Solved

Hello FortiCommunity, We currently are using FortiClient with an EMS server and noticed when we connect to the VPN we received our specified internal DNS on both our physical adapter (wifi/lan) and our vpn adapter. Our specified internal DNS are our domain controllers that run DNS services.   The issue we are having with this is that sometimes the FortiClient software disconnects or something in windows causes the application to crash. My assumption is when you hit the disconnect button on the FortiClient it removes routes and/or the static DNS entry. With that process not taking place the end result is that the static DNS that was not cleared, thus leaving the PC unable to connect to the internet.    Our users working from home do not get admin access to their network adapters as well. The combination leaves the end user unable to connect to the internet and our remote tool useless. Do you guys know why the static DNS is set- can we set this to obtain automatically? I d

Hello everyone.We have two FortiGate 100F devices configured in active/passive mode.We are using six site-to-site IPsec tunnels, as well as remote users (Windows/Linux) who connect via FortiClient VPN.In addition, there are users who connect from Android phones using FortiClient VPN for Android.About a month ago, the FortiGate devices were automatically updated overnight to FORTIOS v7.6.5 build 3651.After the update, external users lost the ability to connect via FortiClient VPN on Windows laptops.After reconfiguring the VPN settings and switching back to DH group 5, Windows laptops were able to connect again.However, FortiClient VPN on Android still cannot connect and returns an error.On FortiClient for Android, only the following DH groups are available: 1, 2, 5, and 14.I tried all of these DH groups one by one, but there was no improvement.I tested this on multiple Android devices, and also tried the full FortiClient VPN version.In all cases, I receive the same error in a loop (the

Hi all, Do Fortigate Firewalls support "BGP peer groups" by sharing the same outbound policies and setting instead of configuring each BGP neighbor individually and updates replicated to all peer group members. I can't seem to find any docs or commands that support BGP peer group config on a Fortigate like a Cisco or Arista Switch.  

The customer currently has approximately 50k concurrent explicit proxy users, and we are trying to identify a suitable FortiGate/FortiProxy model or scalable architecture to support this requirement.Unfortunately, we haven’t been able to find publicly available documentation that clearly states the maximum supported value for “Concurrent Explicit Proxy Users” on most FortiGate models.So far, we have confirmed the following:FortiProxy 4000G – 60k users (from published specifications)FortiGate 901G – 32k users (observed from device login)FortiGate 1001F – 32k users (observed from device login)Could anyone please confirm the supported values for the following models?FortiGate 1800FFortiGate 2600FFortiGate 3000FIf you have access to the device, the value can be found under:System → Global Resources → User & Device → Default Maximum Any insights or confirmations would be greatly appreciated. Thank you.

I am trying to install a FortiClient (VPN only) FortiClient I have downloaded the instalation file after filling the form https://www.fortinet.com/support/product-downloads#download-vpn-only I have selected the Windows version.When I launch the instalation file, it downloads image, unpack it, but then nothing happens.  

HiI continue to try to configure my first FortiGate. After admin login, the GUI hang on register  I think it's beacause it has no internet access.So I tried to configure on CLI.First WAN : edit "port1" set vdom "root" set ip 192.168.99.191 255.255.255.0 set type physical set alias "WAN" set role wan set snmp-index 3 next Then routeconfig router static edit 1 set gateway 192.168.99.254 set device "port1" next endThen DNSconfig system dns set primary X.X.X.X set secondary X.X.X.X endThen firewall policyconfig firewall policy edit 1 set name "LAN_to_WAN" set srcintf "any" set dstintf "port1" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set nat enable next end What have I missed :) ?RegardsMarc

HiI've just recieved my FortiGate 200G.I am following the quickstart guide. It says to connect WAN port. But there is no WAN port So I have connected a PC to the MGMT. I manage to acces the GUI.But It wants to connect to FortiCloud. But no wan port plugged = no internet access. So I tried console CLIhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-initial-configuration/ta-p/283529 config system interface edit port1 set ip 192.168.99.99 255.255.255.0 command parse error before 'ip' Command fail. Return code -61 So I am a little lost.Can you help ? Where can I find a Quickstart guide updated ?RegardsMarc 

We've been having issues getting a SiriusXM player to stream audio when connected to our network and Fortigate 100F and 200F firewalls running 7.2.12 build 1761 firmware. We have created a Firewall Policy for the device that Allows all traffic, with security profiles removed and no SSL inspection. DNS Helper has also been disabled for diagnostic purposes, and we are using external DNS (8.8.4.4 and 1.1.1.1). When checking Forward Traffic logs, we see no traffic being Denied, but the player will not stream audio. We verified the traffic for the device is using the Policy that has been created for it. When connecting the device to a wireless hotspot, the audio streams properly. Below is a sample flow debug:id=65308 trace_id=1 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=6, x.x.x.x:35366->34.215.0.215:443) tun_id=0.0.0.0 from VLANx. flag [.], seq 288633703, ack 3087288262, win 1503"id=65308 trace_id=1 func=resolve_ip_tuple_fast line=5901 msg="Find an exist

