Solved

Hello Community, Would appreciate it if someone can point me to the right direction regarding the following. For example lets say there are 2 DoS policy with tcp_syn_flood configured like such (policy ID1 comes before policy ID2) Policy ID 1tcp_syn_flood, threshold 500, Action block Policy ID 2tcp_syn_flood, threshold 50, Action monitor The question isQ1  If policy ID 1 counter registers 400 therefore block was not triggered (below the threshold) will the packets get evaluated by policy ID 2? Regards.

We have a FortiGate + FortiAuthenticator(bought and registered through a Fortigat partner). We are using the free forticlient vpn, but because it is not getting updates we are looking at fortiems. I downloaded the installer and installed it on Ubuntu. On opening EMS I get a hardware ID which I need to connect to FortiCloud and get the 3 free trial licenses. But I don't see any possibility on FortiCloud to do this.Please point me to the right place to do this.

Hello everyone, From what I understand, the recommended method to register company assets is to integrate LDAP and enable the option where endpoints with the Persistent Agent get automatically registered once users authenticate with their AD credentials.So basically, if a user has the agent installed on their laptop and logs in using AD, the device gets automatically registered, please correct me if I’m wrong here.However, I came across information suggesting this method should mainly be used during the initial onboarding phase and be disabled after. My question is:How are new company users/devices automatically registered after that initial onboarding?Is there a best practice to handle ongoing automatic registration for new assets? Thanks in advance.BR,

Hello WiFi adminsIn FAP-231K datasheet, the AP supports 802.3bt (PoE++), 802.3at (PoE+) and 802.3af (standard PoE).What is the exact impact (on all aspects) if using .3at or .3af instead of .3bt?

Please how i check current fortinet version 7.2.12 when will expire and also confirm If i upgrade to new version fortinet firewall 201 will support SSL-VPN?

Hello everyone, I’ve got RADIUS set up for FortiNAC, with FortiGate managing FortiSwitch via FortiLink.What’s the easiest way to apply security policies in bulk to multiple switch ports?  Thanks in advance,BR,

I am new to FortiGate, i am trying to setup evaluation license on a VM for training purpose, im facing a problem in accessing the GUI, i have registered the license once and it was working good and then it did not work on the next day , i have reinstalled the VM and deleted the license from my fortiCloud account, after that i always receive this message when i try to register the license “Error in downloading license : Invalid serial number “   i’ve tried to register it manually on forticloud but not worked, any advise ? 

I tried to get a copy of the macOS offline installer for the Forticlient (VPN only), but the last post leads to a dead link.

If i have ipsec tunnel for site to site connection listen on port1, then on same port i confgire ipsec tunnel for remote access then is there any miss connection?I mean is there any wrong connection when Remote Access VPN want connect then the connection will passing thru the site to site tunnel and vice versa?

Hello FNAC admins,Is it necessary to configure the Winbind part for RADIUS authentication to work properly? Or can RADIUS function normally without integrating Winbind.Thanks in advance,BR, 

Two to three months ago, we migrated to the EMS Forticlient VMware appliance 7.4.4.Today, I tested the upgrade from 7.4.4 to 7.4.5 via the GUI. I tested two times with the same result.See the log below:As you can see, I started the upgrade around 3:54 PM.The upgrade apparently finished about 30 minutes later, 4:24 PM, but I got stuck at 50% and suddenly saw a client and network error.I logged in to the EMS console via a different workstation and received the message that the EMS Ugrade completed!Only after refreshing the browser with the 50% message, did I get the message "EMS upgrade complete!"I don't see any errors in the logs, so I assume the upgrade most likely completed successfully.The (7.4.4) Forticlient on the Windows 11 workstations didn't generate any errors and could also establish an SSL VPN connection. I could also create a FortiClient installer in the EMS console1) Any idea why the upgrade dialog box is stuck at 50%?2) And I'm missing the SSLVPN option in the screenshot b

I’m trying to setup a DNS service on the network interface.  I followed the instructions on this link.  However, it doesn’t resolve anything on the public domain.  It resolves interface domain name.  It looks like Fortigate doesn’t forward the query to system DNS servers.  Anything I need to check?  I used the following link to create DNS service.  Technical Note: DNS resolution not working when DNS Server configured to 'Same as Interface IP' | CommunityBasically, I want a user to use Fortigate interface as a DNS server IP and have Fortigate to resolve internal domain relying on the local dns database but forward to system dns servers to resolve anything outside domain names.

