Solved

 I have tried many times to activate the evaluation license but the screen shows the following error.I am able to ping google.com and all other domains. I am using eve ng for learning purpose and after logging in the firewall does not allow me to move forward without subscription. Your quick help is required.  Regards,Aneeq Ahmed

Hello, i create a new poliy directly on fortigate CLI with: config firewall policyDescription: "My Policy"edit 0set name "MyPolicy"set action acceptset dstintf IFACE_01set dstaddr MyDstServerset srcintf IFACE_02set srcaddr MySrcServerset service HTTPset schedule alwaysset schedule-timeout disableset status enableset logtraffic allend The command does not return the newly created policyid, since i want to create some batch operation where i have to place the policy before a specific other policy, is there an easy way to return the created policyid, i only know the command get firewall policy  where i have to use the last ID.

Hello team!!! I need create a tutorial for limited users with no Fortigate knoledge to modifý easily the IP address in many VIPs.  This is for manually redirect traffic to another computer (Different IP)If I guide the users to modify manually all VIPs in "Policy & Objects -> Virtual IPs", there are to much posibilities to the user to make a mistake, so I need for example, to create an script to modify the VIPs and guide to the users to execute this script.These is a Fortigate 100F, which I think that have not hard driveActually could be better to create something to be executed from the gui Automation stitch seems not be working to change the Fortigate settings.I have not knoledge about APIs and I have not enough time to learn. Any idea will be apreciated!!Thanks in advance.Regards,Damián

I can connect without any problem to our FortiGate FG‑60F using FortiClient 7.2.0864 on an Intel / Windows 11 device.However, this older version is not supported on ARM / Windows 11, so I upgraded to FortiClient 7.4.3 hotfix 1.8758 (ARM64) on a Surface Pro with Windows 11 ARM.The installation succeeds, but when starting the IPsec VPN I immediately get:“FortiClient – IPsec connection is down”I also noticed that the FortiClient VPN Service / SSLVPNDaemon services are missing on the ARM device, which suggests that the VPN engine is not being installed correctly.It seems other ARM users resolved this by installing the MSI version of FortiClient (instead of the EXE), but the MSI installer is not available for download in the normal Product Downloads section.Where can I obtain the MSI installer for FortiClient 7.4.x ARM64?Do I need to request it through Fortinet Support, or is it available somewhere in the download portal?Thanks for any guidance.

Hey Guys,I am new to FortiGate and Aroba. I wanted to implement a network segmentation on our network this side but i am seeing problems, I created vlans both on the aroba switch and the FortiGate and trunked the port from the switch to the firewall. I even gave on policies for every vlan to show what directions each vlan should take, but there's no communication between the vlans or the vlans to the internet (for the ones having outgoing interface as wan) End devices are able to acquire addresses as per the addressing table. I even did a trace route on the device which was connected to the CORP and Pent vlans and all of them end at their gateways (the ones specified on the firewalls). I carried on doing a debug on the cli on FortiGate to see if at all packets arrive to their designated policies (by doing pin 8.8.8.8 on CORP since it has The Internet policy enabled) nothing popped up from the cliThings verifiedDHCP of the corresponding vlan issues the correct address as par the ad

Hi guys, New to forum, want to check with the community senior of Fortinet whether FortiSASE is a real cloud solution that managed (Backend) by Fortinet or a cloud solution that require customer to managed? As we being request to call Fortinet when hit FSASE bug (1213936) everytime it occur and need to start the troubleshooting from scratch (Took around at least 45minutes everytime) to validate the issue even though we had told them we do hit the bug (1213936). Seems like become the one to maintain FSASE infra instead of Fortinet themselves. Do any of you encounter such experiences before, how would you suggest to speed up whole troubleshooting? Challenges: 1) FSASE not managed by us and require call in to Fortinet support for manually reboot/restart the service/instance2) The troubleshooting most of the time need start from scratch even being told it hit the known issue (1213936)3) The known issue (1213936) can be happen few times on same day (Updated by Fortinet s

 Hello,  I am testing an IKEv2 IPsec dial-up VPN on a FortiGate 81F (FortiOS 7.6.6) and I would like to confirm if my use case is fully supported.SetupFortiGate 81F – FortiOS 7.6.6IPsec dial-up VPN (IKEv2)Authentication: LDAP (Active Directory)No RADIUS, no FortiAuthenticator, no EMSClient: FortiClient VPN Only (free)IssueThe tunnel establishes correctly (IKE + Child SA).The client receives an IP address and traffic is allowed.A few seconds later, the VPN is disconnected immediately.IKE debug shows repeated EAP challenges:  FNBAM_CHALLENGE until the client sends an IKE DELETE.ObservationsEAP-TTLS fails (expected, since no RADIUS/FAC is present).EAP-MSCHAPv2 seems required for LDAP auth, but on FortiOS 7.6.6 there is no option to force the EAP method on the FortiGate.The EAP method appears to be fully client-driven.QuestionIs IKEv2 IPsec with LDAP authentication (without RADIUS/FAC/EMS) officially supported with FortiClient VPN Only?If yes, is EAP-MSCHAPv2

Hello FNAC admins, I'm trying to add my fortigate to FNAC inventory, I'm getting this error. SNMP is configured on my Fortigate, I'm able to ping Fortigate from FNAC and vice versa. Any ideas ?   BR,

Hello FNAC admins, I'm trying to access the CLI console on my FortiNAC's GUI, but I can't find it... Is there a feature I have to enable to access the CLI ? BR,