I have an on prem AD synced to Entra - my EMS cloud is connected and the Entra domain is imported over. I have configured SAML so when the client is pushed to my contractors who are non-domain joined devices, they will be prompted for credentials before connecting to EMS. The SAML redirect is occurring, but I am receiving an invalid response error after attempted log in. Any Ideas? EMS client packager version 7.4 patch 7.4.5   

Hi community, I have bought a used Fortigate 60E to work with SD-WAN. The port WAN2 not working (no sign of life) but my problem is the port WAN1 because it's working only Fast. My service provider router is Giga and my link is 500Mb. What is the problem? I count with your support Addtionals Informations:- The two WAN ports are 10/100/1000;- My firewall is up to date - version 7.0.12;- Memory and CPU used is OK;- When i tested the same cable on another port, it's works Giga (Today, it's my workaround);- When i forced the speed port to 1000, it's stop work; FortiGate#Fortigate60E

Anyone using FortiTester and can confirm / deny if test case configuration is not shared among users? If I create test case configuration and another user logs in they don't see my created configuration, and neither do I see theirs. These are remote (RADIUS) users.

“Is it possible to run FortiLink between a FortiGate and a switch over a Wi‑Fi bridge using two antennas, such as Ubiquiti Loco M5? Are there any known limitations or issues with stability? Thank you in advance for any advice.

Hello everyone, I have a question to which I was not able to find an answer yet.We have a SDWAN/ADVPN setup with one hub (vdom on a 400E) and about 80 spokes. For the hub we want to buy a new 200G, mainly because of the 10GB interfaces. I have found a couple of articles here about migrating a Fortigate to a new model and this article (346859) points out, that i have to add the new 200G to Fortimanager with the help of Forticonverter. Our SDWAN/ADVPN setup is a couple of years old (we started with 6.4) and I wonder if there is way to migrate the hub without breaking all the scripts.  Under VPN Manager -> IPSec VPN communities we have ADVPN-1, ADVPN-2 and ADVPN-3. Every ADVPN has  the same Fortigate with the "Hub"-role - and this is bound to the serial of the device.  I would like to replace this object with the new 200G.... Is there a document around, that shows how to do this?  Or do I need to create all the SDWAN/ADVPN stuff fr

Hi, I'm doing some playbooks and I always need to make a code snippet after a MySQL Run query connector (SELECT) to get - If query returns some data- Number of rows query returns My code snippet is always like this. if isinstance({{vars.steps.Query_CMDB.data}},list: print(len({{vars.steps.Query_CMDB.data}})) else: print(0) As I know when query returns data it always returns an array with N dicts inside (rows). But when there is no data, only return "success", so if I try with jinja to run  {{vars.steps.Query_CMDB.data | count}} > 0 Always return > 0 because when its "success" it counts the letters... There is a better way to avoid my "length" step? and only have the MySQL query step and after that, the decision step (if rows > 0 -> then X, else Y)

I have hub connect to the spoke using 3 different lines, and from bwlow pic i want to troubleshoot why path using 10.103.113.6 is not best path. Anyone knoe how to troubleshoot this? FW01 (Internet) # get router info bgp network 10.4.0.0/16VRF 0 BGP routing table entry for 10.4.0.0/16Paths: (3 available, best #2, table Default-IP-Routing-Table)Advertised to non peer-group peers:10.103.113.2 10.103.113.3 10.103.113.4 10.103.113.5 10.103.113.6 10.204.0.30Advertised to peer-groups:advpn_isp1 advpn_isp2Original VRF 0Local, (Received from a RR-client)10.10.111.6 from 10.10.111.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 1Last update: Thu Jan 8 04:59:01 2026 Original VRF 0Local, (Received from a RR-client)10.10.112.6 from 10.10.112.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 2Last update: Tue Jan 6 09:20:25 2026 Original VRF 0Local, (Recei

Here you can find all important FortiGate CLI commands for the operation and troubleshooting of FortiGates with FortiOS 7.4.  SystemGeneral System Commands   get system status General system information exec tac report Generates report for support config, get, show, tree set, unset, append, unselec Configuration commands <command> ? or tab Use ? or tab in CLI for help <command> | grep [-f] Grep command to filter outputs diag debug cli 7 Shows webGUI changes in CLI   Process Information   get system performance status General performance infos diag sys top [sec] [number] Control + C to stop command Process list Sort with P (CPU) / M (Memory) diag debug crashlog read Crash log  Network Network Interface Information   diag ip address list            &

Hi,I have created a remote IPsec VPN for remote users. the users can connect to the VPN.However, they can't access anything in the LAN behind the FortiGate through HTTP or HTTPS.For example, I can SSH to the FortiGate to manage it; however, I can't access it through HTTP/HTTPS.I don't have a route issue because I have ping/ssh to the FortiGate/LAN behind it. I don't have a Policy issue as I have allowed all the services.Model: 401FVersion: v7.6.4.

