Solved

Hi,Im trying to obtain firmware for my FortiWeb WAF Azure and AWS VM, which is on a PAYG license.The FortiWeb is registered in FortiCloud and shows as one of my assets.When I go to Firmware Download section and select FortiWeb as my product, I get a message indicating that I do not have a contract for this product?Opened a ticket with Support and first they said, with a PAYG license I can download firmware from Azure/AWS market place, with a link directing to the page when you want to purchase and deploy a FortiWeb VM. Not the actual firmware to upgrade my current FortiWeb.After pointing this out to, support came back and said I need to go to VM images, select my product and download the image, but when I follow those steps I see that these images are for New deployments and not for firmware upgrades.Can someone please indicate where I need to go to download my firmware, and is it possible that there might be some sort of registration issue with my FortiWeb? It does show that its licen

We have a FortiClient VPN access to several customers. I try to update the FortiClient version on my machine by downloading a new version from https://www.fortinet.com/support/product-downloads#vpn (download "FortiClient VPN-only" for Windows).This does not work: a form is shown where I enter my contact data and click "Download". The button changes to "Submitting...", and after some time it reverts to "Download" again, without any download coming up.  Does anybody have an idea on how to get new FortClient versions? To my understanding, this component is free to download? Best regards Wolfgang

Please explain this setting:

The goal is to cater for two types of user accounts which require VPN access; internal staff accounts added to a dynamic group and member accounts used by third-party users which are manually assigned to a group as required.  My question is whether it is possible to set multiple Object Ids in the below config on the FortiGate corresponding to multiple Groups assigned to the FortiGate Enterprise App in Entra. Any alternative suggestions for how this scenario can be handled are welcome. 

Hello everyone, in the config wizard I would like to know if the "domain" field has to be a real domain as in the prod domain or do I have to make a subdomain for FortiNAC and config it in my DNS server ? BR,

Hello colleagues! Got confused with a simple case with IPsec on the first view. The situation:We have a 3rd party partner who is not smart enough unfortunately. We have to establish an IPsec tunnel via 2 different link , but with policy base only(don't ask why). The partner has the only single IP for IPsec tunnels where I have to connect , the route for this IP I receive from BGP from both "outside" links (with \30 link's subnets) , one as a main and another as a backup. We have a subnet on a vlan-interface that we announce into the BGP and we have to establish the IPsec Phase1 with the source IP from the subnet. So the problem is that the subnet that we have to use as IPsec source is different from the Outside's interfaces. In my opinion in theory it's possible, looks like a simple routing , an IP packet from my FG will be NAT-ed (SrcNat) with one of IP's from the announced subnet , there is a route toward the partner's IP, the backward packet will get the outside interface with the s

Hello Fortinet Community,I am facing an unexpected behavior when publishing a web application using a Virtual Server.ContextWeb application hosted on an internal server listening on port 80Virtual Server configured with:External port: 3000Mapped to internal port: 80Purpose: publish the application on a non-standard external port (3000) while the backend remains on port 80Observed behaviorFirewall policy allows only port 3000Accessing https://webapp.com:3000 → Does NOT workAccessing https://webapp.com:80 → Does NOT workFirewall policy allows only port 80Accessing https://webapp.com:3000 → Works correctlyAccessing https://webapp.com:80 → Does NOT work What I am trying to understandAt which stage does FortiGate evaluate the firewall policy in relation to:DNAT / Virtual Server port translationWhy the policy seems to match on the post-NAT (internal) service/portWhether this behavior is:By designSpecific to Virtual ServersDifferent from standard VIPs or central NAT QuestionI would