Hello Everyone,I have a Fortios 7.6.4 Fortigate60F device. Even though I enabled the policy and IPsec NPU offloading settings for my IPsec connection, it shows npu_flag=00. Could this be related to the policy rules or the IPsec encryption algorithm?If you could help me,

I tried 23646 and 123123 neither works

Hi,After installing FortiClient (FortiClientVPNSetup_7.4.3.1790_ARM64), it worked great.After a week, I can no longer start FortiClient.I've already uninstalled it and tried FCRemover.exe.Nothing helped.What's the problem, what can I do?Regards, Martin

Hi all, I am looking at using the Guest Management feature on the Fortigate.  Is there a way to customise the Network Guest Credentials email and printed page?  I can't find them in the Replacement Messages area, and they look pretty unprofessional as they are without any branding. thanks

Hello everyone,I have a Fortigate 60F device running Fortios 7.6.4. I want to create a ZONE, but because I have rules on my existing VLANs,I cannot include them in the ZONE interface member section. Deleting these rules would take a long time. Despite this, can I include my interfaces in the zone?Thank you for your help.

Hi there, i need to change the vm size of my FortiGate in Azure. Currently we're using DS1v2 for a small firewall. Can i switch to an ARM-based VM size like "Standard_D2pls_v6" and follow the KB article Technical Tip: Resizing an Azure FortiGate VM instance or do i need to stick to Intel-based ones? I don't want to reconfigure everything, but configuration restore would be OK, if needed for the architecture switch. 

Hi,I'm testing the FortiClient EMS solution on a trial license. After updating to version 7.2.6, the system detected the PHP CVE-2024-11236 Out of Bounds Write Vulnerability. Is there a way to report this to have the vulnerable application version updated?

Hello all,I need your help with problem.I have central location and few branch locations.All branch locations have internet routed via IPSEC vpn established with central location.The problem is that devices at branch locations have internet acces while Fortigate itself doesn't (for license updates etc). So what I'm missing here.  Branch office IPSEC phase 2 remote subnet is set to all (so devices can access internet). Ping and traceroute from branch office fortigate doesn't return anything, firewall isn't blocking (or at least logs doesn't show anything) anything related to fortigate directly.Central location is fortigate 70G while branch locations have 40F if it does matter.It is probably really simple solution but couldn't find solution yet :)Thanks!

Hello everyone,I have a Fortigate 60F device running Fortios 7.6.4.I can't use NPU for my internet exit rules. The CPU is 100% busy. I can use NPU for local traffic, but not when exiting to the internet. What could be the reason?I look forward to you

  I  downloaded  VM  from fort iCloud  Sit  and I cant make evaluation LIC when I put my mail and password get this massage in  CLI  for FortiGate  FortiGate—VM64 login: Requesting Fort iCare Trial license,requesting Fort iCare Trial license, proxy : (null)

Hi,Im trying to obtain firmware for my FortiWeb WAF Azure and AWS VM, which is on a PAYG license.The FortiWeb is registered in FortiCloud and shows as one of my assets.When I go to Firmware Download section and select FortiWeb as my product, I get a message indicating that I do not have a contract for this product?Opened a ticket with Support and first they said, with a PAYG license I can download firmware from Azure/AWS market place, with a link directing to the page when you want to purchase and deploy a FortiWeb VM. Not the actual firmware to upgrade my current FortiWeb.After pointing this out to, support came back and said I need to go to VM images, select my product and download the image, but when I follow those steps I see that these images are for New deployments and not for firmware upgrades.Can someone please indicate where I need to go to download my firmware, and is it possible that there might be some sort of registration issue with my FortiWeb? It does show that its licen

We have a FortiClient VPN access to several customers. I try to update the FortiClient version on my machine by downloading a new version from https://www.fortinet.com/support/product-downloads#vpn (download "FortiClient VPN-only" for Windows).This does not work: a form is shown where I enter my contact data and click "Download". The button changes to "Submitting...", and after some time it reverts to "Download" again, without any download coming up.  Does anybody have an idea on how to get new FortClient versions? To my understanding, this component is free to download? Best regards Wolfgang

Please explain this setting:

The goal is to cater for two types of user accounts which require VPN access; internal staff accounts added to a dynamic group and member accounts used by third-party users which are manually assigned to a group as required.  My question is whether it is possible to set multiple Object Ids in the below config on the FortiGate corresponding to multiple Groups assigned to the FortiGate Enterprise App in Entra. Any alternative suggestions for how this scenario can be handled are welcome. 

Hello everyone, in the config wizard I would like to know if the "domain" field has to be a real domain as in the prod domain or do I have to make a subdomain for FortiNAC and config it in my DNS server ? BR,

Hello colleagues! Got confused with a simple case with IPsec on the first view. The situation:We have a 3rd party partner who is not smart enough unfortunately. We have to establish an IPsec tunnel via 2 different link , but with policy base only(don't ask why). The partner has the only single IP for IPsec tunnels where I have to connect , the route for this IP I receive from BGP from both "outside" links (with \30 link's subnets) , one as a main and another as a backup. We have a subnet on a vlan-interface that we announce into the BGP and we have to establish the IPsec Phase1 with the source IP from the subnet. So the problem is that the subnet that we have to use as IPsec source is different from the Outside's interfaces. In my opinion in theory it's possible, looks like a simple routing , an IP packet from my FG will be NAT-ed (SrcNat) with one of IP's from the announced subnet , there is a route toward the partner's IP, the backward packet will get the outside interface with the s