Solved

Hello,I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.Requirement:Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.Issue I’m facing:The problem comes down to policy order.If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.So effectively, the firewall only applies the firs

I can only access a specific website when I disable the web filter. The Fortigate 40F firewall doesn't display any message informing the blocked category. The website isn't placed in any category. When I disable the web filter, I access it normally. I've already placed the website in the Static URL filter, including Exempt, Block, Allow, and Monitor... but nothing happens. It doesn't block or allow. I've also disabled the Fortiguard Category Basel filter, and nothing happens.   

We used to have FortiClient version 6.2.6 and it works well on SSL VPN connection to our corporate network (gateway FortiOS version 6.4.3).  Once we upgraded to FortiClient 6.4.3, we start getting intermittent connectivity issue in that user cannot access network resources due to DNS resolution failure.  It's found to be caused by client's network interface attempts to query DNS through IPv6 and failed.  It then stop there without attempting querying IPv4 DNS.  We are stuck with no solution from Fortigate and desperately need to resolve it.  Does anyone encounter similar issue and can share some ideas?   Thanks

I am setting up Zabbix. Could anyone recommend a template for the F60 box?

Hi,I have multiple virtual servers configured, their `Virtual server IP` is in a dedicated class A subnet just for this. The VS are then reachable through the SSL-VPN.I now need to make some of those VS reachable from the internet. I'd like if possible to keep the private IP address for the virtual server, and to just dNAT the public IP address to the VS ip address. (so I can keep a public enpoint and a private endpoint, with dns records for each of them)Although, my tests didn't suceed.At the moment I have the not-working following configuration:config firewall vip edit "vip" set uuid aaa set extip 192.0.2.4 set mappedip "10.0.0.1" set extintf "port1" set portforward enable set extport 443 set mappedport 443 next end config firewall vip edit "vs" set uuid bbb set type server-load-balance set server-type tcp set extip 10.0.0.1 set extintf "any" set monitor "hc-zzz" "

Hello everyone,I had a FortiClient EMS implementation for a client which required configuration of regular firewall rules with ZTNA Tags , no use of ZTNA Servers, plain old classic rules with just an extra layer of security/compliance.The implementation worked as expected but the raised question was, what happens when the client doesnt have the security posture tag anymore while sessions are active/accepted ? Well, at first the situation was quite obvious, as long a session was active/didnt expire, although the tag was no longer presented based on which the access was granted it would still work, after it would expire or was manually cleared, the next initiated connection would fail until the computer/client had the correct tag. This situation made do a little research and led me to this article which should solve it : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-remove-allowed-existing-sessions-after-ZTNA/ta-p/362819  I tried to replicate i

Hello team, I'm facing a strange issue with a FortiVM we have deployed on our company.Every 2 or 3 hours, we are losing Internet connectivity. Tried to ping from Forti CLI to 1.1.1.1 / 8.8.8.8, I'm getting no reply, tried to ping google.com or any other web page and I'm able to resolve those URLs to their relevant Public IPs (but no reply), so there is no DNS issue.We've tried to transfer this VM to a different ESXi, but the issue wasn't resolved.Yesterday, we re-deployed the FortiVM (fresh install, not a snapshot from the old VM) with TAC support, upgraded to 7.2.12, but today, in my surprise, we had the exact same issue. We are using this firewall for SSL-VPN Connections, no web filtering or any other "extreme" security features are enabled.The firewall has two Virtual Interfaces (one internal, one external) which are connected to the ESXi through a trunk interface. Anyone had this issue before?Thanks in advance. 

Dear FTNT community, Is there any way of configuring multiple (different) isolation ports in FortiNAC-F 7.2.X ? In our case we want one portal for wired connections and another different one for wireless connections. Thank you in advance.

