Solved

Hello Team, i have two FGT-400F.when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.HA status seems ok from cli but secondary appears out-of-sync HA Health Status: OKModel: FortiGate-400FMode: HA A-PGroup: 0Debug: 0Cluster Uptime: 0 days 0:43:2Cluster state change time: 2025-05-05 15:12:06Primary selected using:<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.ses_pickup: enable, ses_pickup_delay=disableoverride: disableConfiguration Status:FG4H0FTXXXXXXX (updated 1 seconds ago): in-syncFG4H0FTYYYYYYY (updated 2 seconds ago): out-of-syncSystem Usage stats:FG4H0FTXXXXXXX (updated 1 seconds ago):sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%FG4H0FTYYYYYYY (updated 2 seconds ago):sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%HBDEV stats:FG4H0FTXXXXXXX (updated 1 seco

I have a Fortigate 40F. I have been trying for weeks to get DNS Filtering working. The basic setup is simple. When a user goes to a restricted site they do get redirected but the Block Page will not show up as there is a certificate error. (This is understandable since the Fortigate cert does not have the same name as the page the person is trying to go to). For Web Filtering the solution was to download, install and trust the default Fortigate cert. This works for Web Filtering but it does not work for DNS Filtering.I have Googled endlessly with no solution. I have a support case open with Fortinet. So far, they have not been able to provide a solution.If anyone can help with this, it would be much appreciated.

hi Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used? If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.The final goal is to make all connections to a given destination IP on the Internet always go out through the WAN1 interface unless the WAN1 interface has lost communication with the Internet, in which case WAN2 can be used.

Hi every one.We use in my company the ForticlientVPN-only software. We use it to access the VPN of our customer. (link https://links.fortinet.com/forticlient/win/vpnagent)On 2 HP laptops, the installation of these software crashes, avec that sequence :- Installator downloads package -> OK- Installator extracts package -> OK- Then a window opens 0.5 sec and close immediately- Then nothing. The installation of the Forticlient licenced software works fine on theses two laptop. Do you have any clue ? Thank you in advance

I am trying to generate a CSR on the Fortigate and getting the message "etc/cert/local/root_"certname".key: Read-only file system".I have full super-admin permissions on the Fortigate. Has anyone seen this before?

I installed Forticlient VPN 7.4.3 without troubles. The connection looks fine and I get access to the intranet of my company when I use the exact IP number, but I cannot use names. I get the error DNS_PROBE_FINISHED_NXDOMAIN.I checked the nslookup resolves the webnames.I checked that quetying resolvectl does not work, but applying the solution posted in https://community.fortinet.com/t5/Support-Forum/Ubuntu-24-04-Forticlient-VPN-installation-w-DNS-resolution-fix/m-p/313257, makes it work.Even though, I still get DNS_PROBE_FINISHED_NXDOMAIN in the navigator. I am absolutely lost right now.Any idea of what may be going on? Thank you!

HelloRecently there was a post from Fortinet PSIRT about the symlink trick:https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activityIs there any chance to get information how to find indicators of compromise (IOC)?I mean I can update to 7.2.11 (I am currently on 7.2.10) but the used CVE's are older and I updated the fortigate before the publication of these CVE's, so there is a small chance to be compromised.I just want to check if the fortigate is compromised, if yes, i will reinstall it. If no, I just update to 7.2.11 and have a happy life :) Any ideas?

Hi, I am using Multi vdom setup on my Firewall, on the 2nd VDOM I have noticed when I have created the 2nd virtual interface vlan on the new VDOM on the same physical  internal ports as the 1st vdom, I notice the physical ports are greyed out on the 2nd vdom, but green on the 1st vdom. These new virtual interfaces are assigned to the new vdom fine but why are the physical ports greyed out on the 2nd vdom? I manged to establish the BGP neighbors in these new vlan interfaces fine. If I view the Global config on these physical interfaces I see the 1st vdom is configured under the physical interfaces, you cannot assign multi vdoms in the global vdom. 

