Fortinet Community

Hello everybody,We're considering FortiAnalyzer Cloud for our FortiGate 70G-PoE in a small company (~50 employees).Our main goal is incident response and forensic investigations, e.g. identifying suspicious activity, investigating a compromised device or tracking a potential attacker using firewall logs.As I understand it, the last 100 days of logs are available for analytics and reporting, while logs from 100–365 days are archived.A few questions:How easy is it to search archived logs from 3-12 months ago?Can archived logs be re-indexed for FortiView, analytics, and reporting in FortiAnalyzer Cloud?Is it possible to analyze logs spanning an entire year, or are analytics limited to the most recent 100 days? Is FortiAnalyzer Cloud the right product for our use case, or should we consider something else (e.g. FortiSIEM)? Is there a trial license available to test these limitations before purchasing? Thanks in advance for any pointers!

Hello everyone,We are experiencing a minor but frustrating issue with our FortiAuthenticator, and I would appreciate some guidance.Our FortiAuthenticator is configured to synchronize users from Active Directory (AD/LDAP). Under Synchronization Attributes, we have selected Local User for the Sync as option.As a result, whenever a new user is created in AD and synchronized with FortiAuthenticator, the system automatically generates a unique random password and sends it to the user via email.Our goal is to disable this automatic password notification email without affecting the existing AD synchronization or user authentication process.I have searched through the documentation and configuration settings but haven't found a way to disable this specific email notification.The only workaround I have identified so far is modifying the following Replacement Message:Admin Set Random Password for User Email MessageHowever, this would only change the email content rather than prevent the email fr

My question is: How do I configure an email account so that it only sends emails and does not receive them, and so that if someone does send an email to that account, the sender receives a custom notification?Note: This post was machine translated to meet Fortinet Community Guidelines.

Hi everyone,Since upgrading my FortiGate 70G from 7.6.6 to 7.6.7, I can't access the admin GUI via my Nginx Proxy Manager. Direct local IP access works perfectly...The initial HTML loads, but all subsequent parallel requests for static chunks and API calls instantly fail after a login attempt. My NPM logs show: 104: Connection reset by peer in SSL handshake while SSL handshaking to upstream 2026/10/10 08:40:08 [error] 937#937: *53149 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 192.168.20.2, server: forti.local.net, request: "GET /favicon/favicon-16x16.png HTTP/2.0", upstream: "https://192.168.1.1:443/favicon/favicon-16x16.png", host: "forti.local.net", referrer: "https://forti.local.net/login?redir=%2Fprompt%3FviewOnly%3D" What I tried (without success):    Restarted the httpsd process.     Forced proxy_http_version 1.1 in Nginx to prevent HTTP/2 connection spikes.     Toggled SNI (proxy_ssl_server_name) and session reuse.     Tried SSL-offloading

while i try to register my forti AP 221e device in forti cloud web portal & beliow mentioned error are comming. Please check & update the same.  Note: This post was edited to remove personally identifiable information by a moderator. A serial number was entered into the Registration Code box in the original screenshot.

Hi,I have basically this configuration:Thing is that i would like to have multiple IPSEC tunnels with same ike-saml-server, but using different loopbacks interfaces. I need this multiple tunnel solution because I need to have different access restrictions based on GEO policies depending on wich IPSEC tunnel you are using.Right now, I have multiple IPSEC tunnels using networkid parameter: But that configuration have two major issues: I can’t have a different GEO restriction for each tunnel and Forticlient android clients doesn’t support networkid parameter.Does anyone have an idea to configure multiple IPSEC tunnels with SAML on to different loopbacks interfaces?Regards 

Hi Folks,I want to create an automation stitch so I get an alert. I think I have figured out how to do the emailing etc. However I am struggling to create an automation stitch that creates alert. I want it to alert when clients (per host) exceed a bandwidth limit. I know i can do it for interfaces etc but I wanted to be more specific.ieEmail alert: Host 1.1.1.1 has just exceeded 1gb bandwidth. thanks,Chris.

Hi Team,We plan to deploy a FortiPortal Scalable Cluster with two nodes in one DC and one node in the other. If the DC with the two nodes goes down, the single node can operate independently per the configuration:config system ha set min_nodes 1endWhat will happen when the two-node DC is brought up? Will it be enough to change the single configuration to a scalable cluster? Will the changes made on the single node during the outage be replicated to the other nodes?

Hi team,We need your suggestion & support to configure the fortiAP 221E in standalone mode because i dont have the firewall & controller. we need public the one SSID through fortiAP 221E for create the wifi zone for laptop users. please suggest the best method to me. FortiAP 221E 

I have a fortigate 70G (v7.4.12 build2902) setup as the wireless controller of a mesh network. A fortiap 421E (FP421E-v6.4-build0492) is the root, and then the two leaf ap's are another 421E (v6.4.0 build0492) and a 221E (v7.4.4 build0644). When I first configured this several months ago, everything worked great. Then recently my daughter started mentioning that the internet seemed slow.I looked into it and although I hadn't changed anything, the leaf ap's were no longer connected to the mesh network, so all traffic was routing through the root ap.Through some reboots I was able to get the entire mesh up again. However, no clients will connect to either of the leaf ap's.This configuration was previously working with no changes made and then stopped working. What should I do?I don't believe any of the ap's auto updated nor did the FG. None of the devices are registered for support, but that has been true for quite a while, definitely while the mesh was up and working.Any help and advice

My building will be shutting off power for electrical work this weekend and all our hardware has to be powered down ahead of time. We have two Fortigates in an HA configuration and several managed 424E and 448E FortiSwitches. Do we need to issue shutdown commands to the switches via the CLI or will shutting down the managing Fortigates shut the switches down too?