I've been trying to install the SSL VPN Only forticlient install on an employee's workstation and the install process gets almost all the way finished but then errors out and rolls back. There is no actual error message listed in the installer. I can see the MSIexec logs in windows starting the install and ending it but there are no errors there either. There also doesn't appear to be a log file created locally by the installer in the software or app data directories. I've tried multiple versions of the offline install from fortinet's downloads page as well as the default auto installer. I noticed that after a failed install the registry creates a "Fortinet>Volatile" entry under local computer with a "requires reboot" value of 1 but even after a reboot the install just fails again. Removing the Fortinet registry value does not change the outcome either. As a work around I installed the full forticlient with only the required install components and the SSL VPN. This install

Hello, I have encountered strange issue on our FortiClient configuration. We have deployed FortiClient via EMS Cloud to 500+ stations and for some time everything runned smoothly but suddenly lot of stations started to disconnect with this error even tho the configuration on both sides remained unchanged. The VPN connection is re-established randomly. For the specific error - VpnParameterConfigError i did not find any community posts, I reviewed configuration on both sides as the error is pretty explanatory but did not find any misconfigurations. As this is currently production environment, i cannot really troubleshoot this issue and make lot of changes on the current VPN configuration at the moment and need to wait for a weekend. If anyone encountered this beforehand please shine some light on this issue. Thank you Below I attach screenshot from the FortiClient (its in Slovak as the customer has it set this way) Rougly translates to: Last r

Hi, We have a FortiExtender 511G that we want to connect to a private 5G solution. To connect to this private 5G service it is mandatory to set the modem to 5G only mode. I have not found this option in the GUI or CLI. I only found a post on this forum how to do this for the FortiExtender 511F ( https://community.fortinet.com/t5/FortiExtender/Technical-Tip-Switching-Carrier-Service-Mode-to-FortiExtender/ta-p/336389 ). However the used AT-commands are not recognized by the modem of the 511G.  The FortiExtender is in LAN extension mode and runs firmware v7.6.4 and the modem runs FEM_20_EM9291-24-01-01-NAM. So is it possible to set the 511G's modem to 5G only? And how do I do this?Thanks in advance.

Hey Team, I am facing an issue with FortiGate VM evaluation licensing and would appreciate guidance. Scenario: I initially deployed a FortiGate VM for lab/testing purposes.At first, I was able to see and apply the Evaluation license.Later, after deleting the instance and re-deploying (also tried changing instance type from t2/t3), the Evaluation license option is no longer available.Now the firewall only shows options for Full License upload or FortiFlex token.I also tried uploading the previously downloaded trial license under Full License, but it did not work.Environment details:Platform: AWS (EC2)Usage: Lab / learning purposeInstance types tried: t2.small / t3.small / t3.mediumRegion: N. VirginiaThis is not a production setup. 

Hi, We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection? I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some o

On Fortigate 90G faceplate shared ports wan1, wan2, sfp1, sfp2) shows grayed out.There physical connectivities on sfp1, sfp2 and it working fine. We are able to do the configuration  for those interfaces but the only concern is it shows grayed out on gui faceplate.Please guide..

Anybody else having issues with getting the 'free' ipsec client to work?I've been messing around with this for a couple of weeks and so far, with 5 different machines and 4 different clients - only 1 machine will connect.I've already engaged support but since this is the 'free' client - they have exhausted all that they can help with.I don't need all the 'add-on' stuff with the vpn, just need it to connect - stay stable and provide some basic routing (thru it).What happens is that i install, configure, connect - and it hangs.  nothing until the connection drops off a few minutes later. packet captures seem to indicate that 'all' the tcp packets aren't getting sent/received and therefor phase 1 never completed. 

