Solved

hello togetherI have the following problemover IPSEC VPN the file transfer to a share is very slow.We are talking about 1mbits to about 25mbits.The file size is between 500mb and 5000mb.The local breakout are no problems only via IPSEC I have the problemFrom the outside locations (100F each) it goes to the HQ (FortiVM02).Each remote site is connected with 1000 mbit synchronously.All Forti have 7.2.3 in use.IPSECAre connected withIKEv2AES 256 and SHA 521 in both phases and DH 21 also in both phases. 

Hello! Can you explain why a deny happend on this log? The address is release in the rule, but it was blocked anyway, just a single time. date=2025-08-28 time=10:08:20 id=7543622580939259925 itime=2025-08-28 10:08:21 euid=3 epid=6003 dsteuid=3 dstepid=101 logflag=3 logver=704082795 sfsid=0 type=traffic subtype=forward level=notice action=deny policyid=52 sessionid=147382898 srcip=172.30.171.217 dstip=138.59.163.69 srcport=42401 dstport=443 trandisp=noop duration=44 proto=6 sentbyte=180 rcvdbyte=0 sentpkt=3 rcvdpkt=0 logid=0000000013 service=HTTPS app=HTTPS appcat=unscanned srcintfrole=lan dstintfrole=wan srcserver=0 policytype=policy eventtime=1756386501043559039 crscore=30 craction=131072 crlevel=high srcuuid=498de162-e8a6-51ef-6775-922ed917fc34 dstuuid=5d5a000e-f37d-51ef-1ff6-866a1aaf3cde poluuid=f050e110-e89d-51ef-5c4c-a43178bb4c78 srcmac=56:84:20:f4:60:02 mastersrcmac=56:84:20:f4:60:02 srccountry=Reserved dstcountry=Brazil srcintf=lan dstintf=wan2 policyname=Boleto_digita

I'm new to fortinet hardware and am currently having fun and games with a fortigate 401F running v7.4.8We have two internet connections, a static connection with a /29 subnet of public IP's and a broadband connection. Most traffic is routed out of the broadband and we plan to pin only a few systems to the static connection.For our static WAN,.89 is the gateway.90 is the firewall.91-.94 we will use for servicesThe .90 is set as the address on the WAN and the 91-94 are added as secondary addresses.I'm trying to set up a DMZ with one system in it at the moment. The DMZ network is running on a separate switch plugged directly into the firewall with the gateway on the firewall.I've set policy routes for the internal traffic followed by a policy route for the external traffic plus an outbound rule using an ip pool with the address I want the server pinned on (.93)If I run a "what's my IP" from the server it reports the .93 address and if I run curl commands or an apt update, it can pull info

I have a zone on the FortiGate named "VPN Zone", which includes both SSL-VPN and IPsec.We are now testing a ZTNA appliance that is connected via the X1 interface -> VLAN 101.I added the VLAN 101 interface to the existing "VPN Zone" and included its subnet in the existing rules.As a result, LAN clients can communicate with devices inside VLAN 101. However, devices inside VLAN 101 are being blocked by the FortiGate from accessing LAN.FortiAnalyzer reports that the traffic is blocked by policy ID 0, showing the source interface as "VLAN 101". This makes sense, since there are no explicit policies referencing that interface, only the zone.and idea why the existing permit rules for the zone do not trigger for VLAN 101 outgoing? but incomming is fine?FG200F v7.4.8

Hello,I have two VLANs connected via FortiGate 40F:VLAN 40: phones, PBX, and PCsVLAN 10: serversThe network is working fine in general. However, after replacing two old phones with new Grand stream models GRP2602P, I started facing the following issue:Scenario 1: When I call an old phone from a new phone, only I can hear the audio, but the other side cannot hear me.Scenario 2: When the old phone calls the new phone, both sides can hear each other without any problem.Scenario 3: When I call between the two new phones, everything works fine (two-way audio).Scenario 3: when I Make call for outside calls everything fineSo the issue only happens when calling from a new phone to an old phone.Could you please advise what might be causing this problem and how to solve it?some people say this problem from FortiGateThank you.

