Solved

Hello, Team!  I’d like to ask about our FortiGate 300E. Its license will expire in January next year, but I saw online that its EOL (End of Life) is in July 2026.If we don’t plan to buy a new firewall next year and instead move the purchase to 2027, should we still renew the license? Also, if we renew but the unit reaches its EOL, will we still receive FortiGuard services and updates after that? Thank you! So sorry I'm kinda new to this

I have a Fortinet 200F hardware controller setup in an High Availability Cluster.  The version is v7.2.8 build1639 (Mature). Background: - The dedicated MGMT Interface IP address is X.X.30.254. IP address.- The FortiGate LAN interface is using a X.X.99.X IP address.- My workstation is using X.X.210.X IP address. Problem Description: I can login to the FortiGate FW Web interface just fine using the assigned LAN IP Address (X.X.99.X) from my workstation (X.X.210.X) ; but, I cannot get a web page or ping the IP address assigned to the FortiGate MGMT Interface (X.X.30.354) from my workstation.  I can access and ping other devices on the same X.X.30.X network from my workstation; hence the problem is specific to the X.X.30.254 Interface.  By the way other devices on the same subnet (X.X.210.X) have the same problem with the FortiGate MGMT Interface address (X.X.30.254). I have set the following configuration on the FortiGate "MGMT physical Interf

Hi FNAC admins and It seems on FortiNAC-F 7.4 and 7.6 (didn't test on 7.2), when doing enter-shell the user admin can't do sudo.Is there a special way to do that or has it just been removed?

Had this working briefly, but somehow , something has changed in the environment, I have followed: https://docs.fortinet.com/document/fortiauthenticator/6.5.0/cookbook/578250/fortiauthenticator-as-a-wireless-guest-portal-for-fortigate A few tweaks here and there, but essentially, the Client connects to the OPEN ssid, the interface uses system DNS to look up the address of the external portal., then should be able to access the captive portal, this part is completely broken, no traffic arrives at the FAC, meaning the client just cant resolve the FQDN (it used too!)  I checked the clients ipconfig, and it gets the right DHCP IP, gateway (Fortigate wifi interface) and correct DNS (it picks up public DNS, but there are DNS-DATABASE entries for the FAC)  there is an EXEMPT captive portal rule, from the GUEST source network, to the FAC on HTTPS, so that it can use the form to register, before browsing. there are no hits on this rule. I have tried everything now, I ju

I have my four vlans 10,20,30,40 tagged in interface internal5 then i do access my device fortigate 60f via web GUI but now i can not access the web gui again. i want solution to resolve this issue vlan10 10.10.1.1/24vlan20 10.10.2.1/24vlan30 10.10.3.1/24

Hello everyone,I am currently facing the issue, that the first login with "admin" and blank password is not working on the first login to the FortiManager via the HyperV console. I tried both current images for version 7.6.3 and 7.4.7, but same issue on booth of them. It just asks for the password and is then asking for the user again (no error for wrong credentials). Has anyone had any similar issues or knows what else I could try ? Console port loginWe wanted to try FortiManager to see if it fits for our purpose, but we can not open a support ticket for this issue, because we can not access a serial number and haven't bought a license yet.

hi, can someone pls advise whether we should block tor traffics (tor onion) on internet router as best practice for an enterprise? thanks in advance! 

Good morning, I've replaced the FortiGate 60F with a 120G. I can get everything working as it was, including the VPN with FortiClient, but the portal doesn't work. I get the following error: ForbiddenYou don't have permission to access /remote/login on this server.Additionally, a 400 Bad Request error was encountered while trying to use an ErrorDocument to handle the request. Could you please guide me on how to resolve this error?I attach screenshots of the VPN configuration, VPN portal, and a firewall policy.Best Regards!vpn settingsvpn settingsvpn settingsvpn portalvpn portalfirewall policyfirewall policy

Yesterday, out of the blue, our FortiGate 500E stopped accepting any client IPsec phase 1 proposals from our FortiClients.  I quadruple checked the settings on FortiClient, FortiClient EMS, and the FortiGate and nothing has changed.  No versions have changed either.  I verified that that proposals being sent by FortiClient and received by the FortiGate using diag debug, and multiple proposals match what is configured, but none of them are being accepted.I opened a case with FortiNet support and am awaiting a reply.  In the meantime, I'm curious if anyone else in the community has faced this and how you solved it.FortiGate: 7.4.8FortiClient: 7.2.9FortiClient EMS: 7.2.10 2025-08-06 16:29:40.813149 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: negotiation failure2025-08-06 16:29:40.813171 ike V=root:Negotiate ISAKMP SA Error:2025-08-06 16:29:40.813184 ike V=root:0:f4964d4586eabba5/0000000000000000:1235631: no SA proposal chosen VPN config on FortiGa

