Solved

I have a Fortigate Instance deployed on AWS with 4 ENIs.. instance type c5.xlarge Recently we reduced the license from 4vCPU to 2vCPU and now i am looking to change the instance type accordingly. But as i am using 4ENIs the only viable option i see with 2vCPU is r7i.large .. will it support the fortigate vm or are there any other checks i need to look into ? or a compatibility matrix Thanks

Hello Guys, I downloaded FortiGate Hyper-V version. after installing and activated port1 it. I try to login using Browser Interface it become blink and the URL went to: https://FortiGate IP /prompt/fortigate-setup?viewOnly=1anyone know how to solve this issue.Thanks in advance Mina Greas

Hello everyone,I am currently configuring administrator authentication on a FortiWeb appliance using RADIUS against FortiAuthenticator with FortiToken MFA, and I am experiencing a login loop after the OTP step.EnvironmentFortiWeb: admin authentication via RADIUSFortiAuthenticator: used as RADIUS serverAuthentication source: LDAP / Active DirectoryMFA: FortiToken MobileFortiWeb admin group configured with RADIUS serverLogin flowUser enters username and password on the FortiWeb login page.Authentication proceeds and FortiWeb prompts for Token Code (OTP).OTP is entered.Instead of logging in, FortiWeb redirects back to the login page.Relevant log from FortiAuthenticatorAuthentication Failed Bad TokenDescription: Authentication failed, bad token codeMessage:Remote LDAP administrator authentication with FortiToken failed: invalid tokenThings already verifiedUser exists in AD and can authenticate normally.FortiToken is assigned to the user and active.RADIUS client configured correctly on Fort

Hi Community,I wanted to change the email subject for the manual input email notification. I updated the Title field in the manual input playbook step with the subject as i want, as shown in the image below:    I captured this title field data in the email notification template inside Subject field, as you can see in the image below:    However, the email is still showing the default subject: "A FortiSOAR playbook is requesting your input"as shown in below email screenshot and I would like to understand where this default email subject is coming from and how I can change it.  I would appreciate help on how to change the email subject for the manual input notification.FortiSOAR Version: FortiSOARTM 7.6.2-5507Regards,Ranjeet

hi, we want to add blackhole route on fortigate to save the resource. we have one public subnet for example 192.1.0.0/24.Some IP addresses of this subnet are configured on internal servers behind the internet firewall. static routes are configured for this 2x IP on the firewall.    192.1.0.10 configured on internal server 1   192.1.0.11 configured on internal server 2And some IP addresses of the subnet 192.1.0.0/24 are configured on SNAT and DNAT rules.    192.1.0.101 is used as source NATTED IP for some internal hosts.   192.1.0.201 is used as Destination IP on DNAT rule. Now we want to drop the inbound access to the rest IP addresses of the subnet 192.1.0.0/24 on firewall. We plan to add a blackhole rule on the firewall to save the resource. Will this blackhole routing rule affect SNAT and DNAT? I think it should not affect, but not very sure. Can anyone please help to and advise and confirm? Thanks in advance! &nb

I connected my fabric root FortiGate, which happen to be my edge firewall to the FortiClient EMS Cloud just fine via the fabric connector. My other fabric FortiGates show up in EMS Fabric soon after, so I authorized them there and attempted to finish the authorization at the fabric firewalls. When I click authorize on the fabric connector on the firewall, I am presented with the certificate to accept or deny. I accept and it goes back to the fabric connectivity window for EMS Cloud on the FortiGate in question, yet never "connects"... it's still in that pending state of showing the EMS Cloud information coming from my root, yet will not connect successfully like my fabric root edge firewall did.

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).I noticed that:If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.So, it looks like remote admin authentication via SSH is only triggered when the admin has&nb

I looking a way to fix the CVE-2025-31514 then i got this article PSIRT | FortiGuard Labs.Can i know what mean of 'Migrate to a fixed release'?  My FGT running on version 7.4.11 

Hi,I'm new to Fortipam and I want to understand if there is a desktop application of Fortipam for the IT personal that connects to the fortipam and where you can create and use your secrets. Thanks in advance

HiI need to migrate all IPSec Tunnel to one zone to create a single policy.Now i can't migrate tunnel because "Integrate Interface" is gray and it can't select it. 

