Solved

Hi, Just want to know if FortiManager can access FortiSwitch CLI or edit the port of the FSW? If not, is it included on the future improvements/NFR of Fortinet? Thanks.

Hi, seeking for your insight regarding on VTP testing between 2 Cisco Switch connected to 2 FortiSwitches. I already enable flood-vtp on both fortiswitches and cisco switches configured as server and client mode.  After a change in the server cisco switch, FortiSwitch hang up and cisco switch port hang up also. Possibly due to VTP traffic flooded to the port. 

HiI have a new Public Certificate and need to upload it to FortiManager VM 7.4.5I select the certificate and private key, enter the certificate name, enter a password and click OK.  Then the certificate page refresh but the new certificate it's not there.  No error message appear. I was able to upload the same certificate files to FortiAnalyzer, so the certificate is good.

Good morning, everyone! I have a FortiGate model 100F, version 7.4.7. I configured an IPsec VPN on it for employees to connect via FortiClient. I created the FSSO connector, which brought the groups, and I created the LDAP connection (tested and validated). What happens is: in the VPN policy I created, when I add the group from AD, when I try to connect, it displays an error and won't connect. Looking at the logs, I saw an error called FNBAM_ERROR. What could this error be? Thank you.

Hello, We have been testing IPsec dialup connections using autoconnect and Entra ID credentials and so far it has worked pretty well. One area of concern is how to exclude situations where we may not want the auto connect to kick off (IE, local admin login or a user login that is not a member of the VPN group). We are using EMS to configure FortiClient on Windows devices. We have the VPN tunnel configured for auto connect only when off-fabric which covers a majority of these one off situations but is there a better way to exclude users/situations from the auto connection? Maybe something like "stop auto connection after 3 failed attempts"? We have always up max tries set to 3 but this seems to only cover reconnect attempts. Another thought was creating an additional remote user group on the firewall as a "catch all" group for users who are not members of the defined VPN groups and allow them to establish a vpn connection but  go out the WAN only. Local accounts off-

After updating the firmware of the Fortigate 60F from 7.2.2 to 7.2.4, I encountered that SNMP responses stopped coming from the interface configured on the non-managed VDOM.The configuration is as follows: SNMP server → Managed VDOM → Non-managed VDOM (SNMP target interface).The administrator's trusted host is also registered with a /32.The firewall policies between the VDOMs are verified to be correct. No changes were made during the update.Additionally, I have configured the set vdoms as described in the URL below, but nothing has changed.https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Configure-SNMP-in-multi-vdom-to-send-trap-to/ta-p/398884 When checking the communication logs in the managed VDOM, allowed communication from the SNMP server IP to the SNMP target interface is visible. However, in both send and receive directions, the received byte count is 0B.Using a sniffer in the managed VDOM, no response packets are observed.Similarly, a sniffer on the non-mana

Just need a little validation check against something I am implementing yet feel like I am losing something as well. What I mean by that is, I have in my environment, an edge firewall (this is where my users get their primary Internet from), a core firewall (that is acting also as my core router for my private WAN and firewall for my datacenter servers), and my site firewalls. Most of my security inspection is happening at the site firewalls. Since those traffic flows have now been inspected at the site level, I had no inspection for that traffic at the core if it went to the edge, again with no more inspection at the edge (only inspection was for some segmented VLANs off the core to my datacenter servers, etc...). Now that I want to implement QoS/traffic shaping on some traffic (Apple and Microsoft blowing up my bandwidth), my assumption is that I am going to have to implement traffic shaping also end to end... so edge, core, and site. Am I thinking correct on this? I feel like t

 Hello everyone,We’re currently trying to improve our visibility into offline devices in FortiSIEM, specifically in cases where agents or devices silently stop sending logs.So far, we’ve tested a few approaches for alerting:Rules using Followed By / Not Followed By to detect when events stop coming in.A rule that triggers if fewer than 50 logs are received in 24 hours (since our agents usually send ~2 status logs per hour).Unfortunately, these attempts haven’t worked as expected. We’re also not sure what the default “No Log Rule” actually triggers on, as it seems to be an internal event and generates too many false positives.Has anyone else run into the need for better alerting/reporting on devices that stop sending logs (due to agent failures, collector silent failures, etc.)? If so, how did you solve it?For reference, here’s one of the report definitions we’ve built in an attempt to make this more visible on dashboards:  WITH last_seen_per_ip AS (SELECTreptDevIpAddr,MA