Hi, I am new in both eve-ng and fortigate. sorry for my naive question. I create my first lab with fortigate firewall using trial license, everything work fine. then in my second fortigate lab, serial of fortigate node change and trial license is invalid and I cannot register it gain using my account.  Is there a way to sustain the fortigate image with its serial number in different eve-ng lab ?  

Hello,We deployed an instance of EMS to a Linux environment and can not access to GUI with the admin username and blank password.Access to EMS is only possible through ESXi environment by using ems username.has anyone encountered this problem? Vasilis

I have new FortiGate 71g, but it seems there is no new firmware version available for this. The latest i can find is 7.2.8, does anyone know about this? 

I just finished creating a large number of site-to-site IPsec tunnels (approx. 170) using the CLI, but most of them don't seem to be functioning. Only six or eight of them have ever come up and connected.  I can see all of them in the gui, and in a backup of the configuration, so they definitely created.   At first, I thought it was an issue with the way the PSK had imported from my script, so I went through a number of them and re-entered and saved the PSK from the GUI to ensure that it encrypted correctly, but that didn't seem to remedy the issue. If I go into the CLI and run 'diagnose vpn ike gateway' I see entries for the 6 or 8 that work, but not for the rest.  If I run the command for a specific tunnel name, I don't get any information back at all. Something I have noticed in the IPsec dashboard that may or may not be significant, the remote gateway IP addresses are not updating.  All of these tunnels use dynamic DNS hostnames for their rem

Hi, I'm using Fortigate-30E running FortiOS v6.2.16 build1392 (GA). Not sure when it happened, but I can't create geography address anymore. It worked in the past.As can be seen in the picture, the country/region field is empty with no entries.  Please advise,Thanks, Ofir

I want to create a dataset on my Fortianalyzer 7.4.6 that shows the following data:1. Username2. Group associated with the user3. User type (Whether local or LDAP)4. User status (Whether the user is enabled or disabled)5. Authentication (If it's by email, bring the email associated with that account, or if it's by Fortitoken, bring the token associated with the account)Last VPN connection I've tried Multiple Script, but it doesn't show any information. Does anyone have a script that can help me generate the requested data? Or how can I get this information from my Fortigate? Sorry for my English.

Hello Fortinet Community,I have a setup with two WAN connections that are part of an SD-WAN virtual interface. On each of these WAN links, I’ve configured a site-to-site IPsec VPN tunnel to a remote location. The phase 1 and phase 2 settings for both tunnels are identical, except for the WAN interface used. My goal is to achieve redundancy between these two IPsec tunnels—so that if the primary tunnel goes down, traffic automatically fails over to the secondary tunnel. Could anyone guide me on how to properly configure this redundancy within the SD-WAN framework? Should I use performance SLAs, specific SD-WAN rules, or routing strategies?  Any detailed guidance or configuration examples would be greatly appreciated.  Thanks in advance!

Is there an option to add per device mapping for VLANs in FortiSwitch Manager ? I do not want to add it one by one using GUI.

Hello, I'm running FortiClient EMS 7.4.3 with a FG-120G on version 7.4.7. I've configured some ZTNA access on the FortiGate, and it works like a charm. Now, I'm trying to push the ZTNA connection through EMS. The great thing is, my ZTNA applications are automatically detected since my FortiGate and EMS are connected via a connector. My problem is: when I try to create an application, I can't see those gateways. And of course, if I try to create a new gateway with the same IP, I can't.  In the ZTNA destination profile, I see both of my auto-detected applications, but they're not being pushed to the EMS client. So, I'm a little lost here — the "Web Proxy Rules" are not being pushed to the client, and I can't create a rule because I can't create an application, since I don't see the gateway. I was able to create an application with a fake gateway, download the XML, modify the gateway, and re-upload it. But I'm pretty sure it shouldn't be that c

i have fortigate 40F and i'm trying to access the firewall on web browser but it's not opened ! i connect the firewall through fortigate port 1 to computer by ethernet, the ping was okay but its not opened the log in page ! please help me to log in the firewall. Thank you GG FortiGate #support #all 