Here is a cleaner and more professional version for your post:Hello everyone,I’m currently working with a FortiExtender (FEX) using LTE connectivity, and I’m facing an issue related to public IP changes.Every time the LTE provider assigns a new IP address, the connection drops completely. The only way to restore connectivity is by rebooting the FortiExtender.Has anyone experienced a similar behavior?I would like to understand:Is this expected behavior with LTE dynamic IP?Is there any configuration (keepalive, DPD, monitoring, etc.) that can prevent losing connectivity after an IP change?Would enabling specific SD-WAN or tunnel monitoring settings help in this case?Any recommendations or best practices would be greatly appreciated.Thanks in advance!

If i have ipsec tunnel for site to site connection listen on port1, then on same port i confgire ipsec tunnel for remote access then is there any miss connection?I mean is there any wrong connection when Remote Access VPN want connect then the connection will passing thru the site to site tunnel and vice versa?

Hi,I tested a FortiExtender LAN Extension on an FGVM-02. After removing the Extender configuration, only the tunnel interface remains, which cannot be deleted. The error message is: (phase2-interface) # delete fext-ipsec-***Can not delete a static table entryCommand fail. Return code -61 Does anyone have an idea how I can remove it? Thanks. 

Hey guysI already know that we can update IPS Engine manually.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-manually-upgrade-the-IPS-Engine/ta-p/194513https://community.fortinet.com/t5/FortiGate/Technical-Tip-Upgrading-IPS-Engine-on-the-primary-FortiGate-will/ta-p/202345But can we update IPS Engine automatically ? Are there any related document ?

Hi all. A dump question.Can we install the AD connector within the AD server?Cause in the article didn't mention about the connector is not allowed to install with the AD server.It only mention install in the host that can connect to both EMS and AD server but the host spec also not given.    

Hi to all,I would like to disable VPN on my Fortigate. It was configured by the company who installed the firewall but I will not use it. Which command do I have to run because I have asked to the Forticare and they told me to run the following which does not seem to correspond to unable the VPN but the opposite: config vpn ipsec phase1-interface    edit "VPN_Forticlient"        set type dynamic        set interface "wan"        set peertype any        set net-device disable        set mode-cfg enable        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1        set comments "VPN: VPN_Forticlient (Created by VPN wizard)"        set wizard-type dialup-forticlient        set xauthtype auto        set authusrgrp "VPN_Group"        set i

We have several user groups mapped to separate, corresponding SSL-VPN Portals. Each of these portals has Split Tunnel Enabled Based on Policy Destination. Each of these portals also has Routing Address Override with network addresses that match the same "allowed destination" addresses in their corresponding policies. Is Routing Address Override even needed?According to Split Tunnel Enabled Based on Policy Destination, "Only client traffic in which the destination matches the destination of the configured firewall policies will be directed over the SSL-VPN tunnel."So in an example where the Accounting network is 192.168.0.0/24 and a user is in the Accounting Group, which is assigned to the Accounting Policy (that allows access to the 192.168.0.0/24 network); Would I even need any address in the Routing Address Override for the Accounting SSL-VPN Portal?From what I understand, any traffic to 192.168.0.0/24 would go over the SSL-VPN with Split Tunnel Enabled Based on Policy Destinati

Good day,      I'm trying to install a Fortigate 7.6.6 VM for a lab and have this issue      After that I only get a white screen, and enter the trial license window or the device or anything. This is my configuration FortiGate-VM64-KVM (port1) # showconfig system interfaceedit "port1"set vdom "root"set mode dhcpset distance 1set allowaccess ping https ssh httpset type physicalset snmp-index 1nextend FortiGate-VM64-KVM (dns) # showconfig system dnsset primary 8.8.8.8set secondary 8.8.4.4end FortiGate-VM64-KVM (1) # getseq-num : 1status : enabledst : 0.0.0.0 0.0.0.0gateway : 10.16.13.20preferred-source : 0.0.0.0distance : 1weight : 0priority : 1device : port1 This is what I get when I do the  diagnose debug enable diagnose debug application update -1 execute update-now FortiGate-VM64-KVM # execute update-nowupd_daemon[1981]-Received update request from pid=2518FortiGate-VM64-KVM # do_setup[349]-Starting SETUPupd_

