Solved

Hi EMS adminsI wonder if anyone noticed if FortiClient could detect the latest critical vulnerabilities that affect driver and firmware of Dell laptops with Broadcom BCM5820X series chips, I mean all of these vulnerabilities:CVE-2025-24311, CVE-2025-25215, CVE-2025-24922, CVE-2025-25050, and CVE-2025-24919.More information here:https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053If your FortiClient has detected them (or not), then your feedback would be appreciated.

Hi,  I’m trying to use FortiAnalyzer (FAZ) to monitor IPsec tunnel down events in a large-scale SD-WAN.Event Handlers are in place and SMTP email alerts are configured, but I’m seeing:IPsec down events don’t always generate alerts.FAZ is at HQ. When the branch-to-HQ IPsec tunnel drops, FAZ doesn’t trigger the down alert. I usually get a “down + up” alert only after the tunnel comes back up, which isn’t useful.If this isn’t a valid use case for FAZ, what’s the recommended way to achieve timely alerts? Can FAZ generate a “device disconnected” or “device down” event when a FortiGate loses connectivity to FAZ? That would be more meaningful once the tunnels drop.

Hello everyone,I have a FortiWiFi device where I’ve configured 3 SSIDs as follows:veone air: DHCP pool 192.168.10.10 – 192.168.10.254, operating in tunnel modeveone tech: DHCP pool 192.168.20.10 – 192.168.20.254, operating in tunnel modeveone voip: DHCP pool 192.168.30.10 – 192.168.30.254, operating in tunnel modeI’m able to connect to these SSIDs from my computer and complete my tasks without any problems.Today, I received a PBX server that needs to be connected to the FortiWiFi on the internal4 port. The server requires a static IP address 192.168.30.3/24, which belongs to the same subnet as the veone voip SSID’s DHCP pool. This setup should allow me to ping the PBX server from devices connected to the veone voip SSID.However, even though the PBX server is physically connected to the FortiGate’s internal4 port and assigned the static IP address manually, I am unable to ping it from the SSID network.Could someone please advise on how to configure the FortiWiFi or what changes I need t

Hello!  I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering).  One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:config firewall policy edit 117 set name "DNS Filter - Testing" set uuid b4130862-7872-51f0-6074-01eb3ef19f90 set srcintf .... set dstintf "virtual-wan-link" set action accept set srcaddr "laptop wifi" set dstaddr "all" set schedule "always" set service "DNS" set utm-status enable set inspection-mode proxy set dnsfilter-profile "DNS-Filter" set logtraffic all set nat enable next endWhen I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page.  Yet, when I do these

Good evening Fortiweb admins, I have noticed an issue with the "URL Encryption" feature on FortiWeb. When I enable my URL Encryption policy, the URLs are successfully encrypted.However, this distorts the design of the protected website:The site’s appearance is no longer the same.Some elements are missing.Colors change.In some cases, only the HTML code is displayed without the CSS, Bootstrap, and other resources.Does anyone have any idea about the root cause of this problem? 

I would like to create an email notification when someone accesses my firewall, sending an email with the user name and date. Is there something like that?

Hi, We are looking to manage traffic with identity and endpoint based policies. We are also planning on getting EMS to get as much ztna in place as possible. It seems that the best option for managing identities is fsso. Is it compatible/recommanded with EMS ? Which should we go witch ? Any advice before with start going in all directions ?

I'm currently trying to configure a Captive portal with SAML authentication for a specific https traffic.My issue is how can implement this only in my firewall policy and not on my interface which will impact my other traffic. I'm running 7.2.7 version on 1500D.Do you guys have an idea about that?  