Hello everyone,I have a question regarding FortiAnalyzer Cloud licensing. I have the following setup: one FortiGate 70G at the main site and two additional FortiGate 50Gs at two branch offices. We want to use FortiAnalyzer Cloud. If I understand the FortiAnalyzer datasheet correctly, with the "5GB/Day Subscription" license you need a collector, which is a small on-premises appliance or VM running in collector mode. That means that, in addition to the subscription, I would also need a full license and hardware for the appliance or VM. Did I understand that correctly? If that’s the case, I think with this scope the more cost-effective alternative would be to go with the "per Device Subscription." I would appreciate your feedback. Best regards,Karsten

Someone can correct me if my understanding below is correct or not regarding sdwan best quality and lowest cost (SLA). Best quality When use best quality the parameter used is only to select one from available belowLowest Cost (SLA)With this criteria then the parameter used is SLA target from each performance SLA?

I have 3 sites and 6 FAC vms  , 2 fac in HA(active-passive)  in each site is deployed.  one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Dears Appreciate your support to advise with the needed co to solve below issues:High121010TLS Version 1.1 Protocol DetectionHigh17367Fortinet FortiGate Web Console Management DetectionMedium157288TLS Version 1.1 Deprecated ProtocolMedium187315SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)Medium51192SSL Certificate Cannot Be TrustedMedium57582SSL Self-Signed CertificateLow153953SSH Weak Key Exchange Algorithms EnabledLow10114ICMP Timestamp Request Remote Date Disclosure 

Hello Team,i have configured VXLAN over VPN  with MP-BGP EVPNVLANs that are part of VXLAN have VRRP enabled .VXLAN  and VRRP are working as expectedThe problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.The strange thing is that when i runed POC on FG 7.4.7 it was working. attached the config:    

Hello,i'm stuck in creating an Ipsec dialup vpn ikev2 with cisco DUO.During the Phase1 negotiation i see errors on the EAP failing negotiation, following the screenshot directly from the firewall gui and the log taken from cli.I double checked all the settings, configured even the following for EAP:    set eap enable    set eap-identity send-request    set acct-verify enable But i'm still facing "FNBAM_DENIED" followed by the "connection expiring due to EAP failure", what am i missing and should do?My radius is DUO_MFA with ip 192.168.20.125105.94.83.72 is the remote ip and 25.36.47.58 is my public ipjohn.week is my userFw version is 7.4.7Forticlient version is 7.4.3 and 7.4.0.1658     VPNFWISDB (Vpn) # ike V=internet:accepts ike tcp-transport(vd=1, vrf=0, intf=0:55, 88.51.233.52:4500->157.245.243.118:36001 sock=0 refcnt=2 ph1=(nil)) (53).ike V=internet:Wrong IKETCP prefix(OPTION)ike V=Vpn:5: comes 25.36.47.58:500

Hello everyone, I have a FortiGate 400F and updated it from version 7.2.11 to version 7.4.8. I'm currently trying to access Zabbix via SNMP, but I'm getting errors. When I try manually using snmpwalk on my Ubuntu server, I get No Response From... and Timeout errors. I've tried SNMP v2 and SNMP v3, removed the AUTO settings, and still the same thing.The servers I am testing are added as trusted hosts, SNMP is active on the interface side, there is no Local in policy, and even if I manually add and allow them, timeout errors continue.Another server in the same src network was already accessing via SNMP before the update, so there is no problem with the firewall policies.diagnose debug application snmpd -1diagnose debug enable commands do not produce any logs. They are currently being tested.When I examine the issue at the kernel debug level (with the commands below)diagnose debug flow filter cleardiagnose debug flow filter saddr 192.168.1.212diagnose debug flow filter daddr 192

