Fortinet Community

Does anyone know if the Maximize Bandwidth SLA option is supported in the SD-WAN rules when connecting across tunnels to Zscaler Internet Access (ZIA) Cloud on-ramp? The documentation I've found recommends using Link-Cost for failover between a primary vpn tunnel across ISP1 and a secondary vpn across ISP2. Each to a separate Zscaler Public Edge. I'm trying to build 4 tunnels, 2 from each ISP to each Public Edge, and load balance across all 4. Has anyone attempted this? 

Hi allIm trying to find a way to get connection count to a real machine within the loadbalancer pool.My platform is FortiADC v8.0.1The closest method listed in the guides is /slb/all_vs_status_last_2but this gives 404 page not found Any suggestions? 

 I am installing Standalone Fortiswitch FS-648F using MCLAG-ICL topology, critical issues were observed with VRRP and inter-VLAN routing functionality.FS-SW-1 & FS-SW-2 connected through Port 55 & 56 as MCLAG-ICL link and all vlans allowed. L2 Vlans are 10,20,30,40,50STP enabled and priority assigned as default. L3 vlan created and assigned IP's with VRIP FS-SW-1 is Master & FS-SW-2 Backup vrrp statefrom FS-SW-1 Cli I am able to ping vrip for example 172.16.10.1 . (vlan 10)When I ping from FS-SW-2 cli, i unable to ping vrip 172.16.10.1  (vlan10)In sw-2 mclag-icl diag command output , it shows dormant role is SW-2. 2nd switch is not responding for vrip 172.16.10.1 arp in MCLAG-ICLAny solution for the issue ?Is there any limitations with Fortiswitch VRRP with MCLAG-ICL ?

Hello FortiCommunity, We currently are using FortiClient with an EMS server and noticed when we connect to the VPN we received our specified internal DNS on both our physical adapter (wifi/lan) and our vpn adapter. Our specified internal DNS are our domain controllers that run DNS services.   The issue we are having with this is that sometimes the FortiClient software disconnects or something in windows causes the application to crash. My assumption is when you hit the disconnect button on the FortiClient it removes routes and/or the static DNS entry. With that process not taking place the end result is that the static DNS that was not cleared, thus leaving the PC unable to connect to the internet.    Our users working from home do not get admin access to their network adapters as well. The combination leaves the end user unable to connect to the internet and our remote tool useless. Do you guys know why the static DNS is set- can we set this to obtain automatically? I d

Hi, I've a problem of loss of the liceense in my FortiAnalyzer. I've set a proxy and it's used to login the the cloud account. The FortiAnalyzer reboots and everything seems to be OK. But a few minutes / hours later, I get this alert message:License validation state changes from Trial License Init to Found disconnecting because of Server No ResponseI checked the proxy log and there is no entry of any kind of access. If I check the firewall logs, I can see that the FortiAnalyzer tries to communicate directly with some servers in the internet - I guess some license servers!? Afterwards I get a "duplicate license" error (but there is only one license in my account) and instead of the analyzer login a could login dialog is shown. I can login with my cloud account, the analyzer reboots, everyhting seems to be fine... for at least some hours. So, has anyone an idea, why the proxy isn't used to contact the license servers for validation? Regards,Dennis

I am attempting to call the /metadata endpoint in FortiClient EMS, but I am receiving a 404 Not Found error. According to the API documentation, this endpoint requires SAML to be configured.Is there any way to retrieve EMS metadata using the /metadata endpoint without enabling SAML configuration? 

Does any version of FortiOS support MOBIKE with IKEv2 dialup VPNs (using the built-in client on Windows 7/8/10)? I am able to successfully connect but the "status" as reported in Windows always shows a "no" for MOBIKE support.  I have spotted "processing notify type MOBIKE_SUPPORTED" (from the client-side) in the debug output of IKE on the Fortigate but no other messages indicating support on the Fortigate.  I have tried machine certificates as well as EAP for client-side authentication but the results are the same. The only reference I've found (so far) in the Fortigate documentation is from the following:https://help.fortinet.com...ng_Main_Aggressive.htmIt seems as if there should be an additional option for enabling MOBIKE (like the way EAP support is optionally enabled). Also, the built-in Windows client issues DHCPINFORM packets (once connected) as a method to discover additional details.  This can be extremely useful to pass subnets to the client whe