I am getting vulnerability warnings from NIST, which indicate I need to be using version 7.4.4.x of FortiClient, but your website does not provide beyond version 7.4.3.1761 for the VPN only version. Please provide an update for the VPN only version. https://nvd.nist.gov/vuln/detail/CVE-2025-31365

Hi,Has anyone encountered when executing a command below to get this output?Model FSW 124F-FPOE most of them and managed via FortiLink. diagnose switch physical-ports summaryPortname Status Tpid Vlan Duplex Speed Flags Discard__________ ______ ____ ____ ______ _____ ____________ _________prt_switch_phyport_summary: unable to get port1(#1) statusprt_switch_phyport_summary: unable to get port2(#2) statusprt_switch_phyport_summary: unable to get port3(#3) statusprt_switch_phyport_summary: unable to get port4(#4) statusprt_switch_phyport_summary: unable to get port5(#5) statusprt_switch_phyport_summary: unable to get port6(#6) statusprt_switch_phyport_summary: unable to get port7(#7) statusprt_switch_phyport_summary: unable to get port8(#8) statusprt_switch_phyport_summary: unable to get port9(#9) statusprt_switch_phyport_summary: unable to get port10(#10) statusprt_switch_phyport_summary: unable to get port11(#11) statusprt_switch_phyport_summary: unable to get port12(#12) statusprt_

Hi,For some reason, everyone using edge at my company is suddenly getting nonstop notification from FortiClient System Tray Controller saying: "Microsoft Edge" extension policy anomaly detected, please restart the browser.This happens anytime you try to open any websites and they just get stuck in loading until it fails. I restarted the browser and I even shut all Edge operations in task manager, nothing works. I cant seem to find any solutions online so was wondering if anyone was familiar with this issue and if they managed to resolve. Thanks!

Hello All, We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used. Thanks in advance

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.

Na madrugada de sábado (24/01), foi executada a atualização do firmware do Firewall Fortigate 100F da versão 7.4.9 para a 7.4.10.Após a conclusão do processo, identificou-se a interrupção de tráfego entre as demais Unidades e o Administrativo. O problema impactou diretamente o acesso aos sistemas internos hospedados na sede.Observação: Não foram identificados logs de bloqueio ou alterações de configuração que justificassem a queda de conectividade na nova versão 7.4.10, seguindo recomendação técnica, foi realizado o rollback para a versão 7.4.9. Após o reboot do dispositivo, a conectividade foi restabelecida e todos os sistemas voltaram à operação normal.

Hello everyone. Our company wants to provide an IP list through an internal webserver which we should import in our FortiManager to be used in Firewall Rules. (like http://10.10.10.10/list1.txt, .csv etc.)The use case is they want to manage a list which we will block on our internet facing firewall.Is there a way to do this? We have the 7.4.6 firmware installed currently.

Hi,I am trying to register for the FCP_FGT_AD-7.6 (FortiGate Administrator) exam via Pearson VUE in Japan.The exam language is fixed to Japanese, and I do not see an option to select English, while some other Fortinet exams appear in English by default.Could someone please confirm whether this exam is Japanese-only in Japan, or if there is any supported way to take it in English ? Thank you.    

Hello, we currently run FortiMail VM01 on‑prem and have purchased 110 FortiMail Cloud licenses.What’s the recommended way to transition—can existing settings, policies, and configurations be migrated to the cloud?Or does everything need to be rebuilt manually from scratch in FortiMail Cloud?Looking for best practices, steps, or guidance from anyone who has done this migration.

Hello.Within our proxmox environment we have several vlans.  The proxmox has several bonds with some of the interfaces configured as active/failover - such as the mgmt, and a separate bond for the vlan traffic. As it happens one of the vlans within the proxmox environment has the same vlan number as the switch.  By this I mean, the interface on bond0 is configured as the same vlan # that the servers have.  Obsivesily, the servers are 'tagged' within the proxmox environment to 'tag' traffic to/from other devices on that network.Here's a breakdown -Proxmox environment - native vlan is 10.  with an address of 10.0.1.xOn the switch network, which I'd like to configure the 'trunk', the default vlan is 10.The proxmox manages traffic in/out off of the 2nd bond or interfaces, but as the servers are also 'set' to use vlan 10, how will this work? It's almost like a 'nested' configuration with both interfaces using the same network - but not so as the proxmox handles