Solved

Hello,We have an HA pair of FortiGate VM04s in our Azure development environment that we are using to test for a redesign. The FortiGates were built with the "ELB/ILB Sandwich", as Azure/Fortinet documentation outlines. We also have a GLB placed in front of the ELB, in order to gain the flexibility a global IP provides. The backend IP of the GLB is the single ELB public IP.We have tested the following successfully:- We can terminate an IPSec VPN to the ELB, directly connected to the two outside FortiGate vNICs- We can terminate an IPSec VPN to the GLB However, we have not been able to successfully terminate separate VPN tunnels to the GLB and ELB simultaneously. The ability to do so would greatly ease our cutover process, as we currently have a standalone FortiGate-VM in production with a regional IP and dozens of vendor IPSec tunnels terminating to it. If we can prove that it's possible to terminate to the GLB and ELB simultaneously, we can slide our production regional IP over t

Hi i have a problem to ativate double stack for  vpn ssl   config vpn ssl settings set dual-stack-mode enable end Response in cli mode   set dual-stack-mode enableTo enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.node_check_object fail! for dual-stack-mode enable    I have only one vpn policie. do you have an idea ? Regards

Hello, I’m looking for a 10G Single mode SFP module to connect a switch and Fortinet routers over a short distance (around 2–10 meters). Could you recommend the right option?Best regards,

Hi, I have a new deployment for FortiGate as an edge firewall. The latency design involved DC FW acting as both DC and Edge. Now I will implement Fortigate as Edge and do point-to-point with DC FW. The Q is. I do have:- one Internet link with 2 IPSec over the Internet link.- 2 MPLS links. One to Cloud servers with paloalto fw, second for my 10 Fortinet branches. For the internet, I will have only 1 link. And over that will build 2 IPsec (One to be a Load balance SDWAN with MPLS to my branches, Second to be a passive link with MPLS to my cloud service). What is the best practice to build that topology? Should I add all three 3 WAN interfaces under the SD-WAN Zone, and with that ZONE create 2 IPSec? Or I have to keep the 3 WAN interfaces without SDWAN zone as normal WAN interfaces, as there is no Load balancing except the connection with branches. Then create SDWAN for IPsec. Kindly for advice for the best practice solution.

Hello community,Since I have configured some mail alerts with the automation in our FortiGate-VM I noticed that the "High CPU" message gets triggerd every day exactly every 8 hours (0:00; 8:00; 16:00). But the cpu spikes only for a very short time, since I don't even see the spike in the CPU widget or GUI process monitor.I tried configuring the generation of the local reports to other times than those 3 times with the CPU spikes, but it still happens.I also looked at the times where IPS and AV database updates (setting is automatic), but it never was at those times from the CPU spikes in the last weeks.Also rotation of logfiles only happens at 0:00 so this does not explain the other times from the CPU spikes. I also run some CLI commands for monitoring the system performance, when a mail alarm is sent, here is the output from it:========== #1, 2025-08-14 08:00:07 ========== FW-SAAS config global FW-SAAS (global) get system performance status CPU states: 83% user 14% system 0% nice

hello, I need to restrict IPSEC VPN I need to connect only from UAEI Make this step but problem when I connect VPN (connection fine but no data send for example I cannot ping to any server or pc or login to FortiGate).

I'm preparing to migrate from FortiEMS 7.2.10 to 7.4.4 in a test HyperV environmentI've downloaded and configured version 7.4.4. I don't have any Linux knowledge.Now I want to perform the migration steps.But I'm getting the following error during the first command:Error: unknown command "sudo" for "emscli"How can I enable sudo? 

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.I am at a bit of a loss at what else to look at.

