Solved

I have 2 Fortigate 201F set up with a tunnel and I'm seeing some strange traffic (mostly missing) from site A to site B.  Site A has 2 active WAN interfaces with the 2nd interface static DF route at a higher priority. My tunnel is assigned to the interface with the lower routing priority.  I'm not able to ping devices on Site B, yet I'm able to access the internal web interface of the Fortigate of Site B.Site B only has one WAN interface and I'm able to ping from devices within Site B to devices on Site A, but I'm not able to connect to NTP, DNS or LDAP from the Fortigate B to Site A.Both tunnels were created as custom pointing to the IP address of the outside interface of the opposite.  I have phase 2 selectors set for each of the VLANs from Site A and all show active.  Both sites are set with incoming/outgoing policies using the named tunnel and allowing ALL traffic and stated VLANs.Both sites have static routes set to use the tunnel interface for traffic.&nb

Hello team kindly helpi am configuring site-to-site IPSEC on fortimanager to push on fortigate but the i am confused where to confgure the IPsec?i have tried to my best on all platform1. on VPN Manager2. on IPsec Template3. on the device phase1 and phase 2 but after creating the vpn on all the 3 i can not see the VPN as the interface so that i can use on policy?PLASE HELP

Hello Community I am attempting to use the FortiOS API to apply a license. The device is a FortiWifi 80F with Firmware 7.2.6.I am attempting to apply the Advanced Malware Protection Free Trial, for testing purposes.From help with the Fortinet Developer Network I have seen this command:  curl -X 'POST' \ 'https://192.168.20.1/api/v2/monitor/registration/forticare/add-license?access_token=xp40rkkhqcbfyr8Nq96H9G7H43q0f4' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "registration_code": "STRING" }'  I am not sure what the registration_code value should be. I visited support.fortinet.com to gather the license key I wish to apply. It downloads as a .lic file. There is text in there but nothing matches the registration code. I have tried to insert the contract number as the string but this did not work.Where can I find the registration code?Am I using the wrong endpoint?Appreciate it

Hello FortiSIEM Community,I hope this message finds you well. I am planning to upgrade my FortiSIEMinstance from version 6.7.1 and would appreciate any guidance on the recommended upgrade path to the latest stable versionSpecifically, I am looking for:Recommended Upgrade Path: The sequence of versions to upgrade through from 6.7.1 to the latest recommended version.I have reviewed the available upgrade guides but could not find specific recommendations for upgrading from version 6.7.1. Any insights or experiences shared would be greatly appreciated. Thank you in advance for your assistance and support. Your expertise and experiences are invaluable to me.

I am currently preparing for the Fortinet Certified Professional (FCP) certification in Network Security. As part of my hands-on learning and practical lab setup, I have successfully installed the FortiGate VM on my local environment.However i am finding it hard to access the GUI of the FortiGate VM due to absence of a trial license.i have tried this commands execute vm-license-options account-id xxxx@fortinet.comexecute vm-license-options account-password xxxxxxxexecute vm-licenseIt showed the error "Requesting Forticare Trial license, proxy:(null)failed to download VM license"I would like to kindly request help in acquiring trial license for the FortiGate VM. This is meant exclusively for my study and practice and learning experience. Community help will be very much appreciated :'(

Hello,I am starting to learn with FortiManager and when initially importing an existing FortiGate I get the following error: Retriving configuration file from FGT... Configuration file import succeeded. Reloading configuration file... Error: Configuration reload error. --------------------------------- Failure info: SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); >command(set firewall local-in-policy.1:intf SD-WAN-Inet) detail(datasr

Hi Fortinet Community, We're facing an issue where traffic shaping on our FortiGate device doesn't seem to be working as expected. Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows current-bandwidth=0(kbps) when monitoring shaping statistics. What We’ve Verified So Far:1. Class IDs are configured correctly.2. Traffic Shaping Profile is set up and active.3. Relevant Traffic Shaping Policy is in place.4. Interface outbound bandwidth is configured.5. Traffic Shaping Profile is applied to the correct interface.6. Ran "diagnose netlink interface list" command No matter what we try, shaping stats show zero usage:  Any help or insights would be greatly appreciated.Thanks in advance!