Hey all, I recently setup an IPSec VPN to replkace our SSL VPN using Entra and SAML. I had an issue with setting an authusrgrp in the phase1-interface and getting it to work with the user groups that are SAML based. Unset authusrgrp in Phase-1 fixed the issue, and the FW groups starting mathcing on the traffic, but since I moved away from PSK and onto Certificates for IPSec VPN the same behaviour came back, but the authusrgrp knob is gone now due to the certificates. Can I use SAML based FW groups to segregate traffic while using certs? More specifics;We have departmental groups setup in the Entra application, and we need to make sure their access is restricted as such. I'd prefer to only have a single Phase-1 interface that's a 'catch all' for all SAML users (single IP range for all) and let the FW determine who can access what by the SAML groups, if possible.Any thoughts on what might be causing the FW groups to not match on traffic? 

Hi all,   We have 2 X 100D Hardware Appliances running firmware version 6.0.4 (build 0231 GA) in NAT (Flow-based) Mode (HA: Active-Passive).They primarily protect our wireless network which is open to use by staff and visiting members of the public. In general we do not do full SSL inspection.However, I have been testing 'Full SSL Inspection' on a few devices. I have downloaded the Fortinet_CA_SSL certificate from the firewall appliance and installed it on my test platforms (Windows & Android).On the whole, most things appear to work fine except Google Play Store on the Android device, it just won't connect to Google Play at all. If I revert to default SSL Certificate Inspection everything works fine.My Web Filter Policy blockes sites categorised as Advertising and Web Analytics. My Application Control Policy also blocks Google.Ads and Google.Analytics. It should be noted that when I allow these applications Google Play still doesn't work with Full SSL Inspection enabled.My We

We're currently in the process of migrating our FortiManager and FortiAnalyzer VMs from one host to another. We've thoroughly verified the configuration migration from the old instances, but we have some uncertainties regarding the licensing aspect of this transition.Specifically, we’re concerned about the implications of reactivating our existing licenses on the new VMs. Does Fortinet provide a grace period that allows us to run both the old and new VMs simultaneously during the transition? We want to ensure that we can safely shut down the old VMs without encountering any licensing issues.Any insights or suggestions on this process would be greatly appreciated. Thank you!

Hello, I am encountering an issue with my configuration that I am unable to resolve. I have two sites connected with VXLAN over IPSEC. On each of my sites, I have two VLANs (VLAN 10 and VLAN 20).  Here are my tests: SITE A / VLAN 10 successfully pings SITE B / VLAN 10SITE A / VLAN 20 successfully pings SITE B / VLAN 20SITE A / VLAN 10 successfully pings SITE A / VLAN 20SITE A / VLAN 20 successfully pings SITE A / VLAN 10SITE B / VLAN 10 successfully pings SITE A / VLAN 10SITE B / VLAN 20 successfully pings SITE A / VLAN 20SITE B / VLAN 10 successfully pings SITE B / VLAN 20SITE B / VLAN 20 successfully pings SITE B / VLAN 10However, SITE A / VLAN 10 cannot ping SITE B / VLAN 20SITE A / VLAN 20 cannot ping SITE B / VLAN 10SITE B / VLAN 10 cannot ping SITE A / VLAN 20SITE B / VLAN 20 cannot ping SITE A / VLAN 10Do you have any idea why? Thanks for your help!

Hi,  I am deploying 2 FortiSwitch 3032E as core/Tier1 and Multiple FortiSwitch 2048F as distribution/Tier2. 3032E are now manage by FortiGate 3701F, when I am adding the 2048F I connect the port using 100G transceiver to 3032E. There was no LED light indicating that is not physically connected correct? And on the FortiGate side, I cannot see the serial of the FortiSwitch. What do I need to do next. thanks.

