Solved

Hi Fortigate has failed and the operating system must be reinstalled.Fortigate model is 401F. The log on the disk disappears due to OS reinstallation, but the customer wants the log to remain on the Fortigate disk. I'm using FAZ, can I transfer the log in FAZ to the disk in fortigate? Thank you.

Hi, I do have HA Active Passive FortiGate - Active and Running. Recently, I added a new FortiManager. Kindly guide how I can add FortiGate as an HA to FortiManager. There is an option on FortiManager to add an HA Cluster. But that means that this is for a new deployment, and now I'm in production. I followed the normal way to add a node from FortiManager - Add Primary IP - Then I noted that the Secondary became out of sync. Kindly guide me to the correct way.

Dear all, we would like to use VDOM partitioning. In every example I found the FortiGates are ind of connected fully meshed, every vdom uses its own physical interface.  I actually want to do something different: 2 FortiGates (FGCP), both with:- WAN link uses 2 10GbE Interfaces with LACP- LAN link uses 2 10GbE Interfaces with LACP root VDOM on vcluster 1 (FortiGate FGCP A1.1)vdom1 VDOM on vlcuster 2 (FortiGate FGCP A1.2) Do I need separate physical interfaces for each VDOM or may I share all physical links between vdoms, i.e. using different VLANs on top of the physical links (i.e. WAN and LAN interfaces)?   

I have a new deployment, using:Fortigate 120G Controller v7.4.9 build2829andFP231F-v7.6.0-build0894 After a lot testing, I got that the FortiAP GUI is "click sensitive", as the click order of the checkboxes, affects the dtls encryption policies, so I stick with the cfg -a AP_DATA_CHAN_SEC=ipsec-sn,ipsec,dtls,clear in APBut in the controller...Im typing : set dtls-policy ipsec-sn-vpn ipsec-vpn dtls-enabled clear-textAnd still, showing clear-text first (in fact, the exact reverse oder I want)config wireless-controller wtp-profile    edit "MyCustomProfile"        set dtls-policy clear-text dtls-enabled ipsec-vpn ipsec-sn-vpn    end Ok, this could be only a "quirck", being ignored by the internal logic of using the most secure option first, regardless of the order shown in the CLIBut... the sad story .. the channel is CLEAR-TEXT!!!!!!!!!Why is that?What I want?1) Use all options available on AP2) use

Haii  I have license trial FortiSIEM from principle fo 2 months If I install FortiSIEM with license trial and license trial expired, can I extend with license production? Or cant and I must scarp FortiSIEM with license trial and fresh install with license production?

Hi there,we are working with multiple IPv4 subnets in the area 10.98.0.0/19 but we're configuring them on multiple interfaces as multiple networks with subnet lenght 26.I'd like to add a filter to the prefix list - In Bird2 you can work with greater than equal or less than equal like 10.98.0.0/16{26,26}I tried the same on forti manager, I've added a an entry to the prefix list and entered 26 as prefix length in both greater than and less than. But it throws an error:I don't understand quite right, as it keeps telling me "Greather than" must be greater than prefix (met) and less than or equal than "less than" (which is met as it's equal to it)...What am I missing?

Hello There,We are trying to run a playbook to extract pdf files and upload them as a attachment.Extraction seems to work fine but we end up getting a error on the upload.Following is the error in the UI.\n CS-INTEGRATION-5: Error occurred while executing the connector action ERROR :: 400 Client Error: Bad Request for url: https://localhost/api/3/files :: {'type': 'TypeError', 'message': \"Internal Server Error. Check log 'prod.log' for more details\"} :: Url: https://localhost/api/3/files Call for URL: https://localhost:9595/integration/execute/ failed with status code 400 \n Looking at prod.log in cyops-api/prod.log we can see that there is a Issue with the restrictedMimeTypes. [2025-12-02 09:10:07] php.WARNING: Warning: Undefined array key "values" {"exception":"[object] (ErrorException(code: 0): Warning: Undefined array key \"values\" at /opt/cyops-api/src/Service/UtilityService.php:669)"} [] [2025-12-02 09:10:07] php.CRITICAL: Uncaught Error: App\Controller\FilesControll

Hello, i try to write a Report Query with a where clause for the "action" field, if action is only in the "SELECT", "GROUP BY" and "ORDER BY" statement everything works as expected, but if i add the action field to the "WHERE" clause it does not work.The following query does not work, commenting out the "AND action like 'deny'" row will make it work, can somebody explain this behavior to me??I am using "traffic" log type source. SELECT srcip, dstip, action FROM $log as l WHERE $filter AND policyid=0 AND action like 'deny' GROUP BY ( srcip, dstip, action ) ORDER BY srcip, dstip 

