Solved

Hi,I have 2 firewall rules, if the computer is in "open group", there is no problem, They are working with rule 94. But a computer that is not in the group cannot use rule 95. If I disable rule 94, everyone is working.I don't have this problem with my other firewalls.Thank you 1)edit 94set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set ssl-ssh-profile "no-inspection2"set logtraffic allset nat enableset groups "Open Group"nextend 2)edit 95set srcintf "CLIENT"set dstintf "virtual-wan-link"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set utm-status enableset ssl-ssh-profile "certificate-inspection"set av-profile "default"set webfilter-profile "default"set ips-sensor "default"set application-list "default"set logtraffic allset nat enable

Hi, can someone please let me know what the latest firmware version is for Fortigate60F? I have Version v7.0.13 build0566 (Mature)thank you!

Hello team!!! I have the following issue:We have many Fortigates in many different places, some Fortigates have a L2TP/IPsec VPN, which I can connect ussing the Windows native client, and anothers Fortigates have an IPsec VPN, which I can connect through FortiClient VPN.I have FortiClient VPN 7.4.3 in my Windows.When I restart my computer, I can connect to any VPN, but after connect and disconnect to any IPsec VPN with FortiClient, I cannot connect to any L2TP/IPsec VPN, until I restart the computer again.The same with 7.4.1A co-worker installed also 7.4.3 in his computer (Different computer and user, of course) and get the same issue.I cannot use 7.4.4 because we still have many IKEv1 IPsec VPNsIs there a way to workaround or solve this issue instead of restarting the computer?As this is happening in more than one computer, I think this is a bug in FC 7.4.1-7.4.3 Thanks in advance.Regards,Damián

Hello, Our FortiAuthenticator HTTPS certificate is close to expiring, and I would like to know what the impact would be if we continue using the expired certificate. Our FortiAuthenticator manages WiFi access and VPN MFA tokens. Thank you.

I have a problem when i try to up a IPSec VPN deployed from EMS Forticlient 7.4.4 on PC Core I3.I have 2 PCVPN Type: IPSec IKE V2 Deployed by EMS.i5 13420H 24GB RAM -> VPN get up easy and fast.I3 10110U 12GB RAM -> VPN Never get up.  The two PC have the same configuration de VPN IPSec. I Can't get log information because its empty, not save the IPSec VPN logs. 

Hi, I do have existing FortiGate HQ 7.4 and 7 remote branches 7.6, all configured and running. Recently, I added FortiManager to my environment. I added all Firewalls to the Manager with two ADOMs, one for 7.4 and another for 7.6. Now, I want to achieve centralized management for my Firewall. On each Firewall, I have almost 1,000 objects, 50 policies, SD-WAN, and VPN. I checked with ChatGPT to determine the best option for promoting the configuration from local on each firewall to be shared for all devices within the same ADOM. But I need to understand if that's double or there is anyone has faced the same scenario. thanks:keycap_1: Use “Bulk Move / Promote” in FortiManagerInstead of promoting objects one by one:Go to ADOM 7.6 → Policy & Objects → Addresses / Services / VIPsClick More → Bulk Move / PromoteSelect all objects you want to centralizeFilter by type (Address, Service, VIP)Filter by usage (used in multiple firewall packages)Choose Promote to

Hello, When trying to create in Fortigate an IPAM subnet with a Class C subnet (192.168.0.0/24), I received an error stating that the mask must be within the range 8–16. The document below also states that the IPAM pool subnet can only be a Class A or Class B subnet. I’m trying to understand the reason for this limitation, or whether I might be missing something, since our current subnet is Class C. https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/166728/configure-ipam-locally-on-the-fortigate

Hi, I am trying to migrate IKEv1 to IKEv2 Dial-UP VPN tunnels for devices that use Forticlient and that do not use Forticlient(e.g. MacOS).The configuration includes a split tunnel setup.When a Forticlient enabled client attempts an IPSec connection the client acquires a split tunnel VPN session. I can see the following few lines in the debug session that indicate routes will be installed in the routing table of the device. ike 2:QDIPS_0:10843292: processed INITIAL-CONTACTike 2:QDIPS_0:10843292: mode-cfg assigned (1) IPv4 address 172.28.12.1ike 2:QDIPS_0:10843292: mode-cfg assigned (2) IPv4 netmask 255.255.255.128ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:10.0.0.0/255.0.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:172.16.0.0/255.240.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:192.168.0.0/255.255.0.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:91.200.16.0/255.255.254.0:0ike 2:QDIPS_0:10843292: mode-cfg send (13) 0:141.176.34.0/255.255.255.0:0ike 2:QDIPS_0:1