For some reason my last post got flagged as "spam" so here it is again. DPD Failures on IpSec VPNHi In summary between 45 Minutes to every 3 hours, every single IpSec VPN Tunnel gets torn down with a DPD-error. An example log I have included below. GeneralAbsolute Date/Time2026-01-04Last Access Time14:45:21VDOMrootLog DescriptionIPsec DPD failedSourceLocal IPXXXXFortiClient ID7D7A0CD5D9574D5AB509F5519F68B9F8UserXXXXGroupN/AXAUTH UserXXXXXXAUTH GroupFortiClient UsersActionActiondpdStatusdpd_failureSecurityLevel       ErrorEventAssigned IPXXXXXCookiesc7e291824a726956/c9f2b20f46158b9fLocal Port4500Outgoing Interfacewan1Remote IPXXXXXXRemote Port64917VPN TunnelForticlient VPN_0MessageIPsec DPD failureOtherLog event original timestamp (µs)1767537921187226000eventtime_raw_value1767537921187226120Log ID0101037136TypeeventSub TypevpnAlternate UserN/AADVPN Shortcut0 Below is the my current configuration for IpSec VPN Phase 1:config vpn

Hi ,We are facing a client network VPN issue.One of our clients is using Fortinet FortiClient SSL VPN to provide access to their internal network. Our employees connect to the client’s SSL VPN in order to run scripts on the client environment.The script runs automatically and can also be run manuallyWhen employees work from their home network, the script runs without any issuesWhen employees work from our office network, the script stops in the middle and does not completeOur office network uses a Fortinet FortiGate 100F firewall.To troubleshoot, we: Reduced the MTU size from 1500 to 1300Configured TCP MSS as shown below:config firewall policyedit 12set tcp-mss-sender 1300set tcp-mss-receiver 1300endHowever, the issue still occurs only in the office network.The same script works perfectly when run from the home network. can anyone help.

Hi,  Following this article I try to obtain a trial license: https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/441460I receive error as follows:  FortiGate-VM64-KVM # execute vm-license-options account-id FortiGate-VM64-KVM # execute vm-license-options account-password<string> Account password. FortiGate-VM64-KVM # execute vm-license-options account-password FortiGate-VM64-KVM # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)y Failed to download VM license.I have checked my account and master account of our organization, and there is no trial vm license activated. Fortigate can access internet. 

I bought two Lenovo Thinkpad X13 Gen 6 laptops two months ago. Neither of them can use VPN with Foticlient. Meanwhile, other company laptops like the Dell 3450, Acer P4/P6, and Thinkpad T14s can all use it. I'm certain the preshared key and username/password are correct. Please help me fix this error. Only these models are affected.

Hi everyone,I have the following scenario:Two Fortigate HA clusters (active/passive |100E v7.2.10) are currently in operation in the customer environment. The two clusters are currently connected by a fiber optic cable. A transfer network and an IPSec VPN have been configured between the links. If an HA failover occurs on one of the clusters, the other cluster must always switch over so that data traffic can continue, because there is only one link between the firewalls. Now the links between the firewalls will be expanded to four, as shown in the image below.Unfortunately, there is no switch in between, so the firewalls need to be connected directly to each other. My first thought would be to configure an additional IPSec tunnel on both clusters via port 15 and put both IPSec tunnels in an SD-WAN zone. Adjust routing and policies on the SD-WAN zone. Health checks via ping on peer tunnel IP and in SD-WAN rule tunnel via port 16 should be preferred and port 15 backup.Would tha

Hi FortiWeb adminsFortiWeb 7.2.x.What is the best method to achieve URL-based routing on FortiWeb in reverse proxy mode, when using a policy with HTTP Content Routing.E.g.:Client requests www.domain.com/app1 -> route to back-end server 1Client requests www.domain.com/app2 -> route to back-end server 2The method I know is to use HTTP Content Routing to route the traffic, then to use Rewrite policy to remove the URL /app1 or /app2. But I find this method complicated and I feel there should be a way to do it on FWB with less complexity.Any idea about the best way to do it?

I am now planning to deploy IPSec VPN to laptops and I have the application packaged and the IPSec configuration deployed to the registry. The problem I am having now is with the Preshared Key.... I cannot deploy that via GPO and I can't enter that manually on every computer. How you guys handling this?

