Solved

Hello,i need to move my on premise Fortianalyzer to Azure.How can i move my license actually associated to the on premise faz to the new one on azure?Is it feasible?I would like to do the following: create the new faz on azureimport the old faz configuraziontransfer the on prem license to the new azure Fazchange the ip on all the fortigates to the new Fazbe able for a short period to access the on prem faz to see the old log (i.e. for two weeks), i these case i need a trial license or because it's receiving no logs i'll be able to access the machine with no license?haven't found documentation about transferring the licence, so i think i just need to go on my forticloud and change the serial number of the old on prem faz with the new one, is it correct?And at which stage of the deployment should i select the BYOL ? Thank youRegards

I have a FortiGate71F (v7.4.8 build2795) "FortiLink'ed" to a FortiSwitch124F (7.6.1-build1047)I have a Dynamic Port policy:config switch-controller dynamic-port-policy edit "typcialdevices" set description "A port policy for typical devices we know about." set fortilink "afortilink" config policy edit "forti-aps" set description "The FortiAPs" set mac "b4:b2:e9:*:*:*" set hw-vendor "Fortinet" set family "FortiAP" set vlan-policy "vpapmgmt" next edit "pmsi-default" set description "LAST policy rule. This indicates the default properties for any" set mac "*:*:*:*:*:*" set 802-1x "nps-even" next end next endI have a Security Policy:config switch-controller security-policy 802-1X edit "nps-even" set security-mode 802.1X-mac-based set user-group "nps-radius"

We received this notification from our Fortinet support team regarding SSL VPN tunnel mode.is this referring to SSL VPN for users using forticlient SSLVPN or site-to-site IPSec VPN tunnel ?We are still using SSLVPN mode in our forticlient VPN.SSL VPN tunnel mode replaced with IPsec VPNStarting in FortiOS 7.6.3, the SSL VPN tunnel mode feature is replaced with IPsec VPN, which can be configured to use TCP port 443. SSL VPN tunnel mode is no longer available in the GUI and CLI. Settings will not be upgraded from previous versions. This applies to all FortiGate models.To ensure uninterrupted remote access, customers must migrate their SSL VPN tunnel mode configuration to IPsec VPN before upgrading to FortiOS 7.6.3 and later.See Migration from SSL VPN tunnel mode to IPsec VPN in the FortiOS 7.6 New Feature guide for detailed steps on migrating to IPsec VPN before upgrade.A complete migration guide can be found in the following links:For FortiOS&

Hi all,  We are working through setting up SOAR platform. We noticed that many connectors are referencing dependencies on solution packs which are not of relevance to us. Is there a way to install the connectors without the Solution Pack dependencies?FortiSOAR Thanks, S

Hi folks, is there any way to re-send the activation email via FortiManager? The customer says it happens very often that this email is not received when a new user is added. When I tested it, email sending from FortiGate (version 7.4.8) worked fine. Platform Type : FMG-VM64Version : v7.4.7-build2685 250527 (GA.M) I know how to re-send the activation email from FortiGate and I also know how to find the activation code in the logs on FortiGate. I'm only asking if there is a way on FMG for this one customer. Many thanks in advance! FortiManager FortiToken  

I’m trying to create a policy to block IPs from the EmergingThreats list using an External Connector feed, but it doesn’t seem to be working as expected.I have an External Connector > IP Address External Feed configured, and it shows approximately 1500 valid entries.Connection Status 2025/10/28 08:31:32Last Content Update 2025/10/27 16:31:24Entries 1490  Valid  I can view the entries, and if I manually test one of the IPs by browsing to it, the connection succeeds, it’s not being blocked. If I add a single IP address directly to this rule, it does block that address correctly. However, when I rely on the external feed, it does not block any of the listed IPs. I’ve also tested with other external IP lists, and I’m seeing the same issue.Is there something wrong with my configuration, or should I be implementing IP blocking in a different way?Here’s the policy configuration I’m using:config system external-resourceedit "Emergingthreats-block-IPs.net"set uuid 05a9ff8e-cf9

Hi I have an issue with change SSL to IPSec configuration.I follow instruction to build FortiClient Dial UP connection.https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Dialup-IPsec-VPN-Split-Tunneling/ta-p/192207I have an issue with split tunnel, on windows enviroment doesn't appear single routes that assign via split tunnel but only default router. From android trablet it seams work. I am created n°2 policy,1st Dial Up Tunnel -> Local LAN                                       OK2nd Dial Up Tunnel -> to other IPSec tunnel                  KO 2nd policy doesn't work, in diag I see the packet sent but i can't receive answer What can i test? 

