Fortinet Community

Hi guys, This is for anyone who is using the FCT 7.4.5 version for the ARM processor support.I understand it is in beta so it wont be perfect, I am just curious about your experience with this? Obviously taking its current stage into account, is it okay and decently functionable?

There were multiple conversations at this community about this subject on both sides: "should work" and " not supported".I just found the culprit when my new phase1-interface configuration of this dialup IKEv2 over TCP on FG60F 7.4.9 didn't work with FortiClient VPN 7.4.3, which were properly configured to use transport - TCP 4500 both sides. It was NPU offloading at the VPN policy.In multiple documentations for the IPsec over TCP, it was mentioned NPU offloading and ADVPN are NOT supported. So, I tried disabling the NPU offloading at the polcy with:    set auto-asic-offload disableBefore this change, nothing showed up in IKE debugging although connection request packets were hitting at at the wan1 interface at TCP 4500. Then, as soon as I made the change, the request came through and showed up in the IKE debugging and got connected.[below x.x.x.x is FG60F IP]ike V=root:accepts ike tcp-transport(vd=0, vrf=0, intf=0:5, x.x.x.x:4500->y.y.y.y:10670 sock=33 refcnt=2 ph1=(nil))

How do you guys deal with random VPN Disconnections? They are driving me crazy for some of the users!!!!Same thing with SSL and IPSec

 How to Block Application on Fortigate Firewall | Application ControlIn this video, I’ll walk you through how to block applications on a FortiGate firewall using Application Control. This is a critical skill for network and security engineers who want better visibility, control, and security over network traffic.https://youtu.be/llkzZ1RCRb0

Just started noticing this on 7.4.9, but it may have been already happening. We are seeing source field IP information populate correctly, but as soon as we scroll the interface, they all switch to displaying as [object Object] - if the source is identified via FSSO, then the name portion remains, but the IPs all switch to [object Object]. This is making it impossible to review source information by IP easily. Ironically, clicking on the Filter option suggests the first option as [object Object] and then all the other IPs are still viewable in that list. Obviously this is a bug. It is happening across multiple browsers (Edge, Chrome, Firefox). Please provide a non-vibe-coded fix as soon as possible. Thanks!   

I'm wanting to keep up to date with all the new features that get released in the FortiSASE Mature and Feature releases, does Fortinet have a mailing list or RSS feed we can subscribe to to get updated on these features when they are released? In addtion to this, does Fortinet host partner webinars or mailing lists to allow partners to understand the roadmap and up-coming features for FortiSASE and then the constant changing in the packaging of the product? :)  

The MIBs for FortiOS core, Fortigate, and Fortiswitch (where I really care) seem to lack any OIDs for transceiver diagnostic data. Namely RX strength. We do this sort of monitoring with all our non-Forti networks, typically with LibreNMS. I checked the OID mappings that Aruba/Cisco/Mikrotik tend to use, found no similar spot in an SNMPWALK of a fs-1048e, fs-148f, fs-108f, or FG-201F. Obviously the switches have the data, as the below command would show.  get switch modules status port49____________________________________________________________Port(port49)temperature      40.539062 Cvoltage          3.300300 voltsalarm_flags      0x0040warning_flags    0x0040laser_bias       35.442001 mAmpstx_power         -2.726214 dBmrx_power         -18.124792 dBmoptions&n

Every time one of our users attempts to login, they are prompted to provide all their credentials. We're using Forticlient VPN (free). The connection is established and works, but on the next login it prompts for the Microsoft login again. This began happening in Forticlient 7.2 and has continued in Forticlient 7.4. This does NOT happen in Forticlient 7.0, so we're still using Forticlient 7.0 in production. The Fortigate itself has been on various flavors of FortiOS 7.0, 7.2, and 7.4, and the results have been the same for Forticlient. Our Azure accounts are setup with MFA, and we're using SSL-VPN in tunnel-only mode. Forticlient 7.0 - connecting with Azure SSO works fine without reprompting for credentials and without needing to change any of the default Forticlient settings Forticlient 7.2 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not.  For

I apologize for the length of the post. And I will say that I am not a networking genius.I have a 200F. We recently had to get a p2p connection to one of our clients in another state. It was decided to go with Lumen (That is a whole another story). Lumen set up an IP VPN circuit between the two locations.Turns out that a static route will not work, we need to set up BGP. I already have BGP set up for out main internet connection.I know that I can set up a new neighbor with different Remote and Local AS's and add it to the interface of the p2p. What I not familiar with is setting up the route map.I have an ip pool setup so that all traffic coming from my end looks like it is coming from 10.10.15.xxx and needs to route to 192.168.40.100 on the other end.Any links to any docs will be really appreciated.