I have 2 Fortigate 600F in a HA Cluster that needs to connect to 1 ONU. Currently, both Fortigate is connected to a L2 switch that is then connected to the ONU. However, when the ONU is rebooted, Fortigate is no longer able to obtain an ip address on the port used to connect to the ONU. If I configure link monitor, would Fortigate be able to obtain ip address after rebooting ONU?What is the recommended network configuration when using HA Cluster with ONU?

I have problems with a policy where I include an application control where I block access to facebook, youtube and others, one of the applications that I allow within the control is whatsapp but it has presented problems since yesterday, the attached files are not They send and the messages are sent several minutes later, the same as when receiving. I have been doing tests and by allowing the known applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday that I present this inconvenient.   My device is a Fortigate 90D The only categories that I have blocked in the control of applications are: Botnet, Game, P2P, Social.Media, Update, Video/Audio and Unknown applications (now in monitor mode for whatsapp work) The other categories are in monitor mode

Have the following config problem:Fortigate 1 (VLAN400) -----EPLAN LINK-----> Fortigate 2 (VLAN300) traffic works fine. Foritgate 2 (VLAN300) -----EPLAN LINK -----> Fortigate 1 (VLAN400) traffic fails. Have checked all firewall rules, static routes, etc. Can't find the problem.  Looked through the docs, only finding examples of VLAN routing on the same Fortigate.  I have that working just fine.

Hello,Planning to upgrade our EMS instance to 7.4.7 (currently on 7.4.5) and one of the ‘new features’ listed for 7.4.6 is hiding the SSLVPN feature by default (https://docs.fortinet.com/document/forticlient/7.4.0/new-features/483736/ssl-vpn-feature-select-option-is-hidden-by-default-7-4-6). With one of our Remote Access profiles including an SSLVPN profile, does anyone know the expected behavior or impact this may have?IE, once the upgrade is completed, will re-connected endpoints lose their SSLVPN configuration from the remote access profile? We are planning to re-enable the SSLVPN feature post upgrade via the cli commands provided but want to plan accordingly if the upgrade may wipe out the configuration until the feature is re-enabled. I would anticipate we will have some sslvpn connections active during the upgrade and don't want active users to get booted unintentionally. Thanks!

Hello How te configure auto changing password In FORTIPAM LDAP servers . BR 

FirewallFirmware: v7.4.11 build2878 We use a dedicated alert mailbox in our Microsoft 365 tenant for all device and system alerts, and it is already functioning correctly with multiple services.I configured the FortiGate firewall to use this same mailbox, following the same SMTP settings used on our other devices. After triggering a test alert, no email was sent.I reviewed Entra ID sign‑in logs and did not see any authentication attempts from the firewall. I also checked message trace and mail flow logs, with no record of an attempted send, while the previously configured devices continue to work normally.I also set the email “From” address as recommended, but this did not change the behavior.config:config system email-server    set server "smtp.office365.com"    set port 587    set authenticate enable    set username "alerts@ourcomanyname"    set password ********************    set security smtpsend  

Hello everyone,We are currently working on a migration process for the Archive server in our FortiSIEM environment, and we would like to keep all existing archived data during this transition.Our scenario is the following:The Archive server IP will be changed The goal is to reuse the existing storage and preserve all previously stored data The new Archive server is being configured to point to the same storageHowever, when attempting to configure the Archive on the new server, we are receiving the following error: Archive test error: Data storage already mounted. Please provide a raw, unformatted and unmounted disk.From our understanding, FortiSIEM expects a fresh disk during the Archive configuration process, but in our case, the disk already contains valid archive data that we need to maintain.Questions:What is the correct procedure to migrate the Archive server while preserving existing data? Is there a supported way to attach an already-used disk without losing the stored events? S

