Solved

Hello Fortinet Community,I am facing an unexpected behavior when publishing a web application using a Virtual Server.ContextWeb application hosted on an internal server listening on port 80Virtual Server configured with:External port: 3000Mapped to internal port: 80Purpose: publish the application on a non-standard external port (3000) while the backend remains on port 80Observed behaviorFirewall policy allows only port 3000Accessing https://webapp.com:3000 → Does NOT workAccessing https://webapp.com:80 → Does NOT workFirewall policy allows only port 80Accessing https://webapp.com:3000 → Works correctlyAccessing https://webapp.com:80 → Does NOT work What I am trying to understandAt which stage does FortiGate evaluate the firewall policy in relation to:DNAT / Virtual Server port translationWhy the policy seems to match on the post-NAT (internal) service/portWhether this behavior is:By designSpecific to Virtual ServersDifferent from standard VIPs or central NAT QuestionI would

I've been trying to install the SSL VPN Only forticlient install on an employee's workstation and the install process gets almost all the way finished but then errors out and rolls back. There is no actual error message listed in the installer. I can see the MSIexec logs in windows starting the install and ending it but there are no errors there either. There also doesn't appear to be a log file created locally by the installer in the software or app data directories. I've tried multiple versions of the offline install from fortinet's downloads page as well as the default auto installer. I noticed that after a failed install the registry creates a "Fortinet>Volatile" entry under local computer with a "requires reboot" value of 1 but even after a reboot the install just fails again. Removing the Fortinet registry value does not change the outcome either. As a work around I installed the full forticlient with only the required install components and the SSL VPN. This install

Hi Team, I am using FortiGate with Version 7.4.9. I have ISP connected to WAN interface and my clients on LAN interface. Currently I have configured Prefix Delegation for IPv6 to get the LAN addresses from ISP and it is working as supposed to be, with SLAAC addressing towards the client for the PD prefix.Now along with this, I want to configure a ULA as a secondary address in my LAN interface. How can i achieve this. I could not find any option in CLI. Please provide any insight on this or let me know if Am missing anything. Warm RegardsMidlaj

Hello, I have encountered strange issue on our FortiClient configuration. We have deployed FortiClient via EMS Cloud to 500+ stations and for some time everything runned smoothly but suddenly lot of stations started to disconnect with this error even tho the configuration on both sides remained unchanged. The VPN connection is re-established randomly. For the specific error - VpnParameterConfigError i did not find any community posts, I reviewed configuration on both sides as the error is pretty explanatory but did not find any misconfigurations. As this is currently production environment, i cannot really troubleshoot this issue and make lot of changes on the current VPN configuration at the moment and need to wait for a weekend. If anyone encountered this beforehand please shine some light on this issue. Thank you Below I attach screenshot from the FortiClient (its in Slovak as the customer has it set this way) Rougly translates to: Last r

Hi, We have a FortiExtender 511G that we want to connect to a private 5G solution. To connect to this private 5G service it is mandatory to set the modem to 5G only mode. I have not found this option in the GUI or CLI. I only found a post on this forum how to do this for the FortiExtender 511F ( https://community.fortinet.com/t5/FortiExtender/Technical-Tip-Switching-Carrier-Service-Mode-to-FortiExtender/ta-p/336389 ). However the used AT-commands are not recognized by the modem of the 511G.  The FortiExtender is in LAN extension mode and runs firmware v7.6.4 and the modem runs FEM_20_EM9291-24-01-01-NAM. So is it possible to set the 511G's modem to 5G only? And how do I do this?Thanks in advance.

Hey Team, I am facing an issue with FortiGate VM evaluation licensing and would appreciate guidance. Scenario: I initially deployed a FortiGate VM for lab/testing purposes.At first, I was able to see and apply the Evaluation license.Later, after deleting the instance and re-deploying (also tried changing instance type from t2/t3), the Evaluation license option is no longer available.Now the firewall only shows options for Full License upload or FortiFlex token.I also tried uploading the previously downloaded trial license under Full License, but it did not work.Environment details:Platform: AWS (EC2)Usage: Lab / learning purposeInstance types tried: t2.small / t3.small / t3.mediumRegion: N. VirginiaThis is not a production setup. 

