Solved

One of our remote offices has been having intermittent internet issues (thanks Comcast). From what I have been able to find, by default FortiGates don't do much health monitoring on WAN connections, and that if I want WAN health monitoring I need to configure SD-WAN. I have never configured SD-WAN before and wanted to avoid any gotchas. Some of the questions I have about SD-WANHow does configuring SD-WAN affect any WAN firewall policies? Do these need to be updated to point to the SD-WAN instead of WAN?We have a static IP, any concerns with SD-WAN and Static IPs?Will configuring SD-WAN mess with any IPSEC or SSL VPNs?We don't pay for FortiAnalyzer, without that will it make any Health Monitoring useless? 

I wasn't able to connect to an IPsec VPN through FortiClient VPN (7.0.2.0090 free) when updated to Windows 11 (build 22000), SSL VPNs were working fine. When I downgraded to Windows 10 (21h2 build 19044.1415) the IPsec VPN started working again. This is the error that I got on FortiClient  And this is the log that I exported   12/28/2021 4:02:55 PM info sslvpn date=2021-12-28 time=16:02:54 logver=1 id=96602 type=securityevent subtype=sslvpn eventtype=status level=info uid=19AEBE88942A48F59578C42AA765D590 devid=FCT8003159070034 hostname=DESKTOP-5BJFTJ3 pcdomain=N/A deviceip=192.168.224.1 devicemac=<redacted> site=N/A fctver=7.0.2.0090 fgtserial=FCT8003159070034 emsserial=N/A os="Microsoft Windows 11 , 64-bit (build 22000)" user=bueno msg="SSLVPN service started successfully" vpnstate= 12/28/2021 4:03:04 PM info system date=2021-12-28 time=16:03:03 logver=1 id=96823 type=systemevent subtype=system eventtype=status level=info uid=19AEBE88942A48F59578C42AA76

I'm currently working with FortiAuthenticator and I would like to know if it's possible to customize the login page, specifically to:Add our company logoPossibly change or style some elements of the page for branding purposes If this kind of customization is supported, could someone please guide me on how to achieve it or point me to the relevant documentation?Thank you in advance for your support!Best regards,

Hi there, On entry-level FortiGate models, the SSL-VPN web portal breaks after the update to FortiOS 7.4.8. Update 2diagnose debug console timestamp enablediagnose debug application sslvpn -1diagnose debug application fnbamd -1diagnose debug enable 2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-05 11:17:43 [17810:root:4]fsv_check_path_passed:997 No access: check path failed /migadmin/sslvpn/css/ssl_style.css, /data/migadmin/sslvpn/css, /migadmin/sslvpn/css 2025-06-05 11:17:43 [17810:root:4]sslvpn_zip_handler:136 sslvpn check path failed. Update 3The issue has been identified as BUG ID 1164811: https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/236526/known-issues

When we build VPN site to site we defince local and remote subnet, and also there are option to add route.When we enable the add route option why we still need make static route?If no static route I'm not able access to the remote subnet.

Hi, I'd like to know what directional antennas are supported by FAP-432G-N. 

 Hello, In our FortiSIEM environment, we are receiving the following health warning:---> Event Pipeline: Warning (Collector Buffer between 20MB and 50MB) After checking the logs, I observed that the collector is trying to upload events to a worker, and the destination IP is the collector’s own IP address. However, we are not using any workers in this deployment – only a Supervisor and a Collector. Because of this, the collector keeps sending HTTP requests to itself, receives a failed response, and then writes the events into:" /opt/phoenix/cache/parser/events/ "  This continuously increases the collector buffer size. As a temporary workaround, I manually delete the .dat files in that directory, which clears the warning, but the issue reappears after a short while because the collector continues to target its own IP. What would be the correct permanent solution for this issue? Best Regards,İsmail Ürek