Hi, Which Firewall model is recommended for an average organisation for the user counts mentioned below with  NGFW capabilities? 250-500 users500-750 users750-1000 users  Thanks in advance

Hello guys, I was trying secure a guest wifi from illegal torrent streaming. i set up  web filters , application control and all work fine. But we found a <<hole>> lets say. A user used hotspot from his phone and connected to a streaming site (from the ones we have blocked) . The problem is that when he connected to our wifi the movie continued to play .  Is there a way to stop that session with the site automatically?I was thinking something like a reoccuring Session killer to particular sites. is it possible? FortiGate 

I need to upgrade a group of not licenced fortigates, I tried to run a script that execute a restore image tftp but after downloading and validate the image from the tftp server the script stops with errors and doesnt do anything. I would like to know if this upgrade process is posible and if there are alternatives to do this upgrade on not licenced fortigates. Maybe a script on an external server that execute a ssh on every fortigate. Thanks!

hi,i'm migrating a cisco asa ACL to a FGT.just to confirm, i'll always need to create 2x FW policy: inbound and outbound rule for each single ACL?an example would be below: !! ASA:access-list DMZ-IN extended permit tcp object SERVER-SUBNET 10.200.0.0 255.255.0.0access-group DMZ-IN in interface dmz !! FGT:edit DMZ-IN 1set srcintf "any"set dstintf "port 1" !! DMZ interfaceset srcaddr "SERVER-SUBNET" set dstaddr "10.200.0.0_16-SUBNET"set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext edit DMZ-IN 2 !! JUST CLONE REVERSE FW POLICY 1set srcintf "port 1"set dstintf "any"set srcaddr "10.200.0.0_16-SUBNET"set dstaddr "SERVER-SUBNET" set service "ALL_TCP"set schedule "always"set logtraffic enableset status enableset action acceptset nat disablenext

I am trying to reboot a downstream device in the fabric, but the automation stitch is not triggering. The trigger is a weekly schedule at hour 3 (3am - see image below). For action, I've tried using the system action (included with v7.2 onward) as well as a CLI Script for the reboot. Interesting points to note:  If I use the system action and click on the Test Automation Stitch, it reboots the downstream device.If I use the CLI Script and click on the Test Automation Stitch, it reboots the root and downstream device.Waiting for the trigger to reboot in either instance never occurs. Any help is appreciated. All devices are running 7.6.3Root device is a 600EDownstream device is a 40F I have followed the below, but this does not mention if it can be used for a downstream device in a fabric. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Automation-Stitch-to-schedule-restart-reboot/ta-p/19185 

Hey all Trying to automate a few things so I made a script that makes a script that makes the many objects I need to create on a regular basis. The problem is that whatever I do, I can't get the "Upload bulk CLI file" to take my CLI script, all I get is "configuration file error". Pasting the whole script on the CLI works fine and behaves exactly as expected, so I have no idea what the GUI upload function is going on about. Here's a super simple CLI script I made for testing: config firewall addressedit "Blocked-IP-22.222.22.222"set subnet 22.222.22.222 255.255.255.255nextedit "Blocked-IP-222.22.222.22"set subnet 222.22.222.22 255.255.255.255nextedit "Blocked-IP-11.111.11.111"set subnet 11.111.11.111 255.255.255.255nextedit "Blocked-IP-111.11.111.11"set subnet 111.11.111.11 255.255.255.255next end 4 simple address objects to create. Even if they exist, this doesn't produce any error on CLI since it's just editing existing objects anyway. GUI though, "configuration file e

hi,i'm migrating ASA BGP config to FGT and particular on re-using the 'no auto-summary', 'no sync' and 'redistribute static' commands. i'd appreciate if someone can confirm if i need these command syntax/placement under FGT BGP are correct?  ASA:router bgp 65101 address-family ipv4 unicast  neighbor 172.16.6.249 remote-as 65102  neighbor 172.16.6.249 activate  redistribute static  no auto-summary  no synchronizationexit-address-family ----- FGT config router bgp set as 65101 set router-id 172.16.6.250 set auto-summary disable set synchronization disableconfig neighbor edit "172.16.6.249" set capability-graceful-restart enable set remote-as 65102endconfig redistribute "static" set status enableendend