Hello team!!! We have a Fortigate 100F with many IPsec VPNs for FortiClientI configured all IPsec VPNs with IKE v1 and allways used an AD group synchronized in the Fortigate for user authenticationAlso, I use the peer ID field to select an specific VPNAll these VPNs are workingNow I created an IPsec VPN with IKE v2, but when I try to connect, I get an error:In FortiClient: Wrong Credentials EAP failed connecting to VPNnameIn Fortigate: date=2025-07-23 time=16:06:15 eventtime=1753297576267021760 tz="-0300" logid="0101037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.3.5.7 locip=1.2.3.4 remport=4500 locport=4500 outintf="port9" srccountry="Argentina" cookies="b51c1f1809859ab8/7f365d0b1f864add" user="1000" group="N/A" useralt="N/A" eapuser="testdomain" eapauthgroup="N/A" assignip=N/A vpntunnel="IPsec-dom-W3" status="failure" result="N/A" peer_notif="NOT-APPLICABLE" fctuid="E2D4BA7

Hi everyone,I’m currently facing an issue in FortiSOAR. I’ve created a playbook that works fine, but it requires a manual trigger every time a new alert is created.My goal is to have the playbook run automatically whenever a specific type of alert is generated from FortiSIEM (for example, based on alert name, severity, or category).Could anyone please guide me on how to configure FortiSOAR so that the playbook is automatically triggered based on certain FortiSIEM alert criteria?Thanks in advance for your help!

We have some clients using the Forticlient VPN who get looping at 98%. Others are connecting with no issues.The login is set up to use SAML from EntraID. They successfully log in and this can be seen in the EntraID logs. The connection process gets to 98% and the user is prompted to log in again. I have tried this on a failing device with both the latest 7.4 version and with an old 7.0.8 version and get the same result. The FortiGate the VPN connects to is running 7.4.9.Checking the logs on the FortiGate, there is no indication that the user attempted to connect. Checking the event viewer on the failing client there are no errors listed refering to the FortiClient or for the time the login was attempted.The clients are all Windows 11.I did find one article about setting the global ssl_vpn_webmode to enabled but this was already set when I checked.

I have a customer using FortiSiem Cloud version 7.3.4, the customer wants to integrate Google Soar via API with FortiSiem, there is documentation from google regarding this integration:   https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/fortinet-fortisiem?hl=es-419   We created a user with full admin permission, but when we try  the connection from google Soar we see a 401 not authorized response, according the fortisiem cloud documentation the API is supported with some restrictions.   Differences between FortiSIEM Cloud and FortiSIEM | FortiSIEM Cloud | Fortinet Document Library   I would like to know if someone have done this integration in the past, and maybe what are we missing in the configuration.    

Hello, i have a working VPN Device Tunnel (named FG-VPN-Device) for my Windows 11 Clients. These clients can connect on a certificate based authentication with the fortigate firewall.The Tunnel is configured with Mode Config enabled and a the IP is assigned with a Client IP Range (10.58.58.50-10.58.58.99). But i can´t route any traffic over SD-WAN with this config, as the IP Range has no gateway.After some more reading, i think, that i need to set a IP and DHCP Server for this Interface (named FG-VPN-Device). I followed this article  DHCP IP address reservation with Dial up ... - Fortinet Community But after settings these options, the Windows 11 Client can´t connect anymore.There is no DHPC assignment to the client. any idea what is missing?

Hi all, I've been using Forticlient VPN for a while on my M1 MacOS and it worked perfectly. Suddenly, when I try to connec through VPN it always come the same error: "Network error. The request timed out."I've tried with firewall off and different networks and still it doesn´t work. I also have total access to disk and network extensions on for Forticlient. Do you know what could be? Thanks!! 

Hi, Users connect to M365 services using a redirection authentication to the FAC (version 6.6.2).The config is working fine on Microsoft and iOS but not on Android devices.For example, if i add an account to the teams application on the phone, i insert the username and after that i receive got a blank page and not the fac page. All suggesition will be appreciated :) Regards,Simon  

Trying to set-up Agentless Portal access as per  https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Agentless-ZTNA-with-FortiGate-v7/ta-p/373718#M11651 I have it all configured but when I try to access the web portal I get the following error. Any suggestions?