Hi Team Is there any way to find full list of FortiSASE POP IPs ? For check the latency before the deployment. Thank you. FortiCloud Products   

Hi, we set up an ADVPN Hub and Spoke network layout like this: Hub is Fortigate 3000F, Spoke is Fortigate 60F.We configured BGP on Hub and Spoke (on the IPSEC Tunnel)We noticed that "connected networks" of spoke are distributed correctly: 10.39.80.0/24 -> IPSEC TUNNEL but the static route (10.172.6.1/32 -> 10.39.80.2) is distributed with the wrong "next hop".  On the Hub we got:10.172.6.1/32 -> 10.39.80.2instead we would10.172.6.1/32 -> IPSEC TUNNEL Any hints? 

Hi,I'm having trouble with this setup with an IPsec setup: I'm trying to replicate what i had with ssl-vpn; multiple local user groups and the possibility to connect via phone.I could make it work with different users by using a tunnel for each group with a unique ID, the problem is when connecting via phone it doesn't work. I've read some documents that say to use IKEv1, other to use IKEv2, the problem is FortiClient mobile doesn't let me configure auth/enc on IKEv1. I also tried using eap settings but i get stuck in the login prompt, asking for the password on repeat, so i still couldn't connect with phone with any of the config i tried. Have anyone encountered this? or do you have any paper with the steps on how to make an IPsec tunnel work for both PC and mobile?Thanks,

Hi Fortigate has failed and the operating system must be reinstalled.Fortigate model is 401F. The log on the disk disappears due to OS reinstallation, but the customer wants the log to remain on the Fortigate disk. I'm using FAZ, can I transfer the log in FAZ to the disk in fortigate? Thank you.

Hi, I do have HA Active Passive FortiGate - Active and Running. Recently, I added a new FortiManager. Kindly guide how I can add FortiGate as an HA to FortiManager. There is an option on FortiManager to add an HA Cluster. But that means that this is for a new deployment, and now I'm in production. I followed the normal way to add a node from FortiManager - Add Primary IP - Then I noted that the Secondary became out of sync. Kindly guide me to the correct way.

Dear all, we would like to use VDOM partitioning. In every example I found the FortiGates are ind of connected fully meshed, every vdom uses its own physical interface.  I actually want to do something different: 2 FortiGates (FGCP), both with:- WAN link uses 2 10GbE Interfaces with LACP- LAN link uses 2 10GbE Interfaces with LACP root VDOM on vcluster 1 (FortiGate FGCP A1.1)vdom1 VDOM on vlcuster 2 (FortiGate FGCP A1.2) Do I need separate physical interfaces for each VDOM or may I share all physical links between vdoms, i.e. using different VLANs on top of the physical links (i.e. WAN and LAN interfaces)?   

I have a new deployment, using:Fortigate 120G Controller v7.4.9 build2829andFP231F-v7.6.0-build0894 After a lot testing, I got that the FortiAP GUI is "click sensitive", as the click order of the checkboxes, affects the dtls encryption policies, so I stick with the cfg -a AP_DATA_CHAN_SEC=ipsec-sn,ipsec,dtls,clear in APBut in the controller...Im typing : set dtls-policy ipsec-sn-vpn ipsec-vpn dtls-enabled clear-textAnd still, showing clear-text first (in fact, the exact reverse oder I want)config wireless-controller wtp-profile    edit "MyCustomProfile"        set dtls-policy clear-text dtls-enabled ipsec-vpn ipsec-sn-vpn    end Ok, this could be only a "quirck", being ignored by the internal logic of using the most secure option first, regardless of the order shown in the CLIBut... the sad story .. the channel is CLEAR-TEXT!!!!!!!!!Why is that?What I want?1) Use all options available on AP2) use

Haii  I have license trial FortiSIEM from principle fo 2 months If I install FortiSIEM with license trial and license trial expired, can I extend with license production? Or cant and I must scarp FortiSIEM with license trial and fresh install with license production?

Hi there,we are working with multiple IPv4 subnets in the area 10.98.0.0/19 but we're configuring them on multiple interfaces as multiple networks with subnet lenght 26.I'd like to add a filter to the prefix list - In Bird2 you can work with greater than equal or less than equal like 10.98.0.0/16{26,26}I tried the same on forti manager, I've added a an entry to the prefix list and entered 26 as prefix length in both greater than and less than. But it throws an error:I don't understand quite right, as it keeps telling me "Greather than" must be greater than prefix (met) and less than or equal than "less than" (which is met as it's equal to it)...What am I missing?