Hey everyone,We currently have a couple of FortiGate VM appliances running FortiOS 7.2.13 and are using FortiClient SSL VPN tunnel mode for client remote access.I understand Fortinet is sunsetting SSL VPN tunnel mode in FortiOS 7.6.3. the business is not ready to pivot off SSL VPN so in the meantime, they want to know whether upgrading to FortiOS 7.4.x is a reasonable short-term bridge (Fortinet’s lifecycl page says says it’ll be supported until March 31, 2028/November 11, 2028). Questions:1. For those who have upgraded, has FortiOS 7.4.x been stable for production SSL VPN tunnel mode?2. Is SSL VPN tunnel mode supported throughout the 7.4.x branch, including later releases such as 7.4.8 or newer, or is there a specific 7.4.x version we should target/avoid?3. Since SSL VPN is hidden from the GUI by default in 7.4, is it still considered fully supported in 7.4.x, or is it more of a transitional feature?4. Can I upgrade directly from 7.2.13 to a 7.4.x release, or should I follow a specifi

I am trying to set up IPSEC vpn from a fortigate to FortiClient for Windows and Mac. I have it working on FortiClient for Windows. On FortiClient Mac it says Connecting, then times out. I noticed that the Mac version is missing three options in the setup that are visible on Windows and I wonder if that is my problem.The options missing are:VPN Settings: EncapsulationPhase 1: NAT TransversalPhase 2: Enable Replay DetectionCan I get those options to show somehow?The fortigate side was set up using the wizard, and this is a full tunnel.

Ladies and Gents,I have 2 FortiSwitch 224D and would like to connect it to a FGT 40F, what is the recommended configuration for this setup?Thanks in advanced!Alfred

Hi everyone... I have confuse about vpn concentrator, anybody help me to describe what is vpn concentrator mean? Thanks

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

automatic failover between two different ipsecvpn remote gateway public IP addresses in FortiVPN Client

Hi all,I am currently encountering an issue with SSLVPN, and would would like to seek your advices. Thank you very much.Background:Fortigate 121G(7.4.12)Forticlient(7.4.11.0198)iPad OS(16.7.16)Issue:The SSL VPN connectivity is working successfully on iPad devices running iPadOS 17 and Android devices.However, the issue happen on the iPad device running iPadOS 16.7.16. The SSL VPN connection often gets stuck at the "Connecting" stage, and the login page does not appear.(Remark:iPadOS 16 and iPadOS17 in the same network, and same ssl vpn setting)We observed that when the issue occurs, the FortiGate firewall does not receive any SSL VPN traffic from the affected device.（Enabled SSL VPN application diagnostics, but no messages were generated）

So 7.4.3.8758 was a patchfix version last month. A few days ago they released 7.4.3.4726 and I applied it...and now my patch management is crying that the patchfix version is newer...but it's clearly not.Thanks forti for not knowing how numbers work. 

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

Anyone seen a problem using FMG from Safari on MacOS where you occasionally (every few minutes) get a message saying connection to FMG was lost, usually counts down for a few seconds then reconnects. It's likely related to a tcp keep alive because it doesn't happen when I'm interacting, only when I'm idle for a few minutes. I'm just not sure if I should adjust Mac or FMG side. I only see this in FMG but it never happens on Windows machines, even using Safari.

I got problem.. I Deployment Web filter profile on Fortigate, my system already allowed & all runs well..But someday the license expired...then the Web Filter profile not running because license expired…and now i already renew, update & payment the license fortigate... Then Re-Deployment Web filter profile in rules firewall, but my system is blocking by Web filter profile without any changes on web filter profile.. i just replace / re-use Web filter after renew the license.Can you help explain what happen with this?FYI, Fortigate 101F with OS version :  v7.0.18 build0695 (Mature)This alert / alarm show in URL my system must be allowed, but blocking by Security Policies → Web Filter Profile : 

FortiClient IKEv2 IPsec VPN – Negotiation Timeout After 30 Seconds During RADIUS/EAP OTP AuthenticationHello everyone,I'm experiencing an issue with an IKEv2 IPsec remote-access VPN using RADIUS/EAP authentication with MFA/OTP, and I would appreciate your feedback or any similar experiences.Environment FortiGate: FortiOS 7.6.6 FortiAuthenticator: 6.6.8 FortiClient: 7.4.8 (ZTNA) VPN: IPsec IKEv2 Remote Access Authentication: RADIUS/EAP with MFA/OTP RADIUS server: FortiAuthenticator Issue descriptionThe issue occurs regardless of the OTP delivery method. We have reproduced it with: FortiToken Mobile SMS OTP Email OTP When the user enters the OTP within approximately 30 seconds, authentication succeeds and the VPN tunnel is established normally.However, if OTP entry takes longer than approximately 30 seconds, FortiClient remains in the "Connecting" state. The connection eventually fails with an IKE negotiation timeout, and the tunnel is not established.Important observation: