Solved

“Is it possible to run FortiLink between a FortiGate and a switch over a Wi‑Fi bridge using two antennas, such as Ubiquiti Loco M5? Are there any known limitations or issues with stability? Thank you in advance for any advice.

Hello everyone, I have a question to which I was not able to find an answer yet.We have a SDWAN/ADVPN setup with one hub (vdom on a 400E) and about 80 spokes. For the hub we want to buy a new 200G, mainly because of the 10GB interfaces. I have found a couple of articles here about migrating a Fortigate to a new model and this article (346859) points out, that i have to add the new 200G to Fortimanager with the help of Forticonverter. Our SDWAN/ADVPN setup is a couple of years old (we started with 6.4) and I wonder if there is way to migrate the hub without breaking all the scripts.  Under VPN Manager -> IPSec VPN communities we have ADVPN-1, ADVPN-2 and ADVPN-3. Every ADVPN has  the same Fortigate with the "Hub"-role - and this is bound to the serial of the device.  I would like to replace this object with the new 200G.... Is there a document around, that shows how to do this?  Or do I need to create all the SDWAN/ADVPN stuff fr

Hi, I'm doing some playbooks and I always need to make a code snippet after a MySQL Run query connector (SELECT) to get - If query returns some data- Number of rows query returns My code snippet is always like this. if isinstance({{vars.steps.Query_CMDB.data}},list: print(len({{vars.steps.Query_CMDB.data}})) else: print(0) As I know when query returns data it always returns an array with N dicts inside (rows). But when there is no data, only return "success", so if I try with jinja to run  {{vars.steps.Query_CMDB.data | count}} > 0 Always return > 0 because when its "success" it counts the letters... There is a better way to avoid my "length" step? and only have the MySQL query step and after that, the decision step (if rows > 0 -> then X, else Y)

I have hub connect to the spoke using 3 different lines, and from bwlow pic i want to troubleshoot why path using 10.103.113.6 is not best path. Anyone knoe how to troubleshoot this? FW01 (Internet) # get router info bgp network 10.4.0.0/16VRF 0 BGP routing table entry for 10.4.0.0/16Paths: (3 available, best #2, table Default-IP-Routing-Table)Advertised to non peer-group peers:10.103.113.2 10.103.113.3 10.103.113.4 10.103.113.5 10.103.113.6 10.204.0.30Advertised to peer-groups:advpn_isp1 advpn_isp2Original VRF 0Local, (Received from a RR-client)10.10.111.6 from 10.10.111.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 1Last update: Thu Jan 8 04:59:01 2026 Original VRF 0Local, (Received from a RR-client)10.10.112.6 from 10.10.112.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 2Last update: Tue Jan 6 09:20:25 2026 Original VRF 0Local, (Recei

Here you can find all important FortiGate CLI commands for the operation and troubleshooting of FortiGates with FortiOS 7.4.  SystemGeneral System Commands   get system status General system information exec tac report Generates report for support config, get, show, tree set, unset, append, unselec Configuration commands <command> ? or tab Use ? or tab in CLI for help <command> | grep [-f] Grep command to filter outputs diag debug cli 7 Shows webGUI changes in CLI   Process Information   get system performance status General performance infos diag sys top [sec] [number] Control + C to stop command Process list Sort with P (CPU) / M (Memory) diag debug crashlog read Crash log  Network Network Interface Information   diag ip address list            &

Hi,I have created a remote IPsec VPN for remote users. the users can connect to the VPN.However, they can't access anything in the LAN behind the FortiGate through HTTP or HTTPS.For example, I can SSH to the FortiGate to manage it; however, I can't access it through HTTP/HTTPS.I don't have a route issue because I have ping/ssh to the FortiGate/LAN behind it. I don't have a Policy issue as I have allowed all the services.Model: 401FVersion: v7.6.4.

Hello FNAC adminsOn the support portal, image download, under FortiNAC-F > v7.00 > 7.2 > 7.2.9, I found this file: FNAC_install_7.2.9_build0166.bin.Made some searches but couldn't find anything about it.Do you have any idea?Is it for manual installation on a Linux server?If so then why it is not documented? And if so then is it supported?

Hello,Kindly assist me to develop a parser for the following Openshift logs. I am fairly new to FortiSIEM, so I am struggling to accomplish this.The following log is what I'm receiving on FortiSIEM from Openshift:<46>1 2025-10-26T12:49:43.522Z node01.internal.local redgreen-service-deployment-857cb4bb8d-l5v8r_blueyellow-service magenta-7f2a1c9f container - {"@timestamp":"2025-10-26T12:49:43.522728353Z","hostname":"node01.internal.local","kubernetes":{"annotations":{"k8s.v1.cni.cncf.io/network-status":"[{\n "name": "orangeviolet-net",\n "interface": "eth0",\n "ips": [\n "192.168.42.100"\n ],\n "default": true,\n "dns": {}\n}]","kubectl.kubernetes.io/restartedAt":"2025-09-22T01:16:48+03:00","openshift.io/scc":"anyuid","openshift.openshift.io/restartedAt":"2025-10-06T19:57:19.173Z"},"container_id":"cri-o://pinkteal-7f3c2d1a9b8c4e00a1234b567c89deffedcba123","container_image":"registry.internal.local/colors/redgreen-service:prod-blueyellow-20250916120214","container_image_id":"registr

Hi. VPN setting guide in the FortiSASE document doesn't have ikev1, it means IKE version can use only ikev2?And is FortiSASE's VPN IKEv2 not supported on Android?Does SASE have the ability to set up Android and SIA?Thank you

Hello,After upgrading FortiGate to version 7.6.5, we encountered issues with IPsec tunnels. According to the Fortinet technical article, the default Diffie-Hellman group values were changed from  5 to 14, 20, and 21. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-tunnels-not-connecting-after-upgrade-to-v7-6/ta-p/423320 Current situation:On PC clients, the issue was resolved by changing the configuration and setting matching DH groups (14, 20, 21) on both sides of the connectionTunnels are working correctly after synchronizing the settingsProblem: The FortiClient VPN application on Android does not have the option to select DH groups higher than 14. As a result, mobile users cannot establish VPN connection after the FortiGate upgrade.Questions:Is there a planned update for FortiClient Android application with support for DH groups 20 and 21?What is the recommended temporary workaround - should we roll back the configuration on FortiGate to older DH groups

 I have 10 collectors and successfully registered 9 collectors .1 Collector giving this error.I have tried wit different user after logged in to the GUI but the same error.   phProvisionCollector --add admin 'password' 10.10.1.11 Super fsm.col1Continuing to provision the CollectorFailed to register collector!Cause:HTTP Status 401  Not authorizedThis request requires HTTP authentication. seeking expertise answer

Hi. I can't sync with the ntp server after using executetime xx:xx:xx in Fortianalyzer.It is the same even if the ntp status is disabled and enabled.Is there an ntp sync command on Fortianalyzer?In the case of Fortigate, I can find out when it was last synced through the 'execute time' command, but how do I check it in Fortianalyzer? Thank you

Hello all.  In registering the collector with the super. /opt/phoenix/bin/phProvisionCollector --add 130859572admin 'passwordomited' <FQDN SIEM> <ORG>  <COLLECTOR NAME> Error: HTTP Status 401 - Not authorized This request required HTTP authentication.   I am seeking from the community any experience or knowledge of this occurring and the creds NOT being the issue.I  have found a wealth of connectivity troubleshooting articles. But nothing about  401 Not authorized return code error as a result of phProvisionCollector. What we checked.doubled check org name, admin name, etc.checked the collector exists under their org settings in the SIEMchecked Phoenix log and found "PUT" command error 401 from the collectorwe can see the super talking back on port 443found the ssl_access_log and it to had the 401 error from the collector Have not verified time sync by running the date command on collector and super, if they are out of sync

Hi all, I need to use Forticlient VPN ver 7.2.4, but cannot find else where. how can i get its .deb file for installation?

I am currently working on an educational lab My objective is to integrate a fgt 7.0.12 with a fgm 7.4.8.The recommended step-by-step procedure and CLI commands to add the FortiGate to FortiManager

Hello, My FortiAuthenticator HTTPS certificate is close to expiring. I generated a new certificate with the same configuration and imported it through the Local Services console. The old certificate was automatically replaced by the new one, but I can see that the Web GUI is still using the old certificate. I cleaned the browser cache, i tried with the incognito browser mode but nothing works, i also waiting for one but still use the old certificate. I would also like to know whether this certificate has any impact on EAP WiFi authentication or any other FortiAuthenticator components. Thank you.