Hello There,We are trying to run a playbook to extract pdf files and upload them as a attachment.Extraction seems to work fine but we end up getting a error on the upload.Following is the error in the UI.\n CS-INTEGRATION-5: Error occurred while executing the connector action ERROR :: 400 Client Error: Bad Request for url: https://localhost/api/3/files :: {'type': 'TypeError', 'message': \"Internal Server Error. Check log 'prod.log' for more details\"} :: Url: https://localhost/api/3/files Call for URL: https://localhost:9595/integration/execute/ failed with status code 400 \n Looking at prod.log in cyops-api/prod.log we can see that there is a Issue with the restrictedMimeTypes. [2025-12-02 09:10:07] php.WARNING: Warning: Undefined array key "values" {"exception":"[object] (ErrorException(code: 0): Warning: Undefined array key \"values\" at /opt/cyops-api/src/Service/UtilityService.php:669)"} [] [2025-12-02 09:10:07] php.CRITICAL: Uncaught Error: App\Controller\FilesControll

Hello, i try to write a Report Query with a where clause for the "action" field, if action is only in the "SELECT", "GROUP BY" and "ORDER BY" statement everything works as expected, but if i add the action field to the "WHERE" clause it does not work.The following query does not work, commenting out the "AND action like 'deny'" row will make it work, can somebody explain this behavior to me??I am using "traffic" log type source. SELECT srcip, dstip, action FROM $log as l WHERE $filter AND policyid=0 AND action like 'deny' GROUP BY ( srcip, dstip, action ) ORDER BY srcip, dstip 

Dear Expertise, I would like to ask you regarding backing our Fortigate log to tape is a good way or not? we are using FAZ and our license can support only 5GB per day. Thanks

I use my FortiAnalyzer (7.4.8) as a "poor man" syslog server and am trying to see if I can incorporate logging from Cisco Umbrella. Cisco Umbrella only sends to AWS S3 storage and I have the path and keys for said bucket. I saw where FortiSIEM has said functionality, but I don't own that product... so seeing if there is a way to handle this via FortiAnalyzer in any form or fashion. This might end up being my final push point if it cannot, to go with something more dedicated as my new syslog platform.

We have our Fortigate firewalls configured for Syslog offloading to Cynet.  We are then trying to take action, to block IP addresses of users trying to brute force VPN credentials.  We are using a script provided to Cynet by Fortinet named Fortigate-Remediation V0.2.exe, and when it tries to block an IP address, it is getting back "Max retries exceeded".  Any chance anyone knows what the fix for this is?

Do you have to use the Fortinet DNS servers in order for all the filtering subscription services to work properly?

EnvironmentWe have two separate FortiGate-VM HA clusters:Cluster-A (VM-A-HA): 2 nodes (active–passive)Cluster-B (VM-B-HA): 2 nodes (active–passive)Both clusters run FortiGate-VM BYOL licenses (one license per VM node).Background / What HappenedThe licenses on both nodes of Cluster-B expired.To maintain service availability, we performed a temporary workaround:Powered off both nodes of Cluster-A.Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.Uploaded these two licenses respectively to the two nodes of Cluster-B.Cluster-B resumed normal operation with those temporarily reassigned licenses.Cluster-A has remained powered off since the license transfer.Current SituationWe have now purchased new licenses (one per node) for Cluster-B.Our intention is to:Apply the new licenses to both nodes of Cluster-BRestore the original Cluster-A licenses back to the two nodes in Cluster-ABring both clusters back into healthy HA state with proper licensing.Before do

Please advise — my penetration testing team is recommending that I enable admin-restrict-local on the FortiGate firewall. However, if I do that, local admin logins will be completely blocked whenever remote authentication servers are reachable. My concern is about integrating the FortiGate device with FortiManager (FMG), which sometimes requires local credentials. If FMG tries to connect to the device using local admin credentials over the network (via SSH or HTTPS), those logins could be denied because of this restriction. Since FortiManager (FMG) and other management tools rely on local admin credentials or API access over the network, enabling admin-restrict-local—especially in restrictive modes like non-console-only or all—could disrupt those connections. So, would it be correct to assume that enabling this setting in a production environment is not advisable?