Solved

I am running some tests trying to connect a client workstation to another client that sits behind my Fortigate. The trouble is, the Fortigate connects out to the internet via an existing firewall (edge). Therefore the Fortigate is receiving a Private IP from the edge firewall on it's WAN interface. I have proven that I can establish a VPN connection to WANs private IP when connecting the client to the LAN of the edge firewall but now I want to prove that I can create a VPN connection from anywhere in the world. When I enter the public IP address of the edge firewall into Forticlient, I get an error saying VPN down. What must I do to be able to connect from a client in a different location over the internet, through the edge router, into the fortigate and to the "accessible LAN"?

Dear all, For my upcoming wifi project I have to use azure entra as authentication server while I will using the fortigate fw and forti AP. Does anyone knows what feature or/and license are need for the forti ?  Thanks in advance

Hello, I'm wordering if I setup a client with best pratice. Three months ago I setup an SDWAN with two IPSec VPN on Fortigate with another vendor (Forcepoint), It works well as far as I know. (We did some faiolver tests). Forcepoint do support active/aclive VPN (all route is active at same time on FIB), so I just think "that is possible". Today someone told me "There is no SDWAN within different vendor".  Someone here did this type of deployment before? 

Thanks for the help!When firewall receives traffic, it will match the firewall policy by Source_interfaces/Protocol/Source_Address/Destination_Address. I'd like to know why destination interface or outgoing interface is NOT used in policy matching? and if so, why it is to be specified when creating a firewall policy,  is it used for NAT or something other than policy lookup?Thanks again.

Hello team, I wanted to know what is the best method to manage fqdn to be blacklisted. Basically, is it better to use an ad hoc web filter profile or to create fqnd groups with wildcards?My goal is to block specific fqdn for everyone globally. Thanks for the supportBR

Hi Community Member, We have cisco Iron Port on cloud and Fortisiem on prem there is not connectivity between them. How can we get logs from Iron port.

i have one laptop with VPN connection issue.after connecting to SSLVPN, the user will lose Internet connection.What i realize is that on the Ethernet settings for the SSL virtual connection ip address is 169.254.x.x instead of our usual ip address range 172.15.x.x. once i disconnect forticlient, the Internet connection resume.I tested forticlient 7.0.8 and 7.2.6. both version have the same error.removed and re-installed forticlient also do not work.

My company has an R&D facility in one of the southern US "desert" states. The facility is 20 minutes outside of the nearest town and any significant Wifi interference sources, yet we started experiencing poor Wifi performance. I've been troubleshooting and cannot identify the root cause. Let me explain our configuration. We have 2 FortiAP-432F outdoor AP's, the first is the ROOT AP, it is mounted to a post on the side of the office trailer and connected to the main switch. The other AP is the LEAF AP, and it is mounted on a telephone pole across the site near some other trailers. It is connected in a MESH configuration with the ROOT AP. I am using the 2.4 GHz channel as the backhaul, and the 5 GHz channel for the devices. We have three Wifi networks, corporate, guest, and the MESH network. the MESH network is assigned to the 2.4 GHz radio, and the corp and guest networks are assigned to the 5GHz radio. The channels and power are set to auto.  The firewall sees both APs an

Hi, I'm relatively new to FortSwitch and come from Cisco land - so please forgive my ignorance in advance :smiling_face_with_smiling_eyes:   We’re looking into purchasing some Fortinet switches and have a requirement to send traffic in different VLANs across separate physical links. My question is, would it be possible to create different trunks and then isolate specific VLANs to specific trunks?   For example, VLANs 10 and 20 on Trunk 1 only, while VLANs 30 and 40 would be allowed over Trunk 2 only.   For some additional context, the switches would likely be managed using FortiOS via FortiLink as our existing firewalls are FortiGates. We’d also be looking to include access and distribution level switches in the architecture.   Thanks!

Hello everyone,   I am new to the forum and Fortinet in general, so bare with me if this is an obvious mistake.   On a Fortigate firewall with updated firmware I have configured two WAN interfaces to work with SD-WAN rules that leave WAN1 as the main one and WAN2 as backup. This works fine.   However, I want to be able to ping WAN2 and redirect some of it's ports to internal clients, which is only working if WAN1 is down or if I switch the priorities around (otherwise the WAN2 ports are closed from the outside). I tried disabling all the port redirection policies and only try ping and ssh, but the problem persists.   The only relevant post I found is this unsolved one. Looking at the answers, I checked my default routes and I have two with destination 0.0.0.0, both of them with "Gateway Address" corresponding to the correct one of their interfaces (WAN1 and WAN2). Is this correct? Or should I have one with Interface as SD-WAN? What else should I check?   Thanks

Hello,how can I set the forticlient to update itself?Or what is the easiest way to do this?I am on version 7.0.9Thank you very much 

Hi guys, I am trying to configure the automatic tftp backup on our new 100F Forti. I followed a guide how to do the configuration but according to the syslog the process always gets somehow stopped and deleted by the autoscript. When I execute the command manual the backup works. We have two VDOMs, root for MGMT and 1 for production traffic. The configuration is done in the global level (I also tried with adding config global in the cli script).Anyone has an idea where the issue can be? I am absolute cluesless :\ The Eventlogs I have says:1. Automation stitch triggeredstitch:backup-stitch is triggered.2. Autoscript stop automaticallyscript autod.6 stopped automatically3. Autoscript delete resultUser delete the result of script autod.6 from autod The Config looks like this: Trigger:config system automation-triggeredit "TFTP-Daily-Backup"set description ''set trigger-type scheduledset trigger-frequency dailyset trigger-hour 16set trigger-minute 54nextAction:edit "backup-ac

There is no drop down menu. no choices.When I try "unhandled" or "open", won't kick off. 