Hi, I am running an SPA (JS) application behind fortiweb in monitor mode.When HTTP2 is activated, the https (http2) request keeps infinitely pending.This request has the header "text/event-stream" When bypassing fortiweb and accessing directly apache in HTTPS (HTTP2), everything is fine.Could it be that fortiweb (7.6.4) has some issue heandling SSE requests ?Thank you for your help RegardsThibaut

Hi everyone,I'm currently configuring SD-WAN on a FortiGate device, and I’ve noticed that the default routes (0.0.0.0/0) are not being generated automatically for all WAN interfaces as expected.I have four WAN links added as SD-WAN members, and SD-WAN is enabled. However, when I check the routing table, I only see two default routes. I was expecting FortiGate to automatically generate a default route per interface when SD-WAN is active.Here’s what I’ve done so far:Added all interfaces to the SD-WAN zoneAssigned gateways for each member (both working members are configured via DHCP)Checked SD-WAN rules and performance SLA (removed them just for debugging)Verified that all interfaces are up and reachable (adding a static route for my source IP, just to check ping over internet)Still, the routing table doesn’t reflect all default gateways. I suspect I might be missing a step or perhaps some specific configuration is required to force the routes.Has anyone faced this issue before? Should I

Hello everyone,There is some study material on the training institute portal or here on the Fortinet support page regarding the configuration and functionality of a Fortigate used as an IDS/IPS probe.I would like to learn more about this and the admin guides just tell you step by step how to enable or configure a certain function.Thanks to all

FortiWEB full URL RewritingHello Team,i'm trying to rewriting this site From https://Example.com/xyz/#/t yuto https://test.qwe.com:447/   still not working 

I have cause to pull some information from a device connected to one of our switches (FortiSwitch 124F-FPOE), which are connected to / managed by our ForiGate's. Commands such as diagnose lldprx neighbor summary work fine in the CLI of the FortiGate, however it then only see's the devices connected directly to it. If I open the CLI on the switch and run the same command I get. command parse error before 'lldprx'Command fail. Return code -61 I then tried to enable LLDP in case it was off and that was causing the first error, however I have tried going to both config system global and config system settings and running set lldp-reception enable but I just get a similar error. command parse error before 'lldp-reception'Command fail. Return code -61 Any idea what I'm doing wrong? 

Dear all, In FAC 6.6.4I'm facing an issue while trying to sync remote LDAP user group with more than 500 user (510 exactly).The sync rule fails with error Unable to query remote LDAP server SRV_LDAP (ldap.xxx.xxx.xxx.com) for users to sync (rule xxxxxxxxx): ldap_search_ext_s search failed: Size limit exceededIs there a way to overcome this limit? What are the options to sync and use large LDAP groups? I didn't find anything in the documentation related to ldap group limit size. Thank you all! Best Denis

The LDAP configuration on FAC works fine when tested from the FortiGate, but after I enabled FortiToken on FAC, the VPN connection fails. Why is this happening?FAC version: 6.6.2FG version: 7.4.7FortiClient version: 7.4.3.1790

Hello,I need to migrate an SSL VPN from a fortigate 7.2.10 to another fortigate 7.4.8, but the SSL VPN feature doesn't exist; I tried to enable it via CLI and it doesn't appear either set gui-sslvpn enable Fortigate 180F

Greetings, I am configuring RADIUS authentication on my Fortigate 101F running FortiOS Version 7.4.3. The Microsoft NPS Server has been configured according to this guide. My radius configuration is as follows: config user radiusedit "RADIUS"set server "172.16.9.3"set secret PSKset nas-ip x.x.x.xset auth-type ms_chap_v2set source-ip "x.x.x.x"nextend The connection between the Fortigate and the NPS is successful, but test user credentials test fails. The CLI test output is as follows: diagnose test authserver radius RADIUS mschap2 user passwordauthenticate 'user' against 'mschap2' failed, assigned_rad_session_id=1486429090 session_timeout=0 secs idle_timeout=0 secs! Running a packet capture between the Firewall and the Radius Server I get an access-reject response with the following MS-CHAP error Code: 3ID: 190Length: 42Auth: 91 C7 F9 28 0A 50 59 33 13 39 B3 75 58 04 AC EEAVP: l=22 t=Vendor-Specific(26) v=Microsoft(311)VSA: l=16 t=MS-CHAP-Err