Hello. We are currently using FortiSwitches with FortiLink.In version 7.2.x, I understand that changing the FortiSwitch name does not affect active sessions. Recently, we upgraded all our devices (gate, switch, AP) to 7.4.x.We have about 20 switches in use.However, when we change a switch name from the gate, it appears that some other switches temporarily disconnect and reconnect. It also seems that active sessions are interrupted.Based on my research, it seems that when a managed switch is renamed, it is deauthorized and then rejoined, which causes all sessions to be dropped. As the switch reconnects, STP path recalculation occurs, so session drops or other switches disconnecting may be observed. Is this understanding correct?I referred to the following URI for this information:community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-change-managed-FortiSwitch-name-after/ta-p/280009docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/59264/defining-names-for-managed-switche

Is it possible to configure a time-based administrator user access in FortiGate?For example: an administrative user must be able to login the firewall device from 9 am to 11 am. Beyond 11 am, the login access should be disabled 

Hello community, I am new to FortiSIEM, I want to build a rule to detect new devices in my network, I had the idea to create like a list containing MAC addresses and a rule to check each time if a mac is in that list if not it will trigger an incident and add the mac address to the list (if you are familiar with qradar it is like a reference set), the problem is I don't know if that is applicable also in FortiSIEM or there is another approach to solve the problem??? any idea is appreciated, thank you in advance.

Greetings community!We are now receiving events from the Kaspersky cloud in FortiSIEM, where the format is a "System Log", and it has the following structure, for example:<14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="TEST_SIEM_CONNECTION" etdn="Test Siem Connection"]<14>1 2025-04-15T01:34:49.000Z xxx_hostedinst_xxxxx.openstacklocal 1093|1.0.0.0 - KLAUD_EV_SERVERCONNECT [event@23668 p2="x.x.x.x" p3="2x\\xx" p5="x.x.x.x" p9="::1" et="KLAUD_EV_SERVERCONNECT" etdn="Audit (connection to the Administration Server)" hdn="<xxxx>" hip="x.x.x.x" gn="Managed devices" kscfqdn="xxx.openstacklocal"] User "2xxx" has connected to the Administration Server from "x.x.x.x".As a result, the events are arriving as "Unknow_events", precisely because there is no parser for this type of log. I created a new parser file at this first moment just to test the simplest events, for example: <14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="T

Dear Team,I have a question regarding the use of the Per-IP Shaper feature in traffic shaping on the FortiGate firewall.I configured a traffic shaper with a total shared bandwidth of 20 Mbps (Reverse enabled) for 10 users.Additionally, I applied a Per-IP shaper limit of 4 Mbps.My inquiry is:Does this configuration mean that all 10 users combined can consume up to 40 Mbps (i.e., 4 Mbps per user), or will the total bandwidth still be limited to 20 Mbps regardless of the Per-IP shaper setting?Looking forward to your clarification.

How can I set up an SSL VPN connection on an FGT60F v7.6.2.F? Unfortunately, I can't find this option in this FortiOS version.

Hi Everyone, We just bought a FortiSwitch 448E and when I tried to connect a LAN cable from my laptop to the FortiSwitch's MGNT port, it's giving my LAN port an IP of 169.254.200.221.  The label on the switch says the switch itself is supposed to be 192.168.1.99. I even tried to set my laptop's LAN port to a static IP of 192.168.1.10 and still can't access this switch's GUI. Any assistance is greatly appreciated. Thank you very much,Sonny

FortiClient EMS 7.4.1.1872FortiClient 7.2.9.1033 I have gone in to EMS -> Endpoint Profiles -> ZTNA Destinations.  Edited the ZTNA profile.  Disabled it.  Then re-enabled it and made sure the EYE was looking. This has been pushed out to my machine only.  However, in EMS when I find my endpoint I still see ZTNA enabled (hidden) under Features and my client is not showing the Destinations tab even after waiting minutes. What am I missing here????

Hi all,i have 3 branches with MPLS link to HQ and a DIA access.We have only one ISP that manages two different connections for every branch. The ISP give me the possibility to use the local internet connection as a DIA in every branch. The ISP manages the redundancy of MPLS and internet link between the two different connection they provide. I want to build an IPSEC tunnel over the MPLS for security reasons and use this also to route some particular internet traffic. In case this link goes down I need to route all the internet traffic through the DIA. I always need the possibility to use the DIA for other traffic. Branches does not need to talk each other. This is the network scheme. I only manage fortigates. Routers are managed by the ISP. I've coloured the path that i want to implement.  - Should I use SDWAN to manage that?- Do I need BGP?- How do i manage route changes and nat changes?  