Hello FNAC adminsOn the support portal, image download, under FortiNAC-F > v7.00 > 7.2 > 7.2.9, I found this file: FNAC_install_7.2.9_build0166.bin.Made some searches but couldn't find anything about it.Do you have any idea?Is it for manual installation on a Linux server?If so then why it is not documented? And if so then is it supported?

Hello,Kindly assist me to develop a parser for the following Openshift logs. I am fairly new to FortiSIEM, so I am struggling to accomplish this.The following log is what I'm receiving on FortiSIEM from Openshift:<46>1 2025-10-26T12:49:43.522Z node01.internal.local redgreen-service-deployment-857cb4bb8d-l5v8r_blueyellow-service magenta-7f2a1c9f container - {"@timestamp":"2025-10-26T12:49:43.522728353Z","hostname":"node01.internal.local","kubernetes":{"annotations":{"k8s.v1.cni.cncf.io/network-status":"[{\n "name": "orangeviolet-net",\n "interface": "eth0",\n "ips": [\n "192.168.42.100"\n ],\n "default": true,\n "dns": {}\n}]","kubectl.kubernetes.io/restartedAt":"2025-09-22T01:16:48+03:00","openshift.io/scc":"anyuid","openshift.openshift.io/restartedAt":"2025-10-06T19:57:19.173Z"},"container_id":"cri-o://pinkteal-7f3c2d1a9b8c4e00a1234b567c89deffedcba123","container_image":"registry.internal.local/colors/redgreen-service:prod-blueyellow-20250916120214","container_image_id":"registr

Hi. VPN setting guide in the FortiSASE document doesn't have ikev1, it means IKE version can use only ikev2?And is FortiSASE's VPN IKEv2 not supported on Android?Does SASE have the ability to set up Android and SIA?Thank you

Hello,After upgrading FortiGate to version 7.6.5, we encountered issues with IPsec tunnels. According to the Fortinet technical article, the default Diffie-Hellman group values were changed from  5 to 14, 20, and 21. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-tunnels-not-connecting-after-upgrade-to-v7-6/ta-p/423320 Current situation:On PC clients, the issue was resolved by changing the configuration and setting matching DH groups (14, 20, 21) on both sides of the connectionTunnels are working correctly after synchronizing the settingsProblem: The FortiClient VPN application on Android does not have the option to select DH groups higher than 14. As a result, mobile users cannot establish VPN connection after the FortiGate upgrade.Questions:Is there a planned update for FortiClient Android application with support for DH groups 20 and 21?What is the recommended temporary workaround - should we roll back the configuration on FortiGate to older DH groups

 I have 10 collectors and successfully registered 9 collectors .1 Collector giving this error.I have tried wit different user after logged in to the GUI but the same error.   phProvisionCollector --add admin 'password' 10.10.1.11 Super fsm.col1Continuing to provision the CollectorFailed to register collector!Cause:HTTP Status 401  Not authorizedThis request requires HTTP authentication. seeking expertise answer

Hi. I can't sync with the ntp server after using executetime xx:xx:xx in Fortianalyzer.It is the same even if the ntp status is disabled and enabled.Is there an ntp sync command on Fortianalyzer?In the case of Fortigate, I can find out when it was last synced through the 'execute time' command, but how do I check it in Fortianalyzer? Thank you

Hello all.  In registering the collector with the super. /opt/phoenix/bin/phProvisionCollector --add 130859572admin 'passwordomited' <FQDN SIEM> <ORG>  <COLLECTOR NAME> Error: HTTP Status 401 - Not authorized This request required HTTP authentication.   I am seeking from the community any experience or knowledge of this occurring and the creds NOT being the issue.I  have found a wealth of connectivity troubleshooting articles. But nothing about  401 Not authorized return code error as a result of phProvisionCollector. What we checked.doubled check org name, admin name, etc.checked the collector exists under their org settings in the SIEMchecked Phoenix log and found "PUT" command error 401 from the collectorwe can see the super talking back on port 443found the ssl_access_log and it to had the 401 error from the collector Have not verified time sync by running the date command on collector and super, if they are out of sync

Hi, does anyone found a solution, to hold the VPN up and running when the screen is locked? OS: MacOS Sequoia 15.4 and MacOS Sequoia 15.5FortiClient: VPN 7.4.3.1761I had to install the newest FortiClient VPN version after a firewall upgrade as the older versions running in some connection problems.The older versions were stable and connected when the screen was locked. With the new version, the VPN disconnect each time the screen locks. In fortitray.log it is good to see, a message is send to forticlient and immediately after the message, the ssl-vpn is disconnecting. 20250508 14:55:24.613 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:390 System is locked/sleep20250508 14:55:24.620 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:404 System is going to sleep20250508 14:55:24.646 TZ=+0200 [FortiTray:INFO] VpnManager.swift:2163 Check VPN Connect without Reauth20250508 14:55:24.657 TZ=+0200 [FortiTray:DEBG] VpnManager.swift:2174 VPN Connection without reauthenticati