Solved

We have multiple Fortiswitches managed by a Fortigate.  I need a command to see the MAC addresses on a specific port on a managed switch.  For example, I need to see the MAC addresses on port 1 of switch "1234."  I can use this command to see "port1": diagnose switch-controller switch-info mac-table | grep port1 But this command lists all the port 1s for all the managed switches. I need a command that let's me specify which managed switch I want to view. Thanks.

We are converting checkpoint configurations to fortigate (finally getting rid of it)But I have seen the interface setting and here is something I am not used to itIn Checkpoint the LAG interface itself (the physical) has a network without VLAN the Forticonverter converter exactly the same settings. see screenshots bellow:I am used to put all IP addresses and betworks to logical interfaces with VLANIDSo my question is, will this work normally in fortigate? with VLAN ID 1 ? untagged ? can this interface (the physical) be assigned to policies later ? Thanks 

Using the FortiClient VPN to connect with SAML authentication, logins worked before we created a Conditional Access policy that enables "Require device to be marked as compliant" and "Require Microsoft Entra hybrid joined device". When we connect Microsoft blocks the login because it doesn't recognize the device with the following info. You can't get there from hereThis application contains sensitive information and can only be accessed from:domain joined devices. Access from personal devices is not allowed.The current browser is not supported, please use Microsoft Edge, Internet Explorer, Chrome or Firefox 91+ to access this application.If you're not planning to do this right now, you might still be able to browse to other domain sites. Otherwise, sign out to protect your account.Sign out and sign in with a different accountMore detailsError Code: 53001Request Id: RequestUUIDCorrelation Id: CorrelationUUIDTimestamp: 2024-09-14T20:46:27.958ZApp name: My VPN Enterprise AppName

I am trying to configure the PostgreSQL connector on my FortiSOAR setup to connect to the FSR DB however, it fails with below error:Configuration Health Check Failed!FATAL: no pg_hba.conf entry for host "192.168.60.101", user "postgres", database "venom", SSL encryption FATAL: no pg_hba.conf entry for host "192.168.60.101", user "postgres", database "venom", no encryption I tried connecting to the same DB using the pgsql command line and that works fine. What could be the issue here:[root@fortisoar csadmin]# sudo -u postgres psqlPassword for user postgres:psql (16.8)Type "help" for help.postgres=# \lList of databasesName | Owner | Encoding | Locale Provider | Collate | Ctype | ICU Locale | ICU Rules | Access privileges---------------+------------+----------+-----------------+------------+------------+------------+-----------+-----------------------connectors | postgres | UTF8 | libc | en_US.utf8 | en_US.utf8 | | |das | postgres | UTF8 | libc | en_US.utf8 | en_US.utf8 | | |data_arc

Hi there.I am having some issues installing FortiClient 7.4.3 on MacOS 15.6 (24G84)Macbook Pro M4 Pro Using the terminal, I found that the installer fails at around 97%. installer: Package name is FortiClient installer: Installing at base path / installer:PHASE:Preparing for installation… installer:PHASE:Preparing the disk… installer:PHASE:Preparing FortiClient… installer:PHASE:Waiting for other installations to complete… installer:PHASE:Configuring the installation… installer:STATUS: installer:%17.931671 installer:PHASE:Writing files… installer:%39.280230 installer:PHASE:Writing files… installer:%64.101310 installer:PHASE:Running package scripts… installer:%64.661962 installer:PHASE:Running package scripts… installer:%65.221900 installer:PHASE:Running package scripts… installer:%65.786566 installer:PHASE:Running package scripts… installer:%66.347237 installer:PHASE:Running package scripts… installer:%66.911340 installer:PHASE:Running package scripts… installer:%86.516746 ins

Hi,I want to monitor a public IP from my FortiGate, and if the IP becomes unreachable, I want to automatically receive an email alert.Is this possible using FortiGate Automation? If yes, how can I set it up?FortiOS Version: 7.2.10

Hello, I have upgraded my FAC Agent version from 5.2 to 6.2 on my RDS Host.A few days later I have lost the capability to do a remote connection (aka RDP) on this server. I have completely uninstalled the FAC Agent on this server but the RDP access is still unavailable.I have the FAC Agent v.5.2 installed on another RDS Host server and everything is working nice. Nothing in the release notes, any ideas ?  Thanks,