I may have to edit the Subject once I have a better idea of what is going on. We successfully configured our IPSec Dial-up tunnel last week and we were able to successfully login and get assigned IP addresses. Now today I tried to login and I put in my Entra credentials, and it says it successfully logged me in but nothing happens. I just see the VPN Name and the Disconnect button. No metrics or my assigned IP address like before. I verified that I did not get assigned an IP address and the tunnel is not showing up. My coworker proceeds to sign-in and it works just fine.I ran the debugger and compared my connection to his and I found only one difference between our logins. After we get the response back from Entra his logs show the following:    __saml_auth_cache_push-New auth cache entry is created, user='{randomNumbersSet01}', saml_user='{username}', expires=1756916400, SAML_server='{SamlServerName}' Now mine is a little different:    __saml_au

Hi, I have 2 Q regarding to Fortigate A/P. Now I have my 901 FG with a dedicated port for HA. I will make this port for Heartbeat. And I do have 2 fiber links as well for HA with normal ports. Is the best practice to keep the HA default port for heartbeat sync, and use the 2 extra fiber ports for session sync only? Or there is no way to segregate between heartbeat and session synchronization, so I have to keep all of them in the heartbeat option? The second question is, I have enabled the HA with no license on my firewalls when I want to add the license for my firewalls. Is the correct way to remove HA back to standalone mode and then enable the license on each box and return to A/P mode? thanks 

hi,i'm trying to document our FG. how do i view/check the configured pre-shared key string?can this be viewed in the GUI or via CLI only? where in the GUI or what command to use?

Hello, I am trying to find a way to make an auto stitch to trigger and work when a user disconects or connects on a remote ipsec tunnel and send an email. I have it set up but cant see emails comming. Any ideas?  FGT60F # config system automation-stitchFGT60F(automation-stitch) # edit "VPNIPSEC"FGT60F (VPNIPSEC) # showconfig system automation-stitchedit "VPNIPSEC"set trigger "IPSEC VPN UP"config actionsedit 1set action "Email Notification"set required enablenextendnextendFGT60F (VPNIPSEC) #  config system automation-triggerFGT60F (automation-trigger) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-triggeredit "VPNIPSEC"nextend config system automation-actionFGT60F (automation-action) # edit "VPNIPSEC"new entry 'VPNIPSEC' addedFGT60F (VPNIPSEC) # showconfig system automation-actionedit "VPNIPSEC"nextend

Hello. I'd like to add a new entry for the authentication/portal mapping section (VPN->SSL-VPN Settings). Do I need to get the current ssl settings before adding a new entry? Or can I just send a PUT request where the authentication/portal mapping section has only one item for the entry I want to add?Thanks

In https://docs.fortinet.com/document/forticlient/7.2.1/macos-release-notes/223986/special-notices it is mentioned that Ikev2 is not supported on forticlient but in https://docs.fortinet.com/document/forticlient/7.2.0/new-features/374894/support-for-ikev2-for-forticlient-macos-7-2-3 it does mention support, (and it doesn't mention that it is not available anymore)But when I use Forticlient version 7.2.4 or 7.4.0 it still has the Ikev2 option greyed out for IPSec VPN.Does anyone know if it is still not avaiable or If there is something that I need to change?

hello togetherI have the following problemover IPSEC VPN the file transfer to a share is very slow.We are talking about 1mbits to about 25mbits.The file size is between 500mb and 5000mb.The local breakout are no problems only via IPSEC I have the problemFrom the outside locations (100F each) it goes to the HQ (FortiVM02).Each remote site is connected with 1000 mbit synchronously.All Forti have 7.2.3 in use.IPSECAre connected withIKEv2AES 256 and SHA 521 in both phases and DH 21 also in both phases. 