I just ran into this: I have an Adom in FMG. In this is a FGT100F I want to use for lab purposes. It was reseted to factory default before adding it to FMG. It added successfully and I can configure it in FMG. I was able to deploy device configuration to it successfully.I then created a provisioning system template that assigns system dns, ntp etc. The template also does the interface config (creating vlan interfaces and afterwards configuring them). For the interface configuration one variable out of the policy package is used.Once I assign that FGT100F to that template and try to deploy device config only it fails. There is no installation log available and the progress log only says "[fw-teststandort1[copy] root] Copy global shared objects failed (adom:my_Adom, dev:fw-teststandort1) (reason:none)". It does not provide any further information. Also dia deb app securityconsole 255 does not provide any more information. Does anyone have a hint on how to further debug this to

Hi, I have new deployment project for ZNTA. We have a Local CA. we have generated a CSR from FortiGate and signed it by a local CA to be imported in FortiGate. and for EMS I would like to know what should do for the certificate, as there is no CSR option. Should I only import local CA Root Certificate to EMS server? Kindly need help to understand the certificate required for EMS within local CA and FortiGate.

We have two pairs of 91G's running 7.4.6 at two different locations. Each has a DMZ with subnet 192.168.100.0/29, and each location has a route map that allows redistribution of connected routes into OSPF. Site A is preferred and has route redistribution with a better metric. This works fine, but the problem is if the server at Site A goes down, but default the associated FortiGate doesn't know that server is down (the switch port is still up) and continues to advertise the connected route. Is there a way to configure SLA to query the server at 192.168.100.2, and if that server is not reachable, then the FortiGate removes 192.168.100.2/29 from the OSPF process until the server is once again available?

Hi Everyone,I wanted to know what i need to specify for getting all records from splunk. normally the variable is "max_count" i tried to remove but its not worked

Hello, I need your help.I have a Fortigate 100F running firmware 7.4.7, and I have configured GRE over IPsec tunnels.My networks are routed using static routes.The problem is that when one tunnel goes down, the traffic still continues to flow through the main tunnel, so failover to the second tunnel does not occur.Is there a way to configure something like a link monitor or any other mechanism so that when Tunnel1 goes down, it automatically switches to Tunnel2

We have forti cloud EMS version 7.4.3 , invitation code (no expiration set) set to single user does not work, when user is entering invitation code in forticlient-7.4.3 version ( tried both manually and copy paste), it does not give any error it's just show processing tab and nothing moves further. Tried to entered invitation code via CMD also but no luck. Please help here

Dear team, Has anyone else observed this issue? When we create a contractor user with a corporate email address and no one logs in with that user, after a while, it causes the existing user VLAN to change to isolation. When I check that user and click Show Hosts, I can see another host belonging to the same user with the contractor email address. The strange thing is that when I check that host, I can see that the logged-on user is the contractor user, even though we did not log in. Somehow, I guess the passive agent finds that device user, checks the email address, and matches it with the contractor user. Is this normal behavior? It's not happening instantly; it takes some time to detect the other host and link it with the contractor user. My goal is to create a contractor user, assign them to the onboarding VLAN, and install new computers. That's why the help desk team creates users with corporate email addresses and keeps them for a month. Do you have any suggest

We have a vendor who has 2 servers with 2 NICs configured with teaming. Port 1 of each server is directly plugged into port 2 of each FortiGate (also belongs to vendors, and these are 60E's running 7.0.x). We've been testing failover, and it's been problematic. At least one server, sometimes both, will be unreachable when we test failover. We can disconnect the cables to the standby FortiGate, and the servers are instantly reachable. Even after the server is reachable, as soon as we plug the cable back into the FortiGate, the server is sometimes unreachable. We've not had any experience with this before, but then all FortiGates we manage have ports plugged into switches. Are there any ideas as to what we can try? Thanks

Hi Guys. I have starved my own knowledge and googlefu so i hope someone in here can help me.We are transitioning from SSLVPN to IPSEC VPN and want to keep using our SAML setup. When trying to connect to the IPSEC VPN tunnel i get prompted with my SAML prompt, enter my credentials, log in and the client then hangs in "Connecting".In my debug i see the SAML request being processed and completes as it should but i see no IKE debug prompts.Nothing appears in my VPN log either. The only thing i can see is in my Forticlient, where i get an error regarding power which i reckon is not related to this. When connecting to the SSLVPN (same public IP, different ports ofc.) i go straight through and connect with no issues. Does anyone have any idea why i am stuck in "Connected" when my SAML request is processed?Kind RegardsEDIT:We have tested with Forticlient versions 7.2.4, 7.2.5 and 7.4.0 and with different vendors of net adapters and from different locations.

Hi everyone,I am searching for a way to use MFA with TOTP without paying for FortiToken.  Our internal users get authenticated via SAML and MFA from Microsoft Cloud. But we do have some external accounts which can't be linked to SAML but need VPN.  Is there any other way to set up MFA with a TOTP App without using FortiToken?