Hello,i want to change some things on our guest wifi.Currently i am using the Guest Management on my FortiGate with Random User and PW. I would like to have one AD-User for all Guests. So they all log in with the same credentials.They should also accept an Agreement and type in there Email. I found the replacement messages and tried to combine "Login Page" and "Email Collection". I don't know if that really works because i don't know where the adresses are getting stored. Does anyone know where the email adresses getting stored? Or if that is even possible.Should look like this: (Short explanation why i want to use one AD-User: i want to display the credentials (PW changes every day) on screens for the guests)Currently the guest wifi is just an interface on my FW and configured there.

Dear Community support, I've had a custom avatar image a while (think, I've set this two-three years ago) and tried to update it recently. But my finger was too fast, so I got one of the "community avatars" now.Now, my question is: How can set a custom image? Following the FAQ, this seems a little bit outdated:https://community.fortinet.com/t5/help/faqpage/title/images_changeiconThe gallery is now called "photos" and uploading a public photo does not enable an additional tab in the settings area. Is this simply not possible anymore or am I missing something? Thanks,Christian

My Fortigate environment for wifi guest user is a external authentication portal by FortiAuthentication; i replace the Fortinet certicate SSL with my own CA ( Sectigo ) to avoid warning certificate from browser.The workflow begin with the external page of FortiAth " https://fac.xxzxzxzxx.YY/portal"; authentication is processed by Fortiauth but the browser goes redirect at internal page in this url "10.12.0.1:1000/fortiauth.... " without also the HTTPS form... This is the IP internal interface of Fortigate for the specific SSID. The browser warning that it's insecure because it's not in HTTPS and show the warning to trasmit the credential in a non secure channel...How do I avoid this warning and continue the protected session?

Brand new to Fortinac. Discovered several hundred infrastructure devices. Need to change the CLI (ssh) creds Fortinac uses to connect to these devices. Looking for a way to do this in bulk from the GUI vs. changing every device individually. Any help is appreciated.

Community,I have the following configured on the fortigate Service, Object configurations. s-udp-1433      Custom Service    TCP/0:0, UDP/1433 What does TCP/0:0 mean in this case? Regards, Willem K.

Hi everyone, I'm having an issue with my Fortigate FG 60E. It hasn't updated to the latest firmware and is currently on version 7.2.6. When I check the 'latest' section under fabric management firmware update, it indicates that the firmware is up to date. However, if I select 'all updates,' it shows that versions 7.4.0, 7.4.1, and 7.4.2 are available. Should I manually update from 7.2.6 to 7.4.2, or is it better to wait until these updates appear under 'latest'?

Hello, I´ve configured an LDAP Server, Connectivitiy test is successful (Windows2022 Srv) Also I created a UserGroup with the LDAP Server and chosen the desired Group from LDAP I cannot figure out how to login with an account which is member of the group Domain\Username username@domain does not work. Password is known, Account is not locked in AD. Any help is appreciated!  

I have a site-to-site link between two offices and I need to force one VLAN from site A to use site B as it's gateway for internet access. Currently the site-to-site link allows for devices from either network (including other VLANs) to communicate with each other, but they use their home firewall for internet access. I need this one site A VLAN to go out site B's firewall for internet access. 

Hi Support Forum! Could you please provide me on more information about this bug in 7.0.13 When configuring an 802.3ad aggregate interface with a 1 Gbps speed, the port's LED light is off and traffic cannot pass through. We have configured 802.3ad 1 Gbit Interfaces and i am afraid to update the Fortigate. Or is it okay to make an update without interruptions.  BR

Hi all,I would like to configure  ACL for FortiGate and FortiManager connection. The devices are deployed in a closed network and FortiManager is acting as Local FDS FortiGuard server.For licensing update , FortiGate will get update from FortiManager. As per the document , we need to allow TCP/443 and TCP/8890 for FortiGuard override service. I'm confused what incoming and outing ports means by the document FortiGate to FortiManager ( Is it incoming port?)FortiManager to FortiGate ( Is it Outgoing port?) https://docs.fortinet.com/document/fortimanager/7.2.0/fortimanager-ports/465971/incoming-ports As per the document , TCP 8890 need to allow for incoming ports . Does that means  from FortiGate to FortiManager IP?Or is it 443 and 8890 need to allow for both direction  : FG > FMG and FMG > FG ? Please help me, thank you

Hi, I am new to using Fortigate and looking to update the source IP for local out routing\system DNS but the manual option is greyed out. It is on latest firmware. We have few more exact model firewalls but no issues. ,

Hey everyone! I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 but am unable to get what I need to work. Any help with this would be greatly appreciated!