Hello everyone,I have a network that was configured a few years ago with a FortiGate (FG) using a "hardware switch" on ports 1, 2, and 3. The setup is as follows:"internal1" interface:Contains three VLANs:VLAN 1: Used as the core VLAN (I know this is not ideal, but I am not authorized to change it).VLAN 100: Network exclusively for wireless clients.VLAN 1005: Network for phones.Network topology:FG -- Cisco Switch-- FortiSwitch 108 (FSW)The FSW is connected to the FortiGate through "internal1."I configured the FG to recognize and manage the FSW via FortiLink, even though it is not directly connected.FortiLink configuration:I created VLANs 100 and 1005 within FortiLink, assigning them IP addresses and DHCP servers different from those in "internal1."Issue:The VLANs configured on the FSW via FortiLink have no connectivity and do not receive IP addresses via DHCP.I have already configured the ports on the intermediate switches (Cisco and HPE) to allow all VLANs, but the issue persists.Any

Hi everyone,I’m running into an issue with FortiClient VPN Only 7.4.3 (VPN with SSO/EMS support) on macOS 15 Sequoia (15.6). What’s happening:The VPN requires SSO via web browser (SAML) + 2FA.On macOS 15 Sequoia, FortiClient never triggers the required Automation (AppleEvents) TCC permission.I have reset TCC (tccutil reset AppleEvents com.fortinet.FortiClient), reinstalled the app, and checked Automation, Accessibility, and Full Disk Access settings — nothing changes.Without the Automation permission, the embedded SSO browser cannot complete login, and the VPN connection fails.Environment:Personal Mac (non-supervised, no MDM)FortiClient 7.4.3 (VPN + SSO)Tested: full uninstall/reinstall, TCC reset, permissions check — still no Automation promptQuestions for the community:Has anyone managed to get SSO working with FortiClient on macOS 15 Sequoia without MDM/supervision?Is there an older version (e.g., 7.2.x) that still works on macOS 15 for SSO?Any info on when macOS 15 Sequoia will

Hello,  we have two firewalls. We started upgrading the first over automatic upgrade -> 7.0.17 to 7.2.11 to 7.4.8. This was fine. The second had to be updated manually -> 7.0.17 to 7.2.11 ok. Now the upgrade moved to System/Fabric Management. However there I can't choose a file for upgrade anymore. This is availalbe in 7.4.8 again but not in 7.2.11. How can this be solved? Kind regards,David

I see a big discrepency between 7.2/7.4 and 7.6 for maximum values.On a 1500D, 1100E, 2200E, and 3301E the maximum number of server-load-balance is 2048 when running 7.2 and 7.4For 7.6 these values drop to 64. Why is there such a big discrepency?  firewall.vip type=server-load-balance (virtual server)

I am trying to use a FortiAP 221E without a FortiGate, but thus far have been unable to get it work. This FortiAP was previously used with a FortiGate and I can reconnect if needed to put in Standalone mode. I attempted to Factory Reset the AP using the reset button, but even after Factory Reset it doesn't broadcast an SSID and attempting to connect to via web GUI does not work. I am posting here to see if I am missing a step in putting into Standalone mode or if that is not even and option on this model.

 Hello, I'm trying to setup an ldaps srv on my fortigate 50E (6.2.17) and it works with the ip without cert and i can save but i would like it to work with a cert when i try with the fqdn, i can't save and shows invalid hostname (i can ping the fqdn from the fw) even if the connectivity test works and i can browse the distinguised name  then when i try to enable the secure connection and add the CA cert (with the fqdn as the cn), the connectivity test still works, i can still browse the distinguished name but when i try to validate, it disable the secure connexion with the cert and i get an invalid hostname error even if i can ping this hostname and browse the dn and everything... Does someone knows why it could do that ?  Best RegardsJohn      

Can we send the log to syslog only for specific category? Example send log to syslog for '**bleep**' categories.

HiI'm asking because I have a question when I do okta certification at Fortigate. Diagram is ScenarioWhen users on INT side access SRV, they must obtain okta certification to access it. Policy1.INT > SRVS : SSO, User IPD : Server IP 2.INT >  EXTS : User IPD : ALL This way, I can access the server after being authenticated. However, ALL is not available in Destination.So I made okta FQDN and trial.* as destinations, but the authentication screen doesn't show up. Do you know how to set the destination for Okta authentication? Also, I would like to know what traffic flow okta authentication is done when users access the server. Thank you.       

Hi EMS adminsI wonder if anyone noticed if FortiClient could detect the latest critical vulnerabilities that affect driver and firmware of Dell laptops with Broadcom BCM5820X series chips, I mean all of these vulnerabilities:CVE-2025-24311, CVE-2025-25215, CVE-2025-24922, CVE-2025-25050, and CVE-2025-24919.More information here:https://www.dell.com/support/kbdoc/en-us/000276106/dsa-2025-053If your FortiClient has detected them (or not), then your feedback would be appreciated.