Hi, while configuring Tier 1 (Core) and Tier 2 (Distribution )FortiSwitch. I want to test 2 device ping each other, with the same vlan (for example VLAN2). Let say I don't want to mind the FG, only the L2 first. Do I need to set the VLAN2 with IP address to the Tier 1 (Core) and Tier 2 (Distribution) or it will work even if I set only to Tier 2. Thanks

The upgrade order is 7.2.8 > 7.2.9 > 7.2.11, but I accidentally guided the upgrade to 7.2.11 right away. Is there anything that could be a problem? These are 101F and 61F. Thank you

I am looking for assistance getting a multiple IPsec tunnel configuration working on a single WAN IP. Utilizing IKEv2 for Entra SAML authentication.  I have two IPsec configurations, each are configured the same with the exception of PSK and Local ID. Forgot one other note: The second tunnel is configured to use IPv4 Split-Tunnel. I can successfully connect to the "primary" one or the employee one I setup first. As long as my PSK/Local ID and DHG/Encryption in my forticlient is set correctly it authenticates and connects. If I attempt to switch to the Vendor intended tunnel and use that configuration, I get through Entra Authentication and it hangs and fails to connect.  Details120G running v7.4.8Using Forticlient free v7.4.3.1790 Hoping someone can point me in the right direction of what I am missing. I was really expecting the Local ID to make this simple to configure. I have tried changing Encryption & DH groups on the second tunnel phase1/2 (o

Hello. I am standing up a FortiClient #EMS ppliance for the first time, and I have somewhat limited experience with Ubuntu. Our platform is Hyper-V.  The vhdx was properly installed and booted.  I was able to login with user 'ems' and successfully changed the password. So far so good. However, it seems to me that after login, I am now in the 'bash shell', and the instructions for configuring an IP, seem to be based on being in the terminal. None of the commands available in bash seem to allow me to do this. And the instructions here don't work, as they are for terminal.  I tried "execute ls /etc/netplan" but it told me "folder /etc/netplan is not accessible" Can you please help me configure IP? I imagine once that's done, we can ssh into the terminal or maybe even a webpage? Deploying EMS as a VM image | FortiClient 7.4.4 | Fortinet Document LibraryConfiguring the VM IP address by modifying Netplan configuration filesTo configure the VM IP addres

Hello I am installing fortiSIEM 7.3.1When I try to access the gui, it fails with error below"Proxy ErrorThe proxy server received an invalid response from an upstream server.The proxy server could not handle the requestReason: Error reading from remote server"

Hi all,Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?Thanks in advance RegardsFrédéric 

I have a TRUNK-LAG configured for Aggregate mode. This interface contains VLANs 40–48. I want to add VLAN 49 as tagged on the TRUNK-LAG and untagged on SWVL-49. How can I do this?   

Hi, we changed to a FGT90G cluster and we have to change from SSL VPN to IPSec. We are running 7.4.7 and I think it will be the last image with SSL activated. We only used SSL VPN since it seemed easier to configure with different Groups, etc. Now trying to do the same with IPSec we have several problems. Our IPsec configuration:>In the IPSec Client Address range we used another range than SSL VPN (X.X.X.50-100 and IPSec X.X.X.150-X.X.X.200.>We enable Enable IPv4 Split Tunnel and define in Accessible Networks ALL since we want to have access to the LAN and also the MPLS networks>In XAUTH  User Group we have INHERIT FROM POLICY to use the same user groups we had before with SSL VPN Now our problems:> With the Forticlient 7.2 we cant connect, the client shows connecting but nothing happens. Also in the FG I dont see any information about the IPSec access. With older versions, I tried a 6.4 the connection works. > Since SPLIT Tunnel i

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

Hello guys! Got a bit confused with FG's auth process for remote ssl-vpn users. For now we have a simple LDAP/AD (w/o agent) based authentication for remote users and ACL based on AD group names, everything just works and works fine. Now I got the case that I have to implement MFA via an MS NPS(plus azure MFA) as a radius server (please don't ask why). I don't understand how to implement this transparently. Do I have to add all existing groups by name in the same way how I do this with LDAP into each ACL(that's could be long, but ok)? And how the FG knows in which group a user in ? What if the user is in several groups? So can anyone elaborate these moments ? I read this article , but it's still unclear https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-User-Groups-to-match-multiple-Remote/ta-p/358789 AFAIK the FG gets the group name AVP from the radius server (MS-NPS) , but is it all groups for each client or like a first group per client ? Do we have to change sett