Step to reproduce:Install FortiClient  VPN 7.4.3 onto macOS SonomaUpgrade to latest macOS SequoiaAnd here we go, ,no Add Profile or Add New Connection Optionbefore on Mac OS Sonoma it work correctly, and im configure everything- create profile- add new connectionafter upgrading to macOS Sequoia i'm experience this issue, my configuration and connection is gone been trying to reinstall but still can't add or load my existing connection

Hello everyone, I'm trying to figure out how I can allow one of my Fortinet inferface to be able to ping the "IPsec VPN" IP of my remote users (connected with Forticlient). From the Fortinet itself, I'm able to ping those IPsec VPN connected workstations just fine, but I'm unable to do the same from any other interfaces (i.e. like from a server behind the Fortigate). I already created an IPv4 Policy to allow the "PING" to go through between one of my internal interface to the interface of the "IPsec" interface, but that does not seem to work...I also tried adding a static route, but that did not seem to help. Anyone faced a similar issue like this before ?Thanks for your help and best regards,--Eric 

Hello, Is there any known reason for the FortiClient taking upwards of 30 minutes to download or sometimes failing? Today, one download started, restarted after 40% then failed. This is the VPN only client downloading.    - Dan

Hello, Team!  I’d like to ask about our FortiGate 300E. Its license will expire in January next year, but I saw online that its EOL (End of Life) is in July 2026.If we don’t plan to buy a new firewall next year and instead move the purchase to 2027, should we still renew the license? Also, if we renew but the unit reaches its EOL, will we still receive FortiGuard services and updates after that? Thank you! So sorry I'm kinda new to this

I have a Fortinet 200F hardware controller setup in an High Availability Cluster.  The version is v7.2.8 build1639 (Mature). Background: - The dedicated MGMT Interface IP address is X.X.30.254. IP address.- The FortiGate LAN interface is using a X.X.99.X IP address.- My workstation is using X.X.210.X IP address. Problem Description: I can login to the FortiGate FW Web interface just fine using the assigned LAN IP Address (X.X.99.X) from my workstation (X.X.210.X) ; but, I cannot get a web page or ping the IP address assigned to the FortiGate MGMT Interface (X.X.30.354) from my workstation.  I can access and ping other devices on the same X.X.30.X network from my workstation; hence the problem is specific to the X.X.30.254 Interface.  By the way other devices on the same subnet (X.X.210.X) have the same problem with the FortiGate MGMT Interface address (X.X.30.254). I have set the following configuration on the FortiGate "MGMT physical Interf

Hi FNAC admins and It seems on FortiNAC-F 7.4 and 7.6 (didn't test on 7.2), when doing enter-shell the user admin can't do sudo.Is there a special way to do that or has it just been removed?

Had this working briefly, but somehow , something has changed in the environment, I have followed: https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/578250/fortiauthenticator-as-a-wireless-guest-portal-for-fortigate A few tweaks here and there, but essentially, the Client connects to the OPEN ssid, the interface uses system DNS to look up the address of the external portal., then should be able to access the captive portal, this part is completely broken, no traffic arrives at the FAC, meaning the client just cant resolve the FQDN (it used too!)  I checked the clients ipconfig, and it gets the right DHCP IP, gateway (Fortigate wifi interface) and correct DNS (it picks up public DNS, but there are DNS-DATABASE entries for the FAC)  there is an EXEMPT captive portal rule, from the GUEST source network, to the FAC on HTTPS, so that it can use the form to register, before browsing. there are no hits on this rule. I have tried everything now, I ju

I have my four vlans 10,20,30,40 tagged in interface internal5 then i do access my device fortigate 60f via web GUI but now i can not access the web gui again. i want solution to resolve this issue vlan10 10.10.1.1/24vlan20 10.10.2.1/24vlan30 10.10.3.1/24

Hello everyone,I am currently facing the issue, that the first login with "admin" and blank password is not working on the first login to the FortiManager via the HyperV console. I tried both current images for version 7.6.3 and 7.4.7, but same issue on booth of them. It just asks for the password and is then asking for the user again (no error for wrong credentials). Has anyone had any similar issues or knows what else I could try ? Console port loginWe wanted to try FortiManager to see if it fits for our purpose, but we can not open a support ticket for this issue, because we can not access a serial number and haven't bought a license yet.

hi, can someone pls advise whether we should block tor traffics (tor onion) on internet router as best practice for an enterprise? thanks in advance! 