Dear Expertise, I would like to ask you regarding backing our Fortigate log to tape is a good way or not? we are using FAZ and our license can support only 5GB per day. Thanks

I use my FortiAnalyzer (7.4.8) as a "poor man" syslog server and am trying to see if I can incorporate logging from Cisco Umbrella. Cisco Umbrella only sends to AWS S3 storage and I have the path and keys for said bucket. I saw where FortiSIEM has said functionality, but I don't own that product... so seeing if there is a way to handle this via FortiAnalyzer in any form or fashion. This might end up being my final push point if it cannot, to go with something more dedicated as my new syslog platform.

We have our Fortigate firewalls configured for Syslog offloading to Cynet.  We are then trying to take action, to block IP addresses of users trying to brute force VPN credentials.  We are using a script provided to Cynet by Fortinet named Fortigate-Remediation V0.2.exe, and when it tries to block an IP address, it is getting back "Max retries exceeded".  Any chance anyone knows what the fix for this is?

Hi,Looking for clarity in DNAT vip in fortigate. I have vip vip_123.1.1.10 [ external ip 123.1.1.10 & mapped ip 10.1.1.100]. And below is my rule,Src 174.1.1.1Dst 123.1.1.10Port httpsNote, I haven't used vip, but used an actual ip. And I belive it will not work, but can any one explain how fortigate process this traffic. Did fortigate still do vip lookup as I used external ip in my policy?Thanks in advance

Do you have to use the Fortinet DNS servers in order for all the filtering subscription services to work properly?

EnvironmentWe have two separate FortiGate-VM HA clusters:Cluster-A (VM-A-HA): 2 nodes (active–passive)Cluster-B (VM-B-HA): 2 nodes (active–passive)Both clusters run FortiGate-VM BYOL licenses (one license per VM node).Background / What HappenedThe licenses on both nodes of Cluster-B expired.To maintain service availability, we performed a temporary workaround:Powered off both nodes of Cluster-A.Downloaded the valid license files for both nodes of Cluster-A from the FortiCare portal.Uploaded these two licenses respectively to the two nodes of Cluster-B.Cluster-B resumed normal operation with those temporarily reassigned licenses.Cluster-A has remained powered off since the license transfer.Current SituationWe have now purchased new licenses (one per node) for Cluster-B.Our intention is to:Apply the new licenses to both nodes of Cluster-BRestore the original Cluster-A licenses back to the two nodes in Cluster-ABring both clusters back into healthy HA state with proper licensing.Before do

Please advise — my penetration testing team is recommending that I enable admin-restrict-local on the FortiGate firewall. However, if I do that, local admin logins will be completely blocked whenever remote authentication servers are reachable. My concern is about integrating the FortiGate device with FortiManager (FMG), which sometimes requires local credentials. If FMG tries to connect to the device using local admin credentials over the network (via SSH or HTTPS), those logins could be denied because of this restriction. Since FortiManager (FMG) and other management tools rely on local admin credentials or API access over the network, enabling admin-restrict-local—especially in restrictive modes like non-console-only or all—could disrupt those connections. So, would it be correct to assume that enabling this setting in a production environment is not advisable?

Everything was working fine until suddenly this message appeared and now I can't connect anymore. It just stopped working. I'm using version 7.2.9.1033 on macOS Tahoe. Any help would be greatly appreciated, Doug. 

Hi, FortiGate - 7.4.9Fortimanager Cloud - v7.4.8 I am configuring a FortiGate to use SD-WAN for connectivity to FortiManager Cloud and FortiGuard (plus more services once I have a confirmed config), and am hoping to get some feedback on the best way to configure this. I have set the configured central-management to use sdwan (following this page) config system central-management set interface-select-method sdwan All seems ok, however the Fortigate doesn't want to connect using the best connection. The firewall is connected to an FTTC and a 4G router. The FTTC connection has lower latency and jitter, but the firewall always seems to want to connect to FortiManager Cloud using the 4G. Note the 4G interface is DHCP and the FTTC is using a fixed IP.The default route on the Fortigate is pointing to the sdwan-zone as the interface.Other SDWAN rules seem to work fine. Whether I just leave the SDWAN rules blank and use the default 'sd-wan' rule or use a

 Hi all, In the process of setting up FAC Cloud with radsec and a fortigate firewall - we are seeing the traffic coming to the FAC from a different IP to what is our FWs public IP address - when setting our radius client, this took me a little while to find.  Can anyone advise what should be set under the client IP for radius, or how the traffic is handled please? 