Hello, I have a headquarters site with a FortiGate firewall.We also have multiple secondary sites across the country. Each remote site normally uses its primary ISP connection ( through MPLS) to access the corporate network. Our goal is the following:If a remote site loses its primary ISP link,We plug in a Starlink connection at that site,The site should automatically establish an IPsec tunnel (IKEv2) to the headquarters,All traffic (0.0.0.0/0) should be routed through the tunnel to HQ (full tunnel), so the site can continue to access the corporate network and internet through HQ.The tunnel requirements:IPsec with IKEv2Full tunnelStarlink uses dynamic public IPMy question:Is it possible to configure a single Phase 1 and Phase 2 configuration on the HQ FortiGate that can accept connections from all remote sites (with dynamic IP addresses), or do I need to create one Phase1/Phase2 pair per remote site ? What I find difficult to accept from a design perspective is the idea

 EnvironmentPlatform: FortiGate (hardware appliance)HA mode: Active / PassiveFortiOS current version: 7.4.8Target version: 7.4.10HA priorities:Unit A (Master): priority 200Unit B (Slave): priority 100Expected upgrade behavior (normal case)Based on Fortinet documentation and past experience, the expected HA upgrade sequence is:Firmware upgrade starts on the slave unit (B).Slave reboots and temporarily disconnects from HA.Cluster fails over to the upgraded slave.Firmware upgrade is then applied to the former master (A) in background.Final failback occurs according to HA priority (unit A becomes master again).Observed behavior / Issue descriptionDuring the upgrade from 7.4.8 to 7.4.10 (firmware uploaded via GUI using .out file downloaded from fortinet official source):The upgrade process took more than 20 minutes, significantly longer than usual.HA became disconnected, and unit B (slave) was no longer visible from the cluster GUI.Accessing unit B directly via Console & Management

Our district has started an esports program and we're having difficulties with Nintendo Switches on our network. NAT Type is B. UDP ports are not blocked. When hosting a game on a switch on our network, those outside the network cannot connect. They get a NAT Transversal error. What settings do I need to have on the FortiGate to allow esports traffic for the Nintendo Switches?

When we use IPSec for remote access with Split tunnel enabled, can we make the fortiget to not set dns in the client?Now when the forticlient connected to the VPN then the client can't access the local domain.

Hi all, We are building an automated pipeline to continuously collect SSL-VPN and IPSec debug logs from our FortiGate 90G devices, using:diagnose debug application sslvpn -1diagnose debug application fnbamd 8diagnose debug enable We specifically need the raw debug output (e.g. "SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384") which is not present in structured logs and therefore not available via FortiAnalyzer or syslog. We have already gone through the following KB articles:• Continuous debug monitoring with Bash and Crontab:https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Continuous-debug-monitoring-with-Bash-and-Crontab/ta-p/305973 • FortiGate remote monitoring and logging CLI command output into a file:https://community.fortinet.com/t5/FortiGate/Configuration-Example-FortiGate-remote-monitoring-and-logging/ta-p/189892 Based on our research, it appears that the debug subsystem and the structured logging pipeline are architecturally separate, th

Can two FortiGate clusters (each configured in Active-Passive HA with 2 units) be interconnected through a Core switch?

FortiGate - 7.6.3FortiClient - 7.2.9 (Windows and Mac) I have been working with Support for weeks now with no success so hoping I can get help here.Fortigate config:config vpn ipsec phase1-interfaceedit "OpsIPSecVPN"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal des-sha512 aes256-sha512set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"set dhgrp 14set wizard-type dialup-forticlientset nattraversal disableset network-overlay enableset network-id 0set transport tcpset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsIPSecVPN_split"set ipv4-name "VPN_PCI_Operations_us2"set save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret ENC *** FortiClient config:<connection><name>us2-LOACAL2</name><type>manual</type><ike_settings><keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_c