Hi!  We have a pair of Fortigate VM64 in HA on VMware (provider is OVH).We are migrating clients from PaloAlto to this Fortigate. We have around 30 VDOM (and we need to add more), with VDL link to the root.We have EMAC VLANS for the interface (WAN, Private and DMZ). It is working, but when the sessions increase around 30K and higher, everything become very slow.The ping between private and dmz inside any vdom increase around 100-150ms with lost packets. The CPU is used max 20%, and the memory around 60%. We have a ticket with Fortinet, but for them , with a packet capture, there were able to show that the fortigate don't add any latency in the packets. We move back one of the client to PaloAlto and they are now happy!The PaloAlto use the same VMware farm. To be able to make the EMAC VLAN and VDL work, we needed to enable the promicious mode on the port group on VMware. Maybe this is the problem. The links are 10GBs, and the traffic on the trunk t

Hello expert. i Humbly request some guidance. I have a fortigate 80F and tried connected  to manage the  fortiswitch 524D via fortilink but the following error  "offline" (see screen shots) I have included a two screen shots for clarity.    Regards

Hi all, I'm an experienced network guy with 28 years of experience, but it's all Cisco. I'm new to Fortinet. Here's my question: I'm working on a design for a customer with multiple satellite offices that connect back to two datacenters (primary and DR). They are all interconnected with two layer-2 ELAN WAN meshes.  I want to centralize all of my routing onto the Fortigate firewalls at each location. But because the WAN links are from two separate vendors each Fortigate is going to have two physical handoffs, one to each vendor's network. My plan is to create a WAN zone on each Fortigate and then put both physical interfaces in that same zone. (I don't need any filtering/firewalling between those interfaces.) I'm trying to find out if I am going to run into any asymmetric routing issues. The WAN circuits will be load balanced so I can't promise that packets  from a particular session that go out on one vendor's circuit won't return on the other vendor's circuit

Based on another solution by @funkylicious we created a FQDN that was addressable from the internet. We also created a certificate with the FQDN in the common name and the IP address in the Subject Alternative Name. When Forticlient tries to connect to the FQDN the web browser states the connection is not private and lists that the Cert Common Name is Invalid. I notice in the address field that instead of the FQDN being listed it is showing the IP address. I thought that have the IP address in the SAN would address this. Our security policies do not allow users to continue if there is a security certificate mismatch. So trying to figure out why the IP address is showing up when connecting to the VPN instead of the FQDN. Do I need to make another certificate that explicitly names the IP address instead of the FQDN?

Hello   I'm having trouble configuring an IPsec VPN. I configure one IPSec VPN and everything works fine. Clients connect and everything works fine. When I add another VPN, the previous one stops working. Below is the configuration of the first working VPN:                  I'm adding a second VPN    After adding a second VPN, "VPN_Gamma," the first one stopped working. Only after disabling the vpn_VPN_Gamma_remote policy did the first VPN start working again. What could be causing this?

Hi,I am considering using destination NAT on the secondary IP address of the internet-facing port to build a DMZ network.Although I were able to configure destination NAT for the secondary IP address, but it is not working.My hypothesis is that the product's specifications might prevent a secondary IP address from being used for destination NAT.I appreciate any advice from someone with knowledge on this.Thanks,Kenji

I have been discussing if a Fortigate HA in A/P can work with BGP/EBGP from a single ISP.  So I wanted to see what exactly is possible.  The ISP was going to be providing the routing on their side with my firewalls accepting the connection.  I have put a logically diagram of what I am looking to build.