Hello all. Apologies if this has been discussed before and I failed to locate it. I just received a used FG-60F and registered it without any issues. When looking at my assets section, all subscriptions appear to be expired on this device, which I was expecting. Once I reset the unit with the button on back and went to the GUI, I noticed something odd. Being new to the FortiGate, I thought I should ask if this is going to be a problem before purchasing a license. On the 60F GUI, it shows that there is FortiCare coverage to an account that isn't mine. I would have thought that my ability to register the 60F indicates that the device has been unregistered from other accounts although I could certainly be mistaken due to my ignorance on such matters. My question is: If I purchase a UTP or ATP license, is this going to create a licensing problem with FortiCare coverage or will it simply apply the new license and show it as covered with FortiCare under my account?I would very much appreciat

A client is requesting that the secondary LAN port on a FAP231G be used for a wired printer connection. I’ve never done this before, but relevant documentation has pointed me in the right direction (I hope). Before making any configurations, the printer pulled an IP from the VLAN the APs are on.Based on the documentation, I went into the “FortiAP Profiles” tab and changed the port mode to Uplink & Bridge, and the port bridge Bridge to SSID, and then selected the desired SSID, the intent being that wireless devices on said SSID will be able to print from that printer. What I expected would happen is that the printer would pull an IP from the SSID pool. It did not.Next I went into the specific AP in the “Managed FortiAPs” tab, enabled Override LAN Port, set Override Port Mode to Uplink & Link, and enabled Bridge to SSID and selected the desired SSID. This also failed to pull and IP from the SSID pool. Am I missing something/misunderstanding how this works?

Hi everyone,I’m currently using FortiManager Cloud to manage my FortiGate devices.When I was configuring static routes directly on the FortiGate, I used to rely on address objects and especially address groups as route destinations (Named Address with allow‑routing).This approach was very convenient to group multiple networks behind a single static route and keep the routing configuration clean and readable.With FortiManager (Static Route Templates), I understand that this option is not available:Destinations seem to be limited to Subnet / Internet Service / Internet Service Custom. There is no way to select an address object or an address group as a destination, unlike local FortiGate configuration.I’ve seen that meta‑fields (variables) can be used to inject subnets into route templates, but:This does not really replace the concept of address groups. It doesn’t fully meet the use case I had before.So I’m wondering how you deal with this in practice:How do you handle static routing in

Hello, i created a Test-LAB with FortiManager v7.6.6 build3654 (Mature) VM Trial licensed and FortiGate v7.4.11 build2878 (Mature) VM Trial licensed. Now ill try to Join my Gate into my Manager and got the Error. I checked with the "Compatibility Tool" and it looks good for my Case. I use Windows 11 Pro with Hypedr V and booth VM Imgaes are HyperV from Download Center. The Screenshots are attached. Thanks for help. I tried a lot of proposed solutions FortiGate = 192.168.178.241FortiManager = 192.168.178.240  Log Spoiler (Highlight to read)ConnectedFMG-VM64-HV # diagnose debug application fgfmsd 255fgfmsd debug filter: disableFMG-VM64-HV # diagnose debug timestamp enableFMG-VM64-HV # diagnose debug enableFMG-VM64-HV # 2026-02-23 05:41:29 proxy_session.c,__session_frontend_accept,833: 192.168.178.241:1156 -> 192.168.178.240:541.2026-02-23 05:41:29 __use_cert,734: start idx = 02026-02-23 05:41:29 use certificate issuer = /C=US/ST=California/L=Sunnyval

Hello guys, What will happen to my fortimail once licenses expire?Will it be able still to send/relay emails?What about protection, antispam, content and URL filtering? Thank you in advance.

Hello,I am currently working with FortiManager Cloud (7.4) and FortiGate devices running in multi‑VDOM mode.I would like to know whether it is possible to hide or exclude specific VDOMs on FortiManager Cloud, so that:they are not visible in the Device Manager,  they do not consume a device / VDOM license, while still existing on the FortiGate (i.e. without deleting the VDOM on the device itself).From what I understand so far, it looks like:all Traffic‑type VDOMs present on a FortiGate are automatically visible in FortiManager Cloud, each of them is counted as a managed device/VDOM for licensing purposes, and there is no supported way to “unmanage”, hide, or exclude a single VDOM only on the FortiManager Cloud side.Can someone please confirm whether this is indeed not possible on FortiManager Cloud today?And if so, is there any official Fortinet documentation or statement that explicitly confirms this behavior or limitation?Thanks in advance for your clarification.Best regards,B-W