HiI have a pair of Fortigate 200F running 7.2.3, when i try to configure log disk setting, the option doesnt seem to be availablePlease refer to the screenshots below

Hello Fortinet Community,I’ve configured two identical IPsec remote access VPNs on my FortiGate—each mapped to a different WAN interface for redundancy purposes. On FortiClient, I’ve added both VPN gateways. The issue I'm facing is that when I disable WAN1, FortiClient does not automatically failover to the second gateway. Instead, I have to manually reconnect by clicking "Connect" to establish a session with the secondary gateway. I'd like to know is it possible  to automate this failover process, so users experience minimal disruption? Is it possible to achieve automatic remote access VPN failover in FortiClient without using EMS?Thank you! 

hiI have a server configured as a vip in my fortigate to be accesses from internet. I want to block it's admin page. (my.domain.com/admin) . I tried the policy with deep packet and ssl inspection along with creating a webfilter and blocked *\admin* but still admin page reachable from internet. how can i block admin page?

Hello, everyone. I have a question. The client ZTNA has 1,500 terminals, and each terminal may have two USB mobile devices. The client's requirement is to release them in a whitelist manner. However, with so many mobile terminals, the workload is a bit large. For the mice of the same brand purchased in the same batch, information such as USB Type, Vendor ID, Product ID, and Firmware Revision is still different.I have several questions:Question 1: Is there any way to avoid manual entry one by one? The workload is too large. Question 2: Can the whitelist be released based on a certain brand? For example, HP and Dell mice, Panasonic USB drives.Question 3: For the control of such a large - number of mobile external USB devices, are there any other good suggestions?References:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-properly-identify-USB-devices-to-configure/ta-p/339955                          

Hello, We recently started migrating our SSL-VPN to IPSec. Something we just noticed is that the IPSec setup is not fully compatible for iOS version of FortiClientVPN application. FC VPN at its latest version for iOS devices supports IKEv1 only on Main Mode (we went with aggressive mode on our initial config).For remote users authentication we’re using a FortiAuth server that communicates with the firewall using RADIUS and to the AD Servers using LDAP. FortiAuth checks if the user exists on AD and then sends an authentication token to the user for 2FA. We started noticing that the last part with the authentication is problematic for FC v7.4.6 on iOS devices and after investigation with Fortinet they informed us that FC VPN on iOS rejects the authentication packets and drops the tunnel afterwards. For testing purposes, we disabled the 2FA option within the ForitAuth for the spesific user we login and the tunnel was able to connect succesfully without authentication j

Hi, We have two firewalls located in different locations: Firewall A and Firewall B. Both setups include an L3 device positioned between the LAN and the firewall. In Firewall A, the relevant subnet appears as directly connected, whereas in Firewall B, the subnet is marked as statically connected. This indicates that in the Firewall B setup, the switch acts as the gateway, causing the firewall to receive the MAC address of the L3 device instead of the end-user device. However, in the Firewall A network, even with the L3 setup, the firewall acts as the gateway for the subnet, enabling it to detect actual client MAC addresses and enforce MAC-based policies. Consequently, MAC-based policies do not function in the Firewall B setup because the L3 device serves as the gateway. In contrast, these policies work in the Firewall A setup, where the firewall directly receives the MAC addresses of the client devices.  FortiGate 

I generated a CSR on one of my Fortigate firewalls that contained over 10 SAN's entries, the certificate was signed by my internal company CA, I then imported the PEM into the Fortigate firewall successfully to use for HTTPS access, then by mistake I deleted the Certificate off the firewall instead of downloading the cert! My signed PEM file doesn't have a private key, I have a PCKS#7 cert, der and cer from my PKI team. But I do not have the private key anymore is my guess after deleting my imported signed Cert on the Fortigate. On another SAN Firewall where I need to install I import any of these signed cert formats, error is "duplicate mismatch" I gather because the signed cert doesn't have the private key and I should be downloading the imported cert from the Fortigate that imported the signed cert where the CSR was generated to the other Firewalls! Any there any way I can install these signed certs on my SANs Firewalls or do I need to generate another CSR again?&nbsp