Howdy! We're beginning a merger at my org and I need to re-IP my dual hub BGP on loopback schema. My first and biggest question would be, is it even possible to change the BGP and HC loopback as well as the IPsec tunnel IP's, add the new networks to BGP on one hub; say the secondary, update the spokes with the new config, and then once that is successful, repeat the process for the primary hub with little to no downtime? I've been attempting to do this in a partial lab environment and I'm having issues with the spoke not loading the changed tunnel into the sdwan rule as a selected route even though from the hub, the new loop back and IPSec interface IPs are pingable to and from the spoke and hub. What I do find interesting is that if I keep the changes in place on the spoke but revert the actual tunnel interface IP back to the original address, it gets loaded into the sdwan rule even though the secondary hub head end tunnel is still the changed address which would be a comple

Hello everyone.We have two FortiGate 100F devices configured in active/passive mode.We are using six site-to-site IPsec tunnels, as well as remote users (Windows/Linux) who connect via FortiClient VPN.In addition, there are users who connect from Android phones using FortiClient VPN for Android.About a month ago, the FortiGate devices were automatically updated overnight to FORTIOS v7.6.5 build 3651.After the update, external users lost the ability to connect via FortiClient VPN on Windows laptops.After reconfiguring the VPN settings and switching back to DH group 5, Windows laptops were able to connect again.However, FortiClient VPN on Android still cannot connect and returns an error.On FortiClient for Android, only the following DH groups are available: 1, 2, 5, and 14.I tried all of these DH groups one by one, but there was no improvement.I tested this on multiple Android devices, and also tried the full FortiClient VPN version.In all cases, I receive the same error in a loop (the

I have problem when i connecitng my forticlient to the ipsec vpn tunnel.The issue is when i configure the forti client using ip address of fortigate then the vpn connected and can reach to the LAN.But if i use dns name on the forticlient then the vpn is connected bt can't rach to anywhere.Trying ping the dns name from the client and the ip is resolved.Anyone know why?

The following config requires the Fortigate "Web Application Firewall" feature to be enabled underSystem > Feature Visibility > Security Features > Web Application FirewallOnce the feature is enabled, you should find "Web Application Firewall" available under Security Profiles Creating a custom signature helps in blocking/allowing a specific URL address, or URL path that could be related to a "false positive" you have identified. These custom-signatures can also act as your exception list rather than disabling a specific signature ID using the command  "set disabled-signature" The default config values would look like thisconfig custom-signature Description: Custom signature. edit <name> set status [enable|disable] set action [allow|block|...] set log [enable|disable] set severity [high|medium|...] set direction [request|respo

Hi all. I have Fortigate 600E with 7.4.9 FortIOS. I have an HA cluster active pasive:Unit 1 has 100 Priority.Unit 2 has 50 Priority.I have too, override disable. If I put down a monitored interface in Unit 1, cluster converges and Unit 2 becomes active. But, if I turn UP again disconnected interface in Unit 1, Unit 1 becomes active again. Why  doesn't unit2 stay Active, if I have configured the cluster with HA Override disable? If it is not properly configured, what should I do? Thanks

Hi,Running FortiWiFi-60F (7.4.5) in my home lab, I have downloaded 7.6.5 and but found couldn't be able to update if no license.May I know any alternative to perform update without a license?Thanks

I have created 2 x vdoms, each vdom has a vlan assigned to a single physical port (set interface "port#"). If I create a security zone named "Zone1," the only option is to assign a VLAN from that specific VDOM. Both physical ports are connected to a switch, which will be trunked wth both vlans. Ideally, I would like to use the same 2 physical interfaces in each vdom with the same VLAN interface IP address in Security Zone1,  for failover redundancy (each vdom will have a zone named "Zone1") How is this possible? Not wanting inter-vdom links, is there another option, as you can only set 1 physical port per VLAN interface?  Would this be switch mode on the fortigate? Example - if I lose a port, no traffic will be pass to a specific vdom

Hi guys, I am trying to push LDAP settings to two firewalls that are using same LDAP server but with different service account. I use per-device mapping to add two FortiGate with different username and password for LDAP binding account but when I push it to firewall, although it get the right username but password is not being pushed right and as a result account get locked in AD. Anyone can guide how can i do this? Do i need to have same password for both account? My understanding is that FMG should push the settings in per-device mapping.  

Hi all, Do Fortigate Firewalls support "BGP peer groups" by sharing the same outbound policies and setting instead of configuring each BGP neighbor individually and updates replicated to all peer group members. I can't seem to find any docs or commands that support BGP peer group config on a Fortigate like a Cisco or Arista Switch.  

I am attempting to call the /api/v1/vulnerabilities/index endpoint in FortiClient EMS to retrieve vulnerability details. However, I do not see this endpoint listed in the official API documentation(https://fndn.fortinet.net/index.php?/fortiapi/48-forticlient-ems/5282/48/Endpoints/).Is there a specific reason why this endpoint is not exposed in the API documentation? Additionally, could you please confirm whether it is safe to use this endpoint, and whether there are any risks or compatibility concerns with future releases?