Solved

Hi community, Looking at the following post, it seems FGT-1 sends the SYN to FGT-2 through the LAN switch. https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-A-A-cluster-3-way-TCP-handshake/ta-p/197467 In the following situation, what happens if link 1 goes down? The SYN cannot be distributed from FGT-1 to FGT-2, then does the active-active configuration stop working? If not, what happens?  Regards,Julián

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out Our goal:Users connect to Fortinet SSL-VPN.We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.All other traffic should go through the user's local internet connection.Challenge:Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method usin

Hi, Would like to ask what will happen to our billing if the users onboarded exceed to our current subscription of 1000 users? Right now, we onboarded 1200 users. Does this might cause over-subscription and charge us for it?

Hello,I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"Fortigate version is 7.2.4however, there is another set of FGT firewalls which are working fine.Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.

The goal is split multiple JSON events sent in a batch into separate events. Going through the docs available to me, I've gotten to this - <patternDefinitions> <pattern name="patSplitEventsFromAkamai"><![CDATA[\{.*]]></pattern> </patternDefinitions> <eventFormatRecognizer><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></eventFormatRecognizer> <parsingInstructions> <switch> <case> <!-- Individual event format, process like normal --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,\[json\]=<_json:patSplitEventsFromAkamai>]]></regex> </collectFieldsByRegex> <when test="exist _json"> <collectAndSetAttrByJSON src="$json"> <attrKeyMap attr="format" key="format"/> <attrKeyMap attr="version" key="version"/> <attrKeyMap attr="eve

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '

Hi, I'd like to share with all of you a python script to perform full FortiGate config backups. It started as a simple automation for my work two years ago and has become a hobby. Along with today's new release i decided to do this post and maybe help some of you who do this task often. As i no longer have access to an appliance, my tests are done with a FortigateVM. Feel free to try out this tool and share your thougs here. All suggestions, comments and feedbacks are welcome. It requires Python 3.8+ and support FortiOS 6.x and 7.x versions. https://github.com/mcarneir0/fortigate-backup-api 

I'm very new to networking, and I'm a bit over my head. The current situation is we have two firewalls (Firewall 1 and Firewall 2) and two different WANs (VDOM Prod = 1.2.3.4/32, VDOM Nonprod =5.6.7.8/32) on physical ports on Firewall 1. There are no WAN connections are Firewall 2, so when there's a failover, we lose connection to the outside.  My end goal is to have a physical port on each that can support both VDOM WANs without adding more physical WAN drops to the greater network. So, here is my concept:Firewall 1:Physical Port-1 1.2.3.4/32 (Prod VDOM)   VLAN 5.6.7.8/32 (NonProd VDOM)Firewall 2Physical Port 2 5.6.7.8/32 (NonProd VDOM)   VLAN 1.2.3.4/32 (Prod VDOM)Is this a feasible solution? Should I make the connection identical?  Thank you for your time. 

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.

Hello, So i have a problem and cant solve without some help. We have two Fortigates, Main office (Site A) and the new one (Site B). I connected them by IPsec tunnel, with ph2 address 0.0.0.0/0 to both sides. Tunnel is up and working fine, but now i want to route two local subnets  of SiteB to go to internet over SiteA. and other subnets go to internet from local WAN. Topology: 10.20.1.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.20.2.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.99.99.0/24 -> SiteB FTG ->Internet I am trying to use policy routes but its not working or i am doing something wrong. Any help would be nice. 

Hi all, I have setup a new Fortigate 1101E cluster with FortiOS 6.2.10. Now I'm trying to configure radius authentication for administrators but when I try to set as source-ip the IP of the MGMT interface I get this error: x.x.x.x is not valid source ip.node_check_object fail! for source-ip x.x.x.x value parse error before '10.119.254.120'Command fail. Return code -8 What am I doing wrong? Thanks,M. 

Dear All,We are having following issue ClickHouseServer service on the worker is currently down, and no incidents or events are being ingested.Could someone help me to solve this issue ?  What could be the possible reasons for it ?@Anthony_E @Secusaurus   please help  

Hi Everyone! Would like to ask if anyone had experience connecting a breakout cable LC to Fortigate 200FThe breakout Cable in question is the HPE/Aruba K2Q46A MPO to 4 LC.This will be connected on an Aruba Switch using JH233A MPO Qsfp+ so the LC side will be on the Fortinet using a fortinet 10GBase-SR  Sfp+ transciever FTLX8574D3BCLFTN.Would this work having the Aruba switch do the splitting to 4x 10G per breakout cable? Your thoughts on this is much appreciated. Thanks 

Need to shift traffic on MPLS when Packet loss & latency has been increased.Currently when both the link get down traffic is being shifted but we want to shift the traffic when packet loss & latency has been increased.

I have already enable radius on fortigate and fortinac and then the connection is successiful.But when guestusers authenticate from wireless NAC radius log  show like as below i have attached   

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hello All, I'm configuring FortiSIEM 7.3.0, but some of the use cases aren't clear to me, and I kindly request some advice about whether the following use cases are possible to configure and display on the FortiSIEM dashboard. if so, please give advice, or does it need some other solution to be integrated as a source? Insider Threat & Lateral MovementEnable detection of unusual user activity (e.g., access to sensitive data). Correlate logins from multiple locations within a short time frame. Flag mass file downloads from internal systems. Vulnerability scan and\ assesment Identify the Vulnerability of the assets Regularly Test Security Systems & ProcessesDetect failed or overdue security scans. Alert on new vulnerabilities detected in PCI systems. Track & Monitor All Access to Network Resources & Cardholder DataEnable File Integrity Monitoring (FIM) for critical cardholder files. Configure correlation rules for unauthorized d

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.

Hello,  our "Vulnerability Scanner" detected that libcurl.dll as vulnerable to CVE-2025-0167Vulnerable files are:C:\Program Files\Fortinet\FortiClient\libcurl.dllC:\Program Files\Fortinet\FortiClient\x86\libcurl.dllWe use free FortiClient VPN SSL, so we can't confirm if full paid version is vulnerable too.We've upgraded to FortiClient VPN SSL 7.4.3, but libcurl.dll version is still vulnerable 

Hello community, I tried many ways to configure IPsec vpn to access only a specific subnet, but all have failed.Can you guide to how to configure such connection. Thank you!

Hello Team,We have deployed the FortiGate Firewall-201G in HA (Active-Passive) mode. Due to port limitations, we have connected a FortiSwitch (model 148F) to each firewall. These switches are managed through the firewalls.Currently, we are facing an issue: only the FortiSwitch connected to the primary firewall is coming online. However, we want both switches (connected to the primary and secondary firewalls) to stay online.Additionally, while the firewalls are in HA mode and have failover configured, the switches do not have any failover setup. This means if one switch goes down, traffic cannot switch over to the secondary switch, which creates a single point of failure.We have tried using crossover connections and the FortiLink split interface feature, but were not successful. We also noticed that the MC-LAG option is not available on the FortiSwitch 148F.Could you please advise on the best way to configure failover for both FortiSwitches connected to the primary and secondary firewal

I had tried to setup VPN connection. Using the latest version client and firewall. In windows During the login time it shows"VPN Server may be unreachable (-14) " . Status shows 80% complete. BUT it works in ANDROID..!!! Anyone resolved this ?