Hello everyone, We’re looking for guidance on an issue with FortiGate IKEv2 + SAML (Microsoft Entra ID). Below are the key details and symptoms. EnvironmentAppliance: FortiGate 201GFortiOS: v7.6.4 build3596 (Feature) SymptomsFortiClient opens the Microsoft Entra sign-in page and we receive the MFA push.After approving MFA, the client returns “Firewall Authentication Failed.”We are not able to access the ACS URL from the web. We get this page can’t be reached. What we didWe followed the community article for Microsoft Entra ID SAML with FortiGate IPsec (IKEv2) and Fortinet’s official IPsec+SAML guide step by step, but the issue persists.  Note: Before switching, we were using RADIUS for authentication and it was working. Any advice on additional checks or known caveats with FortiOS 7.6.4 for IKEv2 + SAML would be appreciated. Thank you!

Hello Fortimanager admins,  I’ve encountered an unusual issue and would like your feedback. After connecting my FortiManager (v7.4.7) to a preconfigured FortiGate (v7.4.8), the firewall’s configuration was lost. The networking configuration (such as interfaces) remained intact, but all other settings disappeared.The only action I performed was importing the firewall’s configuration into FortiManager as usual.Has anyone experienced this behavior or knows why it might happen? Thanks in advance,

Hi teamsI am using a FortiGate firewall with stateful inspection enabled, and we'd like to understand the packet processing logic for return traffic.Could you please share any information you have on this?Specifically, I am looking for an explanation of return traffic similar to the one provided in the following URL: https://docs.fortinet.com/document/fortigate/6.0.0/parallel-path-processing-life-of-a-packet/478386/packet-flow-ingress-and-egress-fortigates-without-network-processor-offloadingI am currently considering whether to address return traffic by adding a policy route or by adding a less-preferred static route. Our main question is whether the routing table is consulted at all for stateful return traffic.Thank you Kenji

Hi, yesterday a Firewall Policy was accidentally deleted on Fortinet (v7.0.11). In Log Events I only see "Delete firewall.policy 37". How and where can I see what the policy did so that I can recreate it?Thanks.

Hello,I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.Requirement:Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.Issue I’m facing:The problem comes down to policy order.If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.So effectively, the firewall only applies the firs

I can only access a specific website when I disable the web filter. The Fortigate 40F firewall doesn't display any message informing the blocked category. The website isn't placed in any category. When I disable the web filter, I access it normally. I've already placed the website in the Static URL filter, including Exempt, Block, Allow, and Monitor... but nothing happens. It doesn't block or allow. I've also disabled the Fortiguard Category Basel filter, and nothing happens.   

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?   Thanks

I am setting up Zabbix. Could anyone recommend a template for the F60 box?

Hi,I have multiple virtual servers configured, their `Virtual server IP` is in a dedicated class A subnet just for this. The VS are then reachable through the SSL-VPN.I now need to make some of those VS reachable from the internet. I'd like if possible to keep the private IP address for the virtual server, and to just dNAT the public IP address to the VS ip address. (so I can keep a public enpoint and a private endpoint, with dns records for each of them)Although, my tests didn't suceed.At the moment I have the not-working following configuration:config firewall vip edit "vip" set uuid aaa set extip 192.0.2.4 set mappedip "10.0.0.1" set extintf "port1" set portforward enable set extport 443 set mappedport 443 next end config firewall vip edit "vs" set uuid bbb set type server-load-balance set server-type tcp set extip 10.0.0.1 set extintf "any" set monitor "hc-zzz" "

Hello everyone,I had a FortiClient EMS implementation for a client which required configuration of regular firewall rules with ZTNA Tags , no use of ZTNA Servers, plain old classic rules with just an extra layer of security/compliance.The implementation worked as expected but the raised question was, what happens when the client doesnt have the security posture tag anymore while sessions are active/accepted ? Well, at first the situation was quite obvious, as long a session was active/didnt expire, although the tag was no longer presented based on which the access was granted it would still work, after it would expire or was manually cleared, the next initiated connection would fail until the computer/client had the correct tag. This situation made do a little research and led me to this article which should solve it : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-remove-allowed-existing-sessions-after-ZTNA/ta-p/362819  I tried to replicate i