Hi, We are only enabling IPS on some firewall policies and I want to verify if SSL inspection is required for IPS to analyze encrypted traffic? Or is IPS capable of performing deep packet inspection without SSL inspection? I am a bit confused, because the below Fortinet link, mentions: "FortiGate IPS is even capable of performing deep packet inspection to scan encrypted payloads in order to detect and prevent threats from attackers."Also, that same link mentions: "Secure sockets layer (SSL) content scanning and inspection allows you to apply antivirus scanning, web filtering, and email filtering to encrypted traffic. You can apply SSL inspection profiles to firewall policies." - No mention for IPS.Reference Link: https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/565562/intrusion-prevention Whereas the best practice section for IPS in the NSE4 version 7.2 Security Guide (Page 410) mentions: "Certain vulnerabilities apply only to encrypted connections. In some o

On Fortigate 90G faceplate shared ports wan1, wan2, sfp1, sfp2) shows grayed out.There physical connectivities on sfp1, sfp2 and it working fine. We are able to do the configuration  for those interfaces but the only concern is it shows grayed out on gui faceplate.Please guide..

Anybody else having issues with getting the 'free' ipsec client to work?I've been messing around with this for a couple of weeks and so far, with 5 different machines and 4 different clients - only 1 machine will connect.I've already engaged support but since this is the 'free' client - they have exhausted all that they can help with.I don't need all the 'add-on' stuff with the vpn, just need it to connect - stay stable and provide some basic routing (thru it).What happens is that i install, configure, connect - and it hangs.  nothing until the connection drops off a few minutes later. packet captures seem to indicate that 'all' the tcp packets aren't getting sent/received and therefor phase 1 never completed. 

I am getting vulnerability warnings from NIST, which indicate I need to be using version 7.4.4.x of FortiClient, but your website does not provide beyond version 7.4.3.1761 for the VPN only version. Please provide an update for the VPN only version. https://nvd.nist.gov/vuln/detail/CVE-2025-31365

Hi,Has anyone encountered when executing a command below to get this output?Model FSW 124F-FPOE most of them and managed via FortiLink. diagnose switch physical-ports summaryPortname Status Tpid Vlan Duplex Speed Flags Discard__________ ______ ____ ____ ______ _____ ____________ _________prt_switch_phyport_summary: unable to get port1(#1) statusprt_switch_phyport_summary: unable to get port2(#2) statusprt_switch_phyport_summary: unable to get port3(#3) statusprt_switch_phyport_summary: unable to get port4(#4) statusprt_switch_phyport_summary: unable to get port5(#5) statusprt_switch_phyport_summary: unable to get port6(#6) statusprt_switch_phyport_summary: unable to get port7(#7) statusprt_switch_phyport_summary: unable to get port8(#8) statusprt_switch_phyport_summary: unable to get port9(#9) statusprt_switch_phyport_summary: unable to get port10(#10) statusprt_switch_phyport_summary: unable to get port11(#11) statusprt_switch_phyport_summary: unable to get port12(#12) statusprt_

Hi,For some reason, everyone using edge at my company is suddenly getting nonstop notification from FortiClient System Tray Controller saying: "Microsoft Edge" extension policy anomaly detected, please restart the browser.This happens anytime you try to open any websites and they just get stuck in loading until it fails. I restarted the browser and I even shut all Edge operations in task manager, nothing works. I cant seem to find any solutions online so was wondering if anyone was familiar with this issue and if they managed to resolve. Thanks!

Hello All, We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used. Thanks in advance

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.

Na madrugada de sábado (24/01), foi executada a atualização do firmware do Firewall Fortigate 100F da versão 7.4.9 para a 7.4.10.Após a conclusão do processo, identificou-se a interrupção de tráfego entre as demais Unidades e o Administrativo. O problema impactou diretamente o acesso aos sistemas internos hospedados na sede.Observação: Não foram identificados logs de bloqueio ou alterações de configuração que justificassem a queda de conectividade na nova versão 7.4.10, seguindo recomendação técnica, foi realizado o rollback para a versão 7.4.9. Após o reboot do dispositivo, a conectividade foi restabelecida e todos os sistemas voltaram à operação normal.

Hello everyone. Our company wants to provide an IP list through an internal webserver which we should import in our FortiManager to be used in Firewall Rules. (like http://10.10.10.10/list1.txt, .csv etc.)The use case is they want to manage a list which we will block on our internet facing firewall.Is there a way to do this? We have the 7.4.6 firmware installed currently.

Hi,I am trying to register for the FCP_FGT_AD-7.6 (FortiGate Administrator) exam via Pearson VUE in Japan.The exam language is fixed to Japanese, and I do not see an option to select English, while some other Fortinet exams appear in English by default.Could someone please confirm whether this exam is Japanese-only in Japan, or if there is any supported way to take it in English ? Thank you.    