Hello! Can you explain why a deny happend on this log? The address is release in the rule, but it was blocked anyway, just a single time. date=2025-08-28 time=10:08:20 id=7543622580939259925 itime=2025-08-28 10:08:21 euid=3 epid=6003 dsteuid=3 dstepid=101 logflag=3 logver=704082795 sfsid=0 type=traffic subtype=forward level=notice action=deny policyid=52 sessionid=147382898 srcip=172.30.171.217 dstip=138.59.163.69 srcport=42401 dstport=443 trandisp=noop duration=44 proto=6 sentbyte=180 rcvdbyte=0 sentpkt=3 rcvdpkt=0 logid=0000000013 service=HTTPS app=HTTPS appcat=unscanned srcintfrole=lan dstintfrole=wan srcserver=0 policytype=policy eventtime=1756386501043559039 crscore=30 craction=131072 crlevel=high srcuuid=498de162-e8a6-51ef-6775-922ed917fc34 dstuuid=5d5a000e-f37d-51ef-1ff6-866a1aaf3cde poluuid=f050e110-e89d-51ef-5c4c-a43178bb4c78 srcmac=56:84:20:f4:60:02 mastersrcmac=56:84:20:f4:60:02 srccountry=Reserved dstcountry=Brazil srcintf=lan dstintf=wan2 policyname=Boleto_digita

I'm new to fortinet hardware and am currently having fun and games with a fortigate 401F running v7.4.8We have two internet connections, a static connection with a /29 subnet of public IP's and a broadband connection. Most traffic is routed out of the broadband and we plan to pin only a few systems to the static connection.For our static WAN,.89 is the gateway.90 is the firewall.91-.94 we will use for servicesThe .90 is set as the address on the WAN and the 91-94 are added as secondary addresses.I'm trying to set up a DMZ with one system in it at the moment. The DMZ network is running on a separate switch plugged directly into the firewall with the gateway on the firewall.I've set policy routes for the internal traffic followed by a policy route for the external traffic plus an outbound rule using an ip pool with the address I want the server pinned on (.93)If I run a "what's my IP" from the server it reports the .93 address and if I run curl commands or an apt update, it can pull info

I have a zone on the FortiGate named "VPN Zone", which includes both SSL-VPN and IPsec.We are now testing a ZTNA appliance that is connected via the X1 interface -> VLAN 101.I added the VLAN 101 interface to the existing "VPN Zone" and included its subnet in the existing rules.As a result, LAN clients can communicate with devices inside VLAN 101. However, devices inside VLAN 101 are being blocked by the FortiGate from accessing LAN.FortiAnalyzer reports that the traffic is blocked by policy ID 0, showing the source interface as "VLAN 101". This makes sense, since there are no explicit policies referencing that interface, only the zone.and idea why the existing permit rules for the zone do not trigger for VLAN 101 outgoing? but incomming is fine?FG200F v7.4.8

Hello,I have two VLANs connected via FortiGate 40F:VLAN 40: phones, PBX, and PCsVLAN 10: serversThe network is working fine in general. However, after replacing two old phones with new Grand stream models GRP2602P, I started facing the following issue:Scenario 1: When I call an old phone from a new phone, only I can hear the audio, but the other side cannot hear me.Scenario 2: When the old phone calls the new phone, both sides can hear each other without any problem.Scenario 3: When I call between the two new phones, everything works fine (two-way audio).Scenario 3: when I Make call for outside calls everything fineSo the issue only happens when calling from a new phone to an old phone.Could you please advise what might be causing this problem and how to solve it?some people say this problem from FortiGateThank you.

Hi, I'm experimenting a new weird issue with an IPSEC dialup VPN created on a FortiGate 100F with FortiOS 7.6.4. The thing is that I can reach a connection with the FortiClient v7.4.3.1790, and my connection is able to send Bytes but it's not receiving any Bytes. I've been trying several configuration using the IKEv1 and IKEv2, and unfortunately, using IKEv2 is not connecting and using IKEv1 I was able to have a connection but only is sending Bytes and not receiving. Any idea or solution will be are welcome... One more thing, I already reviewed the article ID 352403 posted by Stephen_G, about a similar situation but, my configuration of the FortiClient is the same to the configuration suggested in that article, and it's not working... Please see the snapshots below... Thank you in advance for all your help...