Good morning, I've replaced the FortiGate 60F with a 120G. I can get everything working as it was, including the VPN with FortiClient, but the portal doesn't work. I get the following error: ForbiddenYou don't have permission to access /remote/login on this server.Additionally, a 400 Bad Request error was encountered while trying to use an ErrorDocument to handle the request. Could you please guide me on how to resolve this error?I attach screenshots of the VPN configuration, VPN portal, and a firewall policy.Best Regards!vpn settingsvpn settingsvpn settingsvpn portalvpn portalfirewall policyfirewall policy

Yesterday, out of the blue, our FortiGate 500E stopped accepting any client IPsec phase 1 proposals from our FortiClients.  I quadruple checked the settings on FortiClient, FortiClient EMS, and the FortiGate and nothing has changed.  No versions have changed either.  I verified that that proposals being sent by FortiClient and received by the FortiGate using diag debug, and multiple proposals match what is configured, but none of them are being accepted.I opened a case with FortiNet support and am awaiting a reply.  In the meantime, I'm curious if anyone else in the community has faced this and how you solved it.FortiGate: 7.4.8FortiClient: 7.2.9FortiClient EMS: 7.2.10 2025-08-06 16:29:40.813149 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: negotiation failure2025-08-06 16:29:40.813171 ike V=root:Negotiate ISAKMP SA Error:2025-08-06 16:29:40.813184 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: no SA proposal chosen VPN config on FortiGa

Hi, Which Firewall model is recommended for an average organisation for the user counts mentioned below with  NGFW capabilities? 250-500 users500-750 users750-1000 users  Thanks in advance

Hello guys, I was trying secure a guest wifi from illegal torrent streaming. i set up  web filters , application control and all work fine. But we found a <<hole>> lets say. A user used hotspot from his phone and connected to a streaming site (from the ones we have blocked) . The problem is that when he connected to our wifi the movie continued to play .  Is there a way to stop that session with the site automatically?I was thinking something like a reoccuring Session killer to particular sites. is it possible? FortiGate 

I need to upgrade a group of not licenced fortigates, I tried to run a script that execute a restore image tftp but after downloading and validate the image from the tftp server the script stops with errors and doesnt do anything. I would like to know if this upgrade process is posible and if there are alternatives to do this upgrade on not licenced fortigates. Maybe a script on an external server that execute a ssh on every fortigate. Thanks!

hi,i'm migrating a cisco asa ACL to a FGT.just to confirm, i'll always need to create 2x FW policy: inbound and outbound rule for each single ACL?an example would be below: !! ASA:access-list DMZ-IN extended permit tcp object SERVER-SUBNET 10.200.0.0 255.255.0.0access-group DMZ-IN in interface dmz !! FGT:edit DMZ-IN 1set srcintf "any"set dstintf "port 1" !! DMZ interfaceset srcaddr "SERVER-SUBNET" set dstaddr "10.200.0.0_16-SUBNET"set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext edit DMZ-IN 2 !! JUST CLONE REVERSE FW POLICY 1set srcintf "port 1"set dstintf "any"set srcaddr "10.200.0.0_16-SUBNET"set dstaddr "SERVER-SUBNET" set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext

I am trying to reboot a downstream device in the fabric, but the automation stitch is not triggering. The trigger is a weekly schedule at hour 3 (3am - see image below). For action, I've tried using the system action (included with v7.2 onward) as well as a CLI Script for the reboot. Interesting points to note:  If I use the system action and click on the Test Automation Stitch, it reboots the downstream device.If I use the CLI Script and click on the Test Automation Stitch, it reboots the root and downstream device.Waiting for the trigger to reboot in either instance never occurs. Any help is appreciated. All devices are running 7.6.3Root device is a 600EDownstream device is a 40F I have followed the below, but this does not mention if it can be used for a downstream device in a fabric. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Automation-Stitch-to-schedule-restart-reboot/ta-p/19185