I have tested multiple latest versions of FortiGate firewall images and uploaded them correctly by strictly following the official Fortinet documentation. The images upload and boot successfully without any errors. However, when I attempt to log in using my registered Fortinet email address and password to obtain an evaluation licence, the login does not work at all. As a result, I am unable to activate or retrieve the evaluation licence on any of the tested versions. 

Hi!Are you expecting the same problems?Since friday evening, my Fortigates are not able to get updates for AV/IPS-definitions, while web-filtering is working fine, IF: "fortiguard-anycast-source=aws"When I change to source "Fortinet", everything is working fineLocation is "EU".Best wishes

Hiupgraded 60F to 7.4.9 and our client's 3rd party provider is saying all devices are getting DDS blockedwas using Web filter and SSL inspection on the outbound firewall policy still same with them both turned offI can't see it being blocked in forward traffic logsdo I need to go up to 7.6  or is there another fix ? any help appreciated Graeme

Fortinet SD-WAN Explained | Live Whiteboard Session In this video, we break down Fortinet SD-WAN using a simple, real-world whiteboard explanation. You’ll learn how SD-WAN works, how Fortinet optimizes traffic across multiple links (ISP, MPLS, Internet), and how performance metrics like latency, jitter, and packet loss influence intelligent path selection.https://youtu.be/_PQd6ygy4UI

On my FGT Hub i have  VPN site to site to Azure with the peer ip address is 20.184.16.72 and 52.148.92.8But why when i execute get router info routing-table details 10.201.10.5 the tunnel ip is 1.1.1.1 and 52.163.73.175 (not 20.184.16.72 and 52.148.92.8)?If i check the same routing table on my spoke then the tunnel showing right ip. FW01 (Internet) # get router info routing-table details 10.201.10.5 Routing table for VRF=0 Routing entry for 10.201.0.0/16 Known via "static", distance 10, metric 0, best * via AZURE-1 tunnel 1.1.1.1 vrf 0, tun_id Routing entry for 10.201.0.0/16 Known via "bgp", distance 20, metric 0 Last update 00:00:59 ago vrf 0 10.201.0.4 priority 1 (recursive via AZURE-2 tunnel 52.163.73.175)

Hi everyone, I am currently preparing using the SD-WAN 7.6 Core Administrator training course, and I’m trying to understand which Fortinet exam actually corresponds to this training. So far, I found two exams: NSE6 SD-WAN 7.6 Enterprise Administrator, but this one clearly goes beyond the scope of the Core training (advanced IPsec, ADVPN, FortiManager, enterprise design). NSE5 FortiSASE and SD-WAN 7.6 Core Administrator, which seems closer to the training, but it also includes FortiSASE topics, while the training I’m studying focuses mainly on SD-WAN core concepts. This is where I’m confused. Is there any exam that matches only the SD-WAN 7.6 Core Administrator training? Thanks in advance for your clarification.

My employer has deployed the FortiClient VPN across the network. The client on the company' laptop is the free version ?!?It features a system configuration backup but no restore function; obviously it requires a "full" client version.I downloaded the demo version and installed it on my personal home PC. Until now and for years we had the Anyconnect VPN from Cisco which worked just fine and I intend to duplicate the FortiNet setup here too.Question: Can I buy the "full" complete VPN client license for private domestic use to unlock the restore function, and would the backup from my work laptop restore access and service on my domestic client ?

Good day.If you have "HA Not Synchronized" error and have attempted the below without any luck; https://kb.fortinet.com/kb/documentLink.do?externalID=FD45183https://kb.fortinet.com/kb/documentLink.do?externalID=FD36494https://kb.fortinet.com/kb/documentLink.do?externalID=FD31379 Do the following:On primary unit, "config system ha" "set override enable", "set override-wait-time 120".On secondary unit, "config system ha" "set override disable". This forces the Primary Active unit to take "Active State" after a reboot; however, with a time buffer of 120sec. Download the Fortigates configuration file. "Configuration", "Backup"Select Global, Local PC, FortiOS. This will download the Primary Fortigates full config file.Open this file using a text editor.Find or search for "config system ha"Delete the "set override enable", "set override-wait-time 120"Edit the "set priority value" to that of your current Secondary Unit, or something lower than the value of the Pr

I've recently inherited responsibility for a large number of FortiGate VM licenses in a recent organizational merger. I'm attempting to go through the list of licenses in the support portal and validate which of them are actively in use, and which of them are available to be used, but I don't see a simple way to do this. A few quick Googles seem to point me into having to check licensing status from the firewalls themselves (but this would defeat the purpose because then I would already know they exist). I'm hoping one of you knows of a report somewhere I can run to see which licenses have actually been consumed.

