Solved

Hi Everyone! Would like to ask if anyone had experience connecting a breakout cable LC to Fortigate 200FThe breakout Cable in question is the HPE/Aruba K2Q46A MPO to 4 LC.This will be connected on an Aruba Switch using JH233A MPO Qsfp+ so the LC side will be on the Fortinet using a fortinet 10GBase-SR  Sfp+ transciever FTLX8574D3BCLFTN.Would this work having the Aruba switch do the splitting to 4x 10G per breakout cable? Your thoughts on this is much appreciated. Thanks 

Need to shift traffic on MPLS when Packet loss & latency has been increased.Currently when both the link get down traffic is being shifted but we want to shift the traffic when packet loss & latency has been increased.

I have already enable radius on fortigate and fortinac and then the connection is successiful.But when guestusers authenticate from wireless NAC radius log  show like as below i have attached   

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hello All, I'm configuring FortiSIEM 7.3.0, but some of the use cases aren't clear to me, and I kindly request some advice about whether the following use cases are possible to configure and display on the FortiSIEM dashboard. if so, please give advice, or does it need some other solution to be integrated as a source? Insider Threat & Lateral MovementEnable detection of unusual user activity (e.g., access to sensitive data). Correlate logins from multiple locations within a short time frame. Flag mass file downloads from internal systems. Vulnerability scan and\ assesment Identify the Vulnerability of the assets Regularly Test Security Systems & ProcessesDetect failed or overdue security scans. Alert on new vulnerabilities detected in PCI systems. Track & Monitor All Access to Network Resources & Cardholder DataEnable File Integrity Monitoring (FIM) for critical cardholder files. Configure correlation rules for unauthorized d

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.

Hello,  our "Vulnerability Scanner" detected that libcurl.dll as vulnerable to CVE-2025-0167Vulnerable files are:C:\Program Files\Fortinet\FortiClient\libcurl.dllC:\Program Files\Fortinet\FortiClient\x86\libcurl.dllWe use free FortiClient VPN SSL, so we can't confirm if full paid version is vulnerable too.We've upgraded to FortiClient VPN SSL 7.4.3, but libcurl.dll version is still vulnerable 

Hello community, I tried many ways to configure IPsec vpn to access only a specific subnet, but all have failed.Can you guide to how to configure such connection. Thank you!

Hello Team,We have deployed the FortiGate Firewall-201G in HA (Active-Passive) mode. Due to port limitations, we have connected a FortiSwitch (model 148F) to each firewall. These switches are managed through the firewalls.Currently, we are facing an issue: only the FortiSwitch connected to the primary firewall is coming online. However, we want both switches (connected to the primary and secondary firewalls) to stay online.Additionally, while the firewalls are in HA mode and have failover configured, the switches do not have any failover setup. This means if one switch goes down, traffic cannot switch over to the secondary switch, which creates a single point of failure.We have tried using crossover connections and the FortiLink split interface feature, but were not successful. We also noticed that the MC-LAG option is not available on the FortiSwitch 148F.Could you please advise on the best way to configure failover for both FortiSwitches connected to the primary and secondary firewal

I had tried to setup VPN connection. Using the latest version client and firewall. In windows During the login time it shows"VPN Server may be unreachable (-14) " . Status shows 80% complete. BUT it works in ANDROID..!!! Anyone resolved this ?  

I have a, maybe silly question but maybe someone can answer me.. We have FAC setup with RADIUS clients in a 10.10.0.0/16 subnet, mainly used towards switches for MAB. The thing is we want to configure VPN for a firewall with an IP in the same subnet. Is it possible to configure this as a /32 without it being affected in the /16 subnet policy?

Hello, I am trying to setup a FortiAuthenticator policy for Wireless dot1x. The authentication works but RADIUS attributes (vlan and ACL) is not pushed to client.Here is what I have tested; Added the Remote LDAPCreated a User Group which retrieves user via LDAP Filter (not via imported users).Created a Realm for LDAP UsersCreated a Policy that:WLC as RADIUS ClientAuthentication Type Password/OTP (PEAP and EAP-MSCHAPv2)Identity Source - username@realm - Points to LDAP Realm, uses Windows AD Domain Auth and filters on the groupAuthentication Factors - Password Only and Windows AD computer authentication I have tested with User Group pointed to imported users and remote user sync rule but that does not work either.Does anyone have any idea? I checked the debug logs but cannot find anything interested. Also we havetested this with a local group (MAB) and it works fine.

If use lacp-mode static because the peer equipment does not support lacp, it seems similar to use h/w switch or s/w switch instead of LAG. What's the difference between Fortigate's lacp-mode static and h/w & s/w switch?