Hello, we currently run FortiMail VM01 on‑prem and have purchased 110 FortiMail Cloud licenses.What’s the recommended way to transition—can existing settings, policies, and configurations be migrated to the cloud?Or does everything need to be rebuilt manually from scratch in FortiMail Cloud?Looking for best practices, steps, or guidance from anyone who has done this migration.

Hello.Within our proxmox environment we have several vlans.  The proxmox has several bonds with some of the interfaces configured as active/failover - such as the mgmt, and a separate bond for the vlan traffic. As it happens one of the vlans within the proxmox environment has the same vlan number as the switch.  By this I mean, the interface on bond0 is configured as the same vlan # that the servers have.  Obsivesily, the servers are 'tagged' within the proxmox environment to 'tag' traffic to/from other devices on that network.Here's a breakdown -Proxmox environment - native vlan is 10.  with an address of 10.0.1.xOn the switch network, which I'd like to configure the 'trunk', the default vlan is 10.The proxmox manages traffic in/out off of the 2nd bond or interfaces, but as the servers are also 'set' to use vlan 10, how will this work? It's almost like a 'nested' configuration with both interfaces using the same network - but not so as the proxmox handles

I think I have the answer, and it's yes - but wanted to confirm with everyone. new system running 7.4.8M 6484logged in and got a msg about upgrading to 7.4.9. since auto upgrade was turned off i have the option to upgrade.  trying thru clicking to upgrade doesn't work so the process should be manual, i presume.banner message says there's a (nother) issue with this firmware and i need to upgrade to 7.9M.  reviewing the document - Fortinet Document Library | Upgrade Path Toolit seems like there are 2 upgrades to get to this firmware, 7.4.8M2795 then 7.4.9M2829. Does this mean that i have to do 2 download/upload/reboots to 'jump' to the recommended level.  Again, i think the answer is yes - but wanted to confirm. 2 questions:1 - If this is the path and procedure for upgrades from 1 version to another, higher version? ie no 'jumping' to the latest version? trying to click on upgrade from my console didn't work as the gui seemed to indicate.2. since 7

Hello everyone, This might be a basic question, but what is the purpose on integrating FortiNAC with an LDAP server BR,

Good day! For monitoring purposes, we set up a custom integration with the Fortigate Cloud API. A couple of months ago, our custom integrations stopped working. Authentication still succeeds so it's not a credential/auth issue. We noticed that the following endpoint does not return any data anymore: https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices  Instead we are hit with the following error:{"error":"invalid_client","error_description":"Authentication failed","error_code":-1} This error indicated invalid_client (we used fortigatecloud as per the docs). Even stranger is the fact that we can query the API enpoints for individual devices by specifying the gate's SN. https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices/FGT40FXXXXXX This proves that my access_token is valid and can authenticate against the API endpoints (again: with client_id: fortigatecloud). The fact we get a valid response also confirms to me that it's not a n

I have prefix list to filter which prefix will be send to azure.Previously ID no 4 is not exist and i can see in the advertise route only showig 10.103.0.0/16 and 172.30.30.0/24 FW01 (Internet) # get router info bgp neighbors 10.201.0.4 advertised-routesVRF 0 BGP table version is 43362, local router ID is 10.103.103.103Status codes: s suppressed, d damped, h history, * valid, > best, i - internalOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight RouteTag Path*> 10.103.0.0/16 10.210.0.103 100 32768 0 i <-/->*> 172.30.30.0/24 10.210.0.103 100 32768 0 i <-/->Total number of prefixes 2 But when i add ID number 4 above why the fgt still advertise 2 prefix and not advertise 10.105.0.0/16?

Hi everyone. I am trying to set up Forticlient VPN users to be able to authenticate and get VPN access using their Google accounts. We have a Fortigate FGT60E with FortiOS 7.4.9 running.Right now we have a SSL-VPN set up and working fine but with separate account credentials + FortiTokens. I had tried following different guides I found online + trying to use the logic of my own but I am stuck, based on logs fortigate does not really understand how to map a user to a group.  I had created a custom SAML app with : ACS : https://MyFQDN:10443/remote/saml/login/ Entity ID: http://MyFQDN:10443/remote/saml/metadata/Start URL: https://MyFQDN:10443/remote/loginSigned response checkedCertificate valid until 2031.Basic information > Primary email Attribute mapping : Primary email -> usernameOn Fortigate side, under User & Authentication SSO I created Google_SAML, with this config :Entity ID : http://MyFQDN:10443/remote/saml/metadata/Assertion consumer service URL: ht