Hi, I'm experimenting a new weird issue with an IPSEC dialup VPN created on a FortiGate 100F with FortiOS 7.6.4. The thing is that I can reach a connection with the FortiClient v7.4.3.1790, and my connection is able to send Bytes but it's not receiving any Bytes. I've been trying several configuration using the IKEv1 and IKEv2, and unfortunately, using IKEv2 is not connecting and using IKEv1 I was able to have a connection but only is sending Bytes and not receiving. Any idea or solution will be are welcome... One more thing, I already reviewed the article ID 352403 posted by Stephen_G, about a similar situation but, my configuration of the FortiClient is the same to the configuration suggested in that article, and it's not working... Please see the snapshots below... Thank you in advance for all your help...

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8).  I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine  certificates.  We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side? I've been spinning my wheels on this for awhile now.  Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2?  When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit. Thanks! 

hi everyone,running fortios 7.4 on fortigate 70g with sd-wan across three wans (all have fixed external IPs):isp1: cable internet (docsis, static config, no dhcp passthrough)isp2 & isp3: two separate 5g connections (fixed external IPs, but dhcp passthrough to the firewall, ip/netmask/gateway set automatically)the problem:isp2 & isp3 work perfectly — they show dynamic 0.0.0.0/0 routes and are fully used by sd-wan.isp1 needs manual ip/netmask and a static route. it shows “up” in sd-wan but carries no traffic unless both 5g connections are disabled.routing table shows isp2/isp3 dynamic routes at the top, while isp1 sits static and is ignored.isp1 says enabling dhcp passthrough on their docsis modem is too much work and would break their provisioning, so they won’t change it.questions:any supported way to make sd-wan handle static-only wan links?any cli tricks to make sd-wan treat that static route like a dhcp one?would upgrading to 7.6 help, or is this just a hard limitation?need

Hi,We have integrated fortigate with forticlient EMS, the remote access profiles and EMS tags are able to push on the forticlient successfully. We are having a scenario.In forticlient, after connecting the EMS through its IP, if profile didn't pushed and we manually enter the SSL VPN remote gateway and sends a connection request, it gets connected.Whereas we want to restrict it such that VPN will only gets connected once its profile will pushed from EMS, if we manually connect the SSL VPN, it should restrict. We have also implemented a scenario like VPN will only be connected once EMS gets connected, but now we have another challenging scenario which I had mentioned earlier. I request the seniors to please help out on this. Thanks

Hello everyone, I am trying to figure out if it is possible to use mclag and fortilink to connect the following devices together and how to do it. I have thought of two possible scenarios, but I am not sure if either of them is possible, so I am asking for your opinion. In the first case, I am afraid that I do not have enough ports 10gbit ports to create all link connection, while in the second case, I am afraid that it is not really feasible because I would basically want to have two independent tier1. I don't need guidance with the configuration, I just need help understanding which scenario might be the best one. The system will consist of the following devices, each with four 10Gb ports, which I would like to implement (using fiber SFPs to connect everything). 1x Fortigate FG-120G2x Fortiswitch FS-448E-POE2x Fortiswitch FS-424E-POE FirstHere I don't have the fifth 10Gb port in the 448s to be able to go from the first 448 to the second 424 and from the second 448

We are migrating our network infrastructure to FS1048e switches. We have some legacy equipment that  refuses to communicate at a port speed of 1Gbps. The transceivers we are currently using are FN-TRAN-GC. Copilot suggested FN-TRAN-SFP+GC, but the website it referenced is a third party site that doesn't give me much confidence in its accuracy. Our requirements for the transceiver are an RJ-45 connector, compatible with the FS1048e that can operate at a speed of 100Mbps. Has anyone else run into a similar need and found a working transceiver for the FS1048e?