I build site to site vpn connection from fortigate in HQ and sophos xg in branch.In the tunnel interface in fortigate listen on port8 with ip address xx.xx.xx.230The vpn connection is established, the branch and hq can communicate but if i traceroute from branch to hq i feel strange why the traffic passing thru another ip in fortigate xx.xx.xx.246 and not to xx.xx.xx.230?Here my tracert resultTracing route to 10.7.208.52 over a maximum of 30 hops1 <1 ms <1 ms <1 ms 10.108.150.12 22 ms 16 ms 20 ms xx.xx.xx.2463 29 ms 20 ms 20 ms 10.7.101.24 21 ms 23 ms 18 ms 10.7.208.52

I have implemented IPsec with SAML on a fortigate and can connect fine to it from some machines but other machines are incredibly unstable. The forticlient (vpn only 7.4.3) will connect, the application will be unresponsive for a few seconds and then will say connected however no packets will flow. What is the best version of FortiClient to use with IPsec/SAML for stability? Also is there a way to download older versions?

Hello team!! I hope you are doing well!!We have 2 Fortigates 100F in HA with many IPsec VPNs for FortiClient users.Just one user has a problem to connect from his house.  When he use another internet connection in the same computer this works fine but with his own ISP sometime does it fails (Sometimes work also)When this fails, I can see the following logs on Fortigate: date=2025-09-11 time=12:38:58 eventtime=1757605138121774900 tz="-0300" logid="0101037134" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec phase 1 SA deleted" msg="delete IPsec phase 1 SA" action="delete_phase1_sa" remip=RemoteIP locip=LocalIP remport=18052 locport=4500 outintf="port9" cookies="b77cf798b4edb960/b7f28e5eae0677b7" user="1011" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="IPsec-IT-W3" fctuid="N/A" advpnsc=0date=2025-09-11 time=12:38:38 eventtime=1757605118948074500 tz="-0300" logid="0101037127" type="event" subtype="vpn" level="notice" v

Hi Folks, I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.I hear anecdotally that others using regular Firefox are not experiencing this issue either.I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes.  Any thoughts? I'm at my wits end a bit here.I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place

Hello,I am configuring FortiNAC to work with RADIUS authentication, but I haven’t been able to find anywhere a complete list of available RADIUS attributes.Additionally, when setting up devices for EAP-TLS authentication using certificates, I noticed that NAC allows the use of “pseudo-attributes” such as TLS-Client-Cert-Common-Name or TLS-Client-Cert-Subject-Alt-Name-UPN, and so on.Is there a full list of all available attributes?When I open the dropdown menu, it only shows the first 10 attributes starting with “A.”If I type “TLS” and open the dropdown, it doesn’t show these pseudo-attributes either. Any guidance on where to find a complete list of supported RADIUS and TLS pseudo-attributes would be greatly appreciated.Thank you!

I have deployed FortiNAC in HA mode. And use its radius server to authenticate users when they are login to the network devices. When the primary unit is active user can login using their name and password only. However when secondary unit become active users should include name@domin name to access it. Can someone explain wh

Hi,I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.I'm reluctant to use this method. Is this a well-known workaround?Do you have any advice on a better way to handle this? Hardware: FortiGate 120G OS: 7.4.8Thanks,Kenji

If the Fortigate have multiple vdom, can we directly enter to the vdom global without issuing 'config global'?Currently when i ssh to the fortigate i must enter that command first before i can execute 'get system global'

I currently have two FortiGate 60F devices running in an active-passive HA pair. I am monitoring the active device in N-Central via the management IP, but I am wondering what is the recommended method to monitor the standby unit as there is not a management IP of the standby device. I was planning on monitoring fgHaSystemMode (OID: .1.3.6.1.4.1.12356.101.13.1.1) via SNMP and querying against the OID to ensure that the value of this 3 to match active-passive as I will know if the passive device is down if this value is either standalone or active-active. Currently we are only monitoring the active device so we would not be aware if the secondary goes down 

Hi,We are preparing to migrate from FortiClient EMS 7.2.10 to 7.4.4.We deployed EMS on a Hyper-V VM.Copy/Paste doesn't work in EMS CLI 7.4.4.How can I enable the clipboard functionality?