Greetings Im having some problems with my VXLAN over IPSec implementation. Im able to establish connection to the remote site. Telnet, SSH, RDP, VOIP is working fine but Outlook and some HTTP or HTTPS application don't work. I have read many article about this issue and all says that is a MTU or fragmentation issue. But I follow all the recommendation and nothing seems to work. First thing I notice is that VPN interface, Software-switch and vxlan mtu were set to 1370. I manage to bring the VPN and vxlan mtu to 9000 and Software-switch to 1500. My physical interface are all set to max mtu (9216). I also disable the honor-df bit but the maximum mtu that i can pass without fragmentation is 1472. And I think that is fine because 1472 + 28(header overhead) = 1500. But still cant get Outlook to work. I also adjust the mss in the policy to 1432 (1472-40). Also I lower my encryption to 3DES SHA1.My main FW is a 100F and the remote is a 60F. Im runnig 7.2.4. I will appreciate any

Hello, My wireless clients do not receive an IP Address when connecting to a SSID.My Infrastructure is as follow;FortiGate 120G <fortilink> FortiSwitch FS-108F-FPOE <port1> FAP231 On the FortiSwitch port1 the native vlan is 5 and the allowed vlan are 30 and 40 On the FortiGate in the fortilink interface the vlan5 is configured with a subnet 192.168.5.32/27 and a DHCP server to provide management subnet for the FAP231 (this is working).On the fortilink I configured the vlan 30 without any IP or DHCP serverOn the fortilink I configured the vlan 40 with a subnet 192.168.40.0/24 with a DHCP server (192.168.40.10-192.168.40.250).In the SSID section I configured the SSID GUEST_30 in Tunnel mode, with a subnet 192.168.30.0/24 and a DHCP server (192.168.30.10-192.168.30.250) open authentication with a local captive portal, and the vlanid 30.In the SSID section I configured the SSID OFFICE_40 in Tunnel mode, without a subnet or DHCP server, WPA2 Personnal (will go to

Have few Fortigate devices (6.4.12) managed by Fortimanager (7.2.2) and have problem with packet capture in Fortimanager.Packet Capture is grayedAny suggestion why this option is not available in Fortimanager? Only solution is to make packet capture directly on device but then device will "out of sync".

I know Fortinet is doing away with SSL VPN.  I am close to moving off SSL VPN and going to Dialup IPSec VPN.  However, its taking a while due to issues I am working with support on.  At the same time I am trying to get my head around ZTNA and from what I have been reading ZTNA uses SSL VPN too but in a more secure way. Please tell me that ZTNA using SSL VPN is NOT going to be going away any time soon????  I am looking to use ZTNA so users can access internal websites on port 443, SSH to hosts, RDP to hosts.  I know there are different methods for each of these.  I just want to make I am not wasting my time by setting this up with ZTNA.

Hello Team, I'm facing a issue with update reord Step on playbook as mentioned on below log {"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/{"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 failed with status code

Hello,I'm trying to create a new site to site vpn for a customer.Headquarter device is fortigate 80E, branch is fortigate 60F. There is already a site to site ipsec vpn between Head and Branch that is working internet provider's router at both site are not natted so fortigates route using public IP addresses.Now the customer has a new FWA faster connection at the branch and want to use this new for vpn to the HQ, but this connection has a router with firewall that we cannot disable and we cannot use a public IP address for WAN port of the branch fortigate.What are seeing connection from the HQ arriving at the branch on port 500, but when the branch sends out ike packet to HQ the branch fortigate shows error "network unreachble" Following an exaple of packet capture session 2025-04-11 16:40:01.021309 ike 0: comes 2.40.80.242:500->192.168.1.2:500,ifindex=6,vrf=0....2025-04-11 16:40:01.021384 ike 0: IKEv2 exchange=SA_INIT id=cdb44172569bf4cb/0000000000000000 len=5002025-04-11 16:4

been back and forth with forti support with no answer.LDAP with out token works ok .when we have forti token mobile we get the promt but we get regex error. (both for macOS / WINos) any one know how to solve that?  

Hi, I'm sure this is something I'm overlooking but it does have me a little confused. My Fortigates are still in a lab setting set to roll out to production in the coming weeks. Currently I have two Fortigates with private IP on WAN ports 192.168.2.1 Fortigate - > Cisco Switch 192.168.2.2192.168.6.1 Fortigate -> Cisco Switch 192.168.6.2 192.168.2.1 can ping 192.168.6.1192.168.6.1 cannot ping 192.168.2.1 but 192.168.6.2 can ping this IP.  Monitoring the interface on the 192.168.2.1 firewall. When everything other than 192.168.6.1 pings - it sends responses. When 192.168.6.1 pings - it receives the pings but does not reply.  Anything (obivous) I may be overlooking here? I don't see any SD-wan rules or policy routes that would apply... Any suggestions with debug commands I can use would also be appreciated. Thank you,  

Hello,Is there a way to see in Fortigate how much bandwidth (Mbps)is consuming an internal user?I recall before in fortiview it showed this but now (FortiOS 7.4) I can not see it. Only shows traffic in Bytes (MB). thank you.Regards.