We have been going through the process of setting up our Firewall to access Forticlient connections. All went well with connecting via just a Pre-Shared Key but we wanted to implement Saml using Entra ID. We went through multiple documents and have everything setup correctly (At least we think so). When we try to connect we get the popup to provide our credentials. After the credentials are submitted we are shown a <FQDN> server IP address could not be found. I made another connection using an external browser and when I make the connection I can see it sending the request to our Public facing IP address and then resolves to <FQDN>/remote/saml/login. The message in this window is 'can't reach this page'. There are Firewall policies setup to allow all traffic from the VPN Tunnel so we can verify that it works before scaling back but still does not work. The only thing that comes to mind is I read that the <FQDN> needs to be reachable from the internet. Ours i

Hi,I am planning to use ADC in transparent mode and would like to know if there are any limitations compared to L3 mode. I couldn’t find clear information on this.For example, are there fewer load-balancing methods or health check options available in transparent mode than in L3 mode?Regards, # https://docs.fortinet.com/document/fortiadc/7.2.4/handbook/592141/transparent-mode

Hi FNAC AdmisFortiNAC-F 7.2.9Ruckus ZD1200 v10.xThe WLC doesn't support CoA. So if I understand well the FNAC will send a RADIUS disconnect request in order to change the client's VLAN. But this doesn't happen.The test I've made is to fail the scan of the client. When the client is in wire network it is sent to quarantine, however when it is on WiFi it is not sent to quarantine and not even disconnected.Furthermore when the host is at risk and I try disconnect and reconnect to the SSID, it is put in the production VLAN instead of the isolation VLAN.Followed FortiNAC's "Ruckus Zone Director Wireless Controller Integration" document, but it doesn't mention anything about the issue and its resolution.

Setting up a FortiGate for multiple distinct schools (30). Each requires custom web filters. We manage all sites under one VDOM. Configuring custom web filter settings were a category is blocked and they want to allow a specific site. Block social media but allow Facebook. Once a category is blocked, an allow does not work. So we started to create custom categories for web rating overrides. We must of hit the limit of custom categories "maximum number of entries has been reached", we have 52. Is there a way to increase that number per VDOM? v7.4.8

Hi,I am tryingt to switch form ssl-vpn to ipsec dial up vpn. I worked on this for days now. No success. I have got a Fortigate 80F with Fortios 7.2.1 and FortiEMS & Forticlient running (Forticlient 7.2.11 / FortiEMS 7.2.10) There are 4 IPSEC Site2Site tunnels Forti to Forti1 Dialupconnection (IPSEC) with fixed IPs (local and remote)1 Dialupconnection (IPSEC) with variable dial up IP (IKE V1) And now I try to add an additional IPSEC-Dialup-Access.I configured the Fortigate as follows:NetworkRemote Gateway Dialup, Interface WAN1IPv4 client range: 172.16.10.1-172.16.10.30/255.255.255.255 (even tried 255.255.255.224)IPv6 is not used but there is: ::-::/128 AuthenticationPre-shared KeyIKE Version 2Accept Peers: Specific Peer ID: homeoffice.local P1 ProposalAES128-SHA256 / AES256_GCM-PRFSHA384DH: 18Key-Lifetime: 86400 P2 SelectorsName HomeofficeipsecLocal Address 192.168.10.0/255.255.255.0Remote Address: 172.16.10.0/255.255.255.224 P2 ProposalAES256 SHA

Hi FNAC adminsI see FNAC-F doesn't support SCEP.Anyone knows when it is planed?

Hi FNAC adisOn FortiNAC-F 7.2.9 we can see logs of local RADIUS but can't find anywhere the logs of RADIUS proxy.Any idea where we can find that?

I have 2 VPNs configured in my forticlient VPN, one of those works fine but the other after it connects I can't acess any server in my network.I checked that it shows that Received bytes are constantly at 0. I was using an older version of the client for years until it stopped working for this 2nd VPN, then I updated it to version 7.4.0.1658, but the problem continued. Can anyone help me understand what is the problem?