Hi,  I’m trying to use FortiAnalyzer (FAZ) to monitor IPsec tunnel down events in a large-scale SD-WAN.Event Handlers are in place and SMTP email alerts are configured, but I’m seeing:IPsec down events don’t always generate alerts.FAZ is at HQ. When the branch-to-HQ IPsec tunnel drops, FAZ doesn’t trigger the down alert. I usually get a “down + up” alert only after the tunnel comes back up, which isn’t useful.If this isn’t a valid use case for FAZ, what’s the recommended way to achieve timely alerts? Can FAZ generate a “device disconnected” or “device down” event when a FortiGate loses connectivity to FAZ? That would be more meaningful once the tunnels drop.

Hello everyone,I have a FortiWiFi device where I’ve configured 3 SSIDs as follows:veone air: DHCP pool 192.168.10.10 – 192.168.10.254, operating in tunnel modeveone tech: DHCP pool 192.168.20.10 – 192.168.20.254, operating in tunnel modeveone voip: DHCP pool 192.168.30.10 – 192.168.30.254, operating in tunnel modeI’m able to connect to these SSIDs from my computer and complete my tasks without any problems.Today, I received a PBX server that needs to be connected to the FortiWiFi on the internal4 port. The server requires a static IP address 192.168.30.3/24, which belongs to the same subnet as the veone voip SSID’s DHCP pool. This setup should allow me to ping the PBX server from devices connected to the veone voip SSID.However, even though the PBX server is physically connected to the FortiGate’s internal4 port and assigned the static IP address manually, I am unable to ping it from the SSID network.Could someone please advise on how to configure the FortiWiFi or what changes I need t

Hello!  I just migrated most of the policies on a customer's 600E (7.4.8) from Proxy mode to Flow mode since only a few of the policies actually needed the Proxy mode to work (CDR & Video Filtering).  One of the rules that I tried to change from Proxy mode to Flow mode was a simple DNS rule that only does DNS filtering for DNS lookups to the Internet:config firewall policy edit 117 set name "DNS Filter - Testing" set uuid b4130862-7872-51f0-6074-01eb3ef19f90 set srcintf .... set dstintf "virtual-wan-link" set action accept set srcaddr "laptop wifi" set dstaddr "all" set schedule "always" set service "DNS" set utm-status enable set inspection-mode proxy set dnsfilter-profile "DNS-Filter" set logtraffic all set nat enable next endWhen I change this rule to Flow, a select few DNS lookups resolve to FortiGuard's DNS Blocking page.  Yet, when I do these

Good evening Fortiweb admins, I have noticed an issue with the "URL Encryption" feature on FortiWeb. When I enable my URL Encryption policy, the URLs are successfully encrypted.However, this distorts the design of the protected website:The site’s appearance is no longer the same.Some elements are missing.Colors change.In some cases, only the HTML code is displayed without the CSS, Bootstrap, and other resources.Does anyone have any idea about the root cause of this problem? 

I would like to create an email notification when someone accesses my firewall, sending an email with the user name and date. Is there something like that?

Hi, We are looking to manage traffic with identity and endpoint based policies. We are also planning on getting EMS to get as much ztna in place as possible. It seems that the best option for managing identities is fsso. Is it compatible/recommanded with EMS ? Which should we go witch ? Any advice before with start going in all directions ?

I'm currently trying to configure a Captive portal with SAML authentication for a specific https traffic.My issue is how can implement this only in my firewall policy and not on my interface which will impact my other traffic. I'm running 7.2.7 version on 1500D.Do you guys have an idea about that?  

Step to reproduce:Install FortiClient  VPN 7.4.3 onto macOS SonomaUpgrade to latest macOS SequoiaAnd here we go, ,no Add Profile or Add New Connection Optionbefore on Mac OS Sonoma it work correctly, and im configure everything- create profile- add new connectionafter upgrading to macOS Sequoia i'm experience this issue, my configuration and connection is gone been trying to reinstall but still can't add or load my existing connection

Hello everyone, I'm trying to figure out how I can allow one of my Fortinet inferface to be able to ping the "IPsec VPN" IP of my remote users (connected with Forticlient). From the Fortinet itself, I'm able to ping those IPsec VPN connected workstations just fine, but I'm unable to do the same from any other interfaces (i.e. like from a server behind the Fortigate). I already created an IPv4 Policy to allow the "PING" to go through between one of my internal interface to the interface of the "IPsec" interface, but that does not seem to work...I also tried adding a static route, but that did not seem to help. Anyone faced a similar issue like this before ?Thanks for your help and best regards,--Eric