Hello to all,I’m trying to build a single spoke hub & spoke (Dual hub) topology using the overlay template provided by FMG 7.6.3.The architecture is formed by 2 VM fortigate hubs in 7.4.6 and an onprem A/S pair that acts as spoke in 7.4.6.Full internet topology, each hub has only one link while the spoke has 2.All the tunnels are UP, and HUB side I see the advertisement in BGP of the test subnet that I’m using onprem side (192.168.99.0/24). The BGP advertisement has something strange, I would have expected to see the VPNs as next-hop interfaces, instead it uses directly the port 1 (outside of the hub) used by the underlay.I noticed that the templates created by FMG do not assign an IP on the HUB interface tunnels, I don’t know if this is an error.From the hub loopback (172.16.5.252) I can successfully ping the spoke’s Lo (172.16.5.1).

Both the FortiGate Firewall content processor（CP） and the network processor（NP） have IPsec encryption and decryption functions, and there is overlap in their functions. How are the two processors divided in IPsec encryption and decryption?

Hi all,I'm doing a trial setup of some FortiExtender FEX-202Fs with my existing Fortigate 91Gs which are managed via a FortiManager VM. I plan on using these as LAN extenders for remote microsites. I've managed to get the FEX units working well with the FGTs on their own, but the trouble comes when I try to use FMG to create firewall policies involving the FEX interfaces.  In the FGT UI, I can see the FEX units correctly appearing under the "LAN Extension" category. Firewall polices work fine when configured directly on the gates. However, when the FGT configs are imported into FMG these same interfaces appear as the "VLAN" type. I am then not able to select these interfaces when making firewall polices. I'm assuming this is because the "role" variable on the erroneous VLAN page for these interfaces is set to "Undefined". Unfortuantely I am not able to change the interface role, as an error message appears notfying that "VLAN ID must be between 1-4096", but the option to set

Good morning! How does static mode work in LACP on Fortigate?As far as I know, Fortigate don't send lacp messages in static mode,so how can I communicate in a static-static configuration? Thank you

FortiNAC self-registration Guest Management with wireless dynamic Vlan management .During the registration process without doing nothing . I got a native vlan ip.In NAC's Network>Inventory>Device>Virtualized Devices>root I haven't add native Vlan id . What is the fault ? 

One of our customer planning to integrate Forcepoint DLP with our FortiGate firewall using ICAP profile and require information regarding SSL inspection, specifically whether deep SSL inspection is necessary for this integration. As deep inspection enables the firewall to decrypt, inspect, and re-encrypt encrypted traffic by acting as an intermediary, which requires distributing FortiGate’s CA certificate to all endpoints to avoid certificate warnings. Could you please confirm if deep SSL deep inspection is mandatory for Forcepoint DLP integration with FortiGate?   

Hello! Our fortianalyzer stopped displaying logs 2 days ago. I am using fortigate with version 7.0.13 build0566 and fortianalyzer with version 7.6.3.From the fortigate graphical interface I can successfully run a connection test with fortianalyzer. However, through the CLI command "execute log fortianalyzer test-connectivity" I see the output "Log: Tx & Rx (log not received)": execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FAZ-MINUANO FortiAnalyzer Adom Name: FortiGate Device ID: FGT40FTK21099EV4 Registration: registered Connection: allow Adom Disk Space (Used/Allocated): 0B/Unlimited Analytics Usage (Used/Allocated): 0B/Unlimited Analytics Usage (Data Policy Days Actual/Configured): 0/0 Days Archive Usage (Used/Allocated): 0B/Unlimited Archive Usage (Data Policy Days Actual/Configured): 0/0 Days Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx Certificate of Fortianalyzer valid and ser

Hi, Would like to know if I can backup a FortiGate device through FortiManager?

Hello everyone, we use a FortiMail VM02 with version 7.2.5. I would like to set up a "Content Profil" for attachments that only allows selected (explicitly defined) "File Types" and "File Extensions" to pass through.All other "File Types" and "File Extensions" should be removed from emails. (and insert some disclaimer, send notification, ...) I've set up "File Filters" for the allowed "File Types" and "File Extensions".In addition, I set up a "File Filter" "all_other_attachments" with “File Type” and “File Extension” “*.*”. But no matter how I combine these "File Filters" in a "Content Profile" ("Attachment Scan Rule" operator "Is" or "Is Not" and regardless of the order) all attachments are always removed from emails.The log always says "File name: testpicture.PNG, detected by Content Filter, attachment scan rule: all_other_attachments". Can anyone give me a tip on how I can implement this allowlist?How do you manage email attachment restrictions? Best re