Hello, in the proccess of troubleshooting my Entra SAML DialUp IPsec tunnel I noticed something weird. While SAML auth via TCP 9443 worked fine, the handover to the IKE negotiation didn't work. There were no packets being received by FortiGate referring to IKE negotiation or ESP, only SAML via 9443. I was blaming my ISP first but running a local Wireshark on my WiFi interface revealed that there aren't even packets leaving my device for that peer IP referring to IPsec. To limit potential sources of errors, I replaced the SAML auth with a local firewall user and tried to log in. However, that doesn't work as well. Now there are NONE outgoing packets to the gateway IP! Upon login, FortiClient freezes for a bit and then says "IPsec connection is down" - like without even trying. I tested on 3 diferent devices now and I can't get it to work. My only assumption is that Wireshark doesn't capture the traffic to the gateway and that there's an iussue somewhere in the config

Hello FortiNAC community We have FNAC 9.4.3 controlling WiFi access with FNAC local RADIUS + Winbind.All works fine except when a user's password has expired.With our old MS AD RADIUS, when user with expired password wants to connect to WiFi, it asks him to reset his password. However with FNAC RADIUS it doesn't, so the user is unable to connect and unable to reset his password. Any useful idea would be appreciated. 

Hello all, I am currently setting up 802.x1 EAP-TLS authentication on an external cloud radius server on my FortiSwitch 448E-POE (Fortilink) and am experiencing a minor issue.Basically, I wanted to do this via TLS TCP (RadSec).I noticed that the FortiSwitches only send the packets as UDP. Presumably, the current FortiSwitch FW S448EP-v7.6.2-build1085,250526 (GA) does not support TLS over TCP, is that correct? In any case, there is no mention of “set transport-protocol tls” in the radius profile on the switch.The FGT with FW v7.6.3 build3510 (feature) seems to support this; at least, I can see that the packets are sent as TCP and they also arrive on my RADIUS server.In any case, I have now adjusted the RADIUS client so that it performs authentication via UDP on the RADIUS server. The query is also successful and arrives at the RADIUS server.The problem is that when I try to authenticate on a port of the FortiSwitch, no packets arrive at the RADIUS server. In debug mode, I can see t

Hi everyone!, I'm currently facing a problem with DDNS associated with fortiddns.com. The service isn't updating and returns an update error. Additionally, when I attempt to edit the configuration, no servers appear as available. This started after the DNS incident. I have another FGT 100F with the same configuration and it's not experiencing the issue. Has anyone else run into this problem?Any insights or suggestions would be appreciated.best regards! 

So we trying to setup a new Dialup IPSec tunnel but we keep getting a connection time out message. We rebuild the tunnel and policies multiple times thinking we missed a step but from the videos we found online this should be the simplest thing to do. I can see the traffic make it to the firewall and I see in the local traffic logs that the traffic is denied (even though we setup local-in-polices) to allow the IKE traffic.  So we are stumped and we are hoping that we are missing something simple that a more experienced person setting these things up might clue us in on. Our firewalls are running 7.4.8 and we are running Forticlient 7.4.3 (We've also tried 7.0.9 and 7.2.9 since some posts we stating older versions worked vs the latest version). I feel something is blocking the traffic on the Firewall I'm just not sure what it could be. Thanks for all and any help. Phil

Hi community,I have the following VoIP setup:Avaya IP Office v2 --- FG-80F --- ISP1 / ISP2 (SD-WAN)My goal is to configure a simple failover, where the FortiGate automatically switches to the secondary ISP if the primary link goes down.However, I’m running into the following issues: With SIP helper / SIP ALG enabled:Once the SIP communication is established (INVITE, ACK, etc.), the SIP ALG forces the voice traffic to go out through the failover link (ISP2), even though it should stay on the primary.This breaks the voice session.I’ve tried separate rules and SD-WAN policy routes, but the issue persists. With SIP helper disabled (no ALG):The SIP/SDP packets are sent out through the correct WAN link.However, the SDP headers are not NATed and still carry the LAN IP address.As a result, packets reach the destination but the remote side cannot reply. Has anyone faced a similar scenario?I solved this problem configuring the wan ip on the avaya but just can set 1 of them so if m