Hello team, I'm facing a strange issue with a FortiVM we have deployed on our company.Every 2 or 3 hours, we are losing Internet connectivity. Tried to ping from Forti CLI to 1.1.1.1 / 8.8.8.8, I'm getting no reply, tried to ping google.com or any other web page and I'm able to resolve those URLs to their relevant Public IPs (but no reply), so there is no DNS issue.We've tried to transfer this VM to a different ESXi, but the issue wasn't resolved.Yesterday, we re-deployed the FortiVM (fresh install, not a snapshot from the old VM) with TAC support, upgraded to 7.2.12, but today, in my surprise, we had the exact same issue. We are using this firewall for SSL-VPN Connections, no web filtering or any other "extreme" security features are enabled.The firewall has two Virtual Interfaces (one internal, one external) which are connected to the ESXi through a trunk interface. Anyone had this issue before?Thanks in advance. 

Dear FTNT community, Is there any way of configuring multiple (different) isolation ports in FortiNAC-F 7.2.X ? In our case we want one portal for wired connections and another different one for wireless connections. Thank you in advance.

Hello everyone,I have a question regarding FortiAnalyzer Cloud licensing. I have the following setup: one FortiGate 70G at the main site and two additional FortiGate 50Gs at two branch offices. We want to use FortiAnalyzer Cloud. If I understand the FortiAnalyzer datasheet correctly, with the "5GB/Day Subscription" license you need a collector, which is a small on-premises appliance or VM running in collector mode. That means that, in addition to the subscription, I would also need a full license and hardware for the appliance or VM. Did I understand that correctly? If that’s the case, I think with this scope the more cost-effective alternative would be to go with the "per Device Subscription." I would appreciate your feedback. Best regards,Karsten

Someone can correct me if my understanding below is correct or not regarding sdwan best quality and lowest cost (SLA). Best quality When use best quality the parameter used is only to select one from available belowLowest Cost (SLA)With this criteria then the parameter used is SLA target from each performance SLA?

I have 3 sites and 6 FAC vms  , 2 fac in HA(active-passive)  in each site is deployed.  one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Dears Appreciate your support to advise with the needed co to solve below issues:High121010TLS Version 1.1 Protocol DetectionHigh17367Fortinet FortiGate Web Console Management DetectionMedium157288TLS Version 1.1 Deprecated ProtocolMedium187315SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)Medium51192SSL Certificate Cannot Be TrustedMedium57582SSL Self-Signed CertificateLow153953SSH Weak Key Exchange Algorithms EnabledLow10114ICMP Timestamp Request Remote Date Disclosure 

Hello Team,i have configured VXLAN over VPN  with MP-BGP EVPNVLANs that are part of VXLAN have VRRP enabled .VXLAN  and VRRP are working as expectedThe problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.The strange thing is that when i runed POC on FG 7.4.7 it was working. attached the config:    

Hello,i'm stuck in creating an Ipsec dialup vpn ikev2 with cisco DUO.During the Phase1 negotiation i see errors on the EAP failing negotiation, following the screenshot directly from the firewall gui and the log taken from cli.I double checked all the settings, configured even the following for EAP:    set eap enable    set eap-identity send-request    set acct-verify enable But i'm still facing "FNBAM_DENIED" followed by the "connection expiring due to EAP failure", what am i missing and should do?My radius is DUO_MFA with ip 192.168.20.125105.94.83.72 is the remote ip and 25.36.47.58 is my public ipjohn.week is my userFw version is 7.4.7Forticlient version is 7.4.3 and 7.4.0.1658     VPNFWISDB (Vpn) # ike V=internet:accepts ike tcp-transport(vd=1, vrf=0, intf=0:55, 88.51.233.52:4500->157.245.243.118:36001 sock=0 refcnt=2 ph1=(nil)) (53).ike V=internet:Wrong IKETCP prefix(OPTION)ike V=Vpn:5: comes 25.36.47.58:500