hi all !i've a question :i've 2 FGT 200F cluster on different location connectet by several link that share the my own BGP pubblic IP access in VRRP.so every cluster have different phisical IP on WAN interface and a COMON VRRP Address that i use to terminate IPSEC VPN declaring the Local Gateway ip address.In case of Failiure of the Primary location the Ipsec VPN tunnel will be closed on the same VRRP address on other location.Is it possible to use same configuration for SSLVPN?In gui i have not found the possibility to specify the IP where the sslvpn listen to,but only The INTERFACE where the services in Listen on - there are some other workarround?I'm in 7.0.12 Nat modeThanks Alberto

Hello everyone, after updating the license for fortimanager in my testing environment, I found that fortigate couldn't connect to fortimanager. Despite entering the following command, I still couldn't connect. I hope to get your help. Thank you!fortimanager version: 7.2.8Fortigate version: 7.0.15config system central-managementset type fortimanagerset serial-number " FMG-VMTM25015787"set fmg "113.31.127.109"endexecute central-mgmt register-device FMG-VMTM25015787 123The following is the firewall debug informationfortigate_test_1 # diagnose debug application fgfmd<Integer> Debug level.fortigate_test_1 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.fortigate_test_1 # diagnose debug enablefortigate_test_1 # FGFMs: set device as in_progressFGFMs: client:send:get authserialno=FGT40FTK2109BQ01mgmtid=1581151727platform=FortiGate-40Ffos_ver=700minor=0patch=15build=632branch=632maxvdom=10fg_ip=192.168.1.4hostname=fortigate_test_1harddisk=nobiover=05000021mgm

Hello, I installed FortiClient on MacOS 26.1 and after following the instruction from our IT, I am apparently connected to the VPN. Everything seems fine in the FortiClient window, showing it is "connected", but I have two problems: first in the Mac system setting, VPN & Filters, it shows VPN is "disconnected", second I lose the internet after connecting to the VPN. In the same system setting, under Filters & Proxies, I cannot add FortiClient to the list, while I can still see Cisco Secure. I checked some posts regarding  internet disconnection, but all are confusing to me and have not been helpful. I would be thankful if anyone would help to solve this issue.Thank you.    

Hi, is anyone else having a problem doing deep inspection using Google Chrome? Google Chrome version:  119.0.6045.160 (Versão oficial) 64 bits Fortigate 200F, 7.4.1.config sys globalset admin-https-ssl-versions tlsv1-2 tlsv1-3google same policy/ssl profile from prints below. same policy ID from above - EGDE    same policy ID from abobe - firefox   SSL Profile:   Do you guys have some advices?TY  

We are trying to authenticate a wireless client using EAP-TLS on a Meraki AP against a FortiAuthenticator (with RADIUS).The EAP-TLS is successful but the wireless client doesn´t receive a DHCP IP address, nor does it have network access. However, a wired EAP-TLS (computer authentication) request from the same client works flawlessly. Parts of the debug log show: (2794) facauth: ===>NAS IP:192.168.100.96 (2794) facauth: ===>Username:host/W10CLIENT.company.local (2794) facauth: ===>Timestamp:1707907999.157486, age:1ms (2794) facauth: Comparing client IP 192.168.100.96 with authclient Meraki-AP1 (192.168.100.96, 1 IPs) (2794) facauth: ------> matched! (2794) facauth: Found authclient from preloaded authclients list for 192.168.100.96: Meraki-AP1 (192.168.100.96) (2794) facauth: authclient_id:2 auth_type:'eap-tls' (2794) facauth: Found authpolicy 'EAPTLS' for client '192.168.100.96'<SNIP>(2794) facauth: Updated auth log 'host/W10CLIENT.company.local' for attempt

Hello team!! I need to know compatibility between FortiOS (Fortigate) and FortiClient, and between FortiClient and Client OS versions.For example, I need to know for an specific OS version (Windows, Linux, and Mac OS), which is the last FortiClient that supports this OS.  And also, I need to know, for this FortiClient Version, which is the last FortiOS supporting this.I found some old compatibility matrix, but this didnt help me.Which is the correct way to find out this?Do I need to read the release notes?  FortiOS or FortiClient release notes?In which section do I find the compatibility? Thanks in advance.Regards,Damián

Hello. We want to change our EMS-Server to be reachable from Public and not only from internal network. At the moment users connect to an internal FQDN-Name while on internal network or connected via VPN.  When changing the FQDN name of EMS-Server to a public reachable name, is this affecting the current connected users?  The current users are connected through an invitation code and registered via LDAP to EMS-Server. Do they need a new invitation code after changing the FQDN Name? Thank you.