I would like to connect a FortiGate 50G-SFP firewall to a USW Pro Max 24 PoE switch. Can I use the Ubiquiti UF-MM-1G SFP and plug it into the switch’s SFP+ port?My second question is whether the same Ubiquiti UF-MM-1G SFP would be compatible with the SFP port on the FortiGate 50G-SFP.From what I’ve read, FortiGate usually works with third-party SFPs (e.g., Cisco).

I am experiencing a connectivity issue where the Secondary unit of a FortiGate HA cluster cannot connect to the FortiAnalyzer (FAZ).Environment:Device: FortiGate HA Cluster (Active-Passive)Log Storage: FortiAnalyzer (FAZ)Symptoms:The Primary FortiGate connects to the FAZ normally.The Secondary FortiGate shows a status error: "Could not connect to the FortiAnalyzer to retrieve its serial number."On the FAZ side, both devices appear in the device list, but the Secondary unit is not sending logs correctly.Troubleshooting Performed:Certificate: Disabled "Verify FortiAnalyzer certificate", but the issue persists.HA-Direct: The ha-direct setting is currently disabled.Packet Capture: Ran diag sniffer packet any "host [FAZ_IP]" 4 0 l on the Secondary unit. Results: No packets were captured at all when attempting to connect to the FAZ.The Secondary unit seems unable to initiate any traffic toward the FAZ IP.

Hello Fortinet Community, I’m new to Fortinet and have decided to pursue the FCP - FortiGate 7.4 Administrator certification (Exam: FCP_FGT_AD-7.4). I’m excited about this opportunity to deepen my understanding of FortiOS 7.4.1 and FortiGate firewalls, but as a beginner, I’m feeling a bit overwhelmed about where to start. I’d greatly appreciate your insights and advice to help me prepare effectively for this 50-question, 90-minute exam.Here’s a bit about my situation: 1. I have basic networking knowledge (e.g., TCP/IP, basic routing, and switching) but no hands-on experience with FortiGate devices or FortiOS. 2. I plan to use the official Fortinet resources, including the exam description, and I’ve also subscribed to Leads4Pass for practice exams to familiarize myself with the question format and test my knowledge. 3.Pass the exam before it retires on September 30, 2025. Here are my specific questions for the community: 1. What are the best resources for a

Hello Guys,I need to ask my FortiGate version is 7.4.9 and configured with vdoms and VPN IPSEC . if i will perform, upgrade to 7.6.4 is it recommended ?i use Upgrade Path Tool and output Recommended Upgrade Path show i can directly upgrade to 7.6.4 . just there is anyone do that upgrade and encounter issues ?Thanks

Hi,2 networks192.168.1.1 / 24 (LAN network)10.10.10.1 / 24 (WiFi network)I have created rule to allow WiFi interface to Lam network, but still failed to communicate.May I know anything missing ?Thanks

Im trying to troubleshoot what happen that HA isnt synced. I did try debug commands but no luck :) Please suggest where to search for solution. Below example logs:  FW600D-RZ-0~ $ dia system ha sync-config get-statusThe sync config status is enable.||diag system ha statusHA informationModel=FortiWeb-600D 7.07,build0151(GA),230519, Mode=active-passive Group=2||HA group member information: is_manage_master=1.LocalSN: FV600DXXXMasterSN: FV600DXXXFV600D3XXX: Primary, 3, 0, 50617820, 47648191, FW600D-RZ-01FV600D3XXX: Secondary, 4, 0, 50606741, 47638346, FW600D-VWG-02||diag system ha confd_statusHA informationModel=FortiWeb-600D 7.07,build0151(GA),230519, Mode=active-passive Group=2HA group member information: is_manage_master=1. cfg_state:Not syncLocalSN: FV600D3XXXX confdmember cnt: 2msg_queue:0 file_queue:0 md5_rep_ignore:0 do_md5sum:242FV600D3XXXX: Primarypending:0 update:0 time:0 sync:0 cfg_state:Not syncSYS: 4159F01630575F9FDF120EDB1EC3638BCLI: 7853F4D9511E41F8A8EB471011

We always follow the Technical Tip: Recommended Release for FortiOS  link for the fortiOS version on our Fortigate. It's says for our Fortigate that the recommended FortiOS is 7.4.8 but this morning when i logged in on my fortigate I got a message saying Installed Firmware Contains Critical Vulnerabilities and that we should upgrade to 7.4.9.So is the recommended version 7.4.8 or 7.4.9?