered with an old, vulnerable firmware. We had no chance to upgrade at first, and later couldn’t follow a supported upgrade path.But this was about 6 months ago, so I’m wondering if the G Series is ready for production now, or if we should still stick with the F-series.

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi there! I’m part of a student design research team from Simon Fraser University, working on building a design solution for the documentation experience, specifically with FortiOS/FortiGate. We’re currently conducting user research and looking for insights directly from people who actually use it!If you have a few minutes to spare, we’d really appreciate your thoughts through a short 6-8 minute anonymous survey. It focuses on topics like navigating documentation, handling version differences, and finding the relevant information you need. Your perspective would be super valuable to our research process. Thank you for your time, and no worries at all if you’re unable to participate! Feel free to ask any questions if you have any!Here is the link for our form: https://forms.gle/ieEcwqVFzu2i8yZQ8

How to configure Dynamic Wi-Fi VLAN Assignment with FortiAP & FortiAuthenticator In this video, I walk you through how to dynamically assign Wi-Fi users to VLANs using FortiAP and FortiAuthenticator. Instead of creating multiple SSIDs for different user groups, you’ll learn how to use identity-based policies to automatically place users into the right VLAN based on who they are.https://youtu.be/jKsDymddwlc

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.

 I have followed this as much as possible,  I am using sAMAccountName on the config user ldap so it looks at every account, but NTLM doesnt work at all,  So I set up basic Auth to the same LDAP server, and that works fine, user has to log in with current credentials and they can hit the proxy policy and surf the web etc, can see them under "diagnose wad user list" as "basic auth" I need the behaviour to be transparent, so NTLM seems to be the answer (Not using FSSO yet!)but the login box appears, you type in creds, then it just appears again. config user ldapedit "ldap-server"set server "x.x.x.x"set cnid "sAMAccountName"set dn "dc=lab,dc=local"set type regularset username "myadadmin"set password ENC blah blah blahnext config authentication schemeedit "MYAD-LDAP"set method nlmset domain-controller "MYDC" (LDAP SERVER ABOVE) config authentication ruleedit "auth-web"set srcintf "proxy-int"set srcaddr "all"set active-auth-method "MYAD-LDAP" Any advic