Hello, The Default-Server-Certificate expiration will expire in 5 days. We use FAC for WIFI EAP-TLS and VPN MFA. I can see that the certificat is used in LDAP service, OAuth service and maybe in other services. It is safe to keep using this certificate after the expiration, or should i renew it ? i wanna also the impact if i renew the certificate.   

Hi, I did a less-than-thorough search on the web, but was wondering if Fortinet has plans to integrate Wireguard VPN in their Fortigates?  We've all had some sports with IPSEC tunnels that drop and never come back - might be time to embrace the future. :)  Thanks! 

Hello everyone, I’m currently working on the design of a FortiSIEM deployment expected to handle 10,000 EPS, and I’d like to get some insights or recommendations from the community. Planned architecture1 Supervisor1 WorkerCollectors at each site (multiple sites)ClickHouse for event storageBefore finalizing the architecture, I have a few questions about the design choices and database placement.  1. Architecture benefitsWhat are the main advantages of separating the Supervisor and Worker compared to using an all-in-one Supervisor setup (for a 10K EPS environment)?Does it provide noticeable performance or scalability improvements in real-world deployments? or would be an all in one supervisor good enough (to optimize resources usage).  2. ClickHouse placementWhere should ClickHouse ideally be installed — on the Supervisor or on the Worker?My initial preference is to host ClickHouse on the Worker to reduce load on the Supervisor, but I’d like to confirm if th

I connected the FortiAP (FortiAP-FP431F) to the lan, and the firewall is a FortiGate VM (v7.4.9 build2829 (Mature)). I found that the FortiAP can obtain an IP address from the DHCP LAN port of the firewall, but the FortiAP device is not discovered in the WiFi controller's "Managed FortiAP" menu. What could be the issue, and how can it be resolved?

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's. In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this.  I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too.  Looking for some suggestions on how to tackle this one?Denny    

Hello, We have two questions:Is there a guide to make virtual IPs work on SSL VPN interfaces?May hairpin NAT work using secondary IP interfaces?We are trying to make hairpin NAT work on 3000F. Any help will be much appreciated. We followed this KB on hairpin NAT (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448#M2442). Our use case is similar to Example 1. Campus1 (VPN / LAN IPs) --- FW (WAN IPs) -- internalServer (VIP). At the FortiGate side, the VPN tunnels land on an SSL interface (ssl.root); ssl.root is defined on a WAN interface (port35). Two firewall policies are defined:a NAT ingress rule, from ssl.root to port35, allowing internal users (VPN admin pool) to reach the virtual IP (defined as destination address object) balancing on an internal server.an egress rule, from port35 to a DMZ, allowing the NAT'ed requests to reach the load balancer virtual IP.This translates into these policies: # show firewa

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:FortiGate-120G HardwareI am looking for advice and community experience regarding the possibility of implementing a port knocking mechanism on a FortiGate firewall.My goal is to restrict access to specific services and dynamically allow connections only after a predefined sequence of connection attempts (port knocking).I have reviewed the official documentation and forum discussions, but I would appreciate clarification from those with hands-on experience:1. Is native port knocking supported on FortiGate?Scenario:• 4 ports in a specific sequence• 2–3 seconds timeout between each attempt• Final goal: open a real port (e.g. SSH, RDP, Web) only for that IPStep-by-step process1️. Initial state• The firewall completely blocks the real port (e.g. SSH 22).• It only listens for connection attempts on the knocking ports.Example ports:• Port 1 → 4000• Port 2 → 5000• P

■Customer Environment・FortiGate 400E・PC1 (RDP executor)・PC2 (RDP receiver) ※Both PCs are windows 10.※The firmware for the fortigate400E is v7.2.5. Also, the FortiClient firmware is v7.0.7.※SSL-VPN connection is used.※A policy has been added to allow communication from the internal segment to the VPN terminal segment. ■InquiryI want to make an RDP connection from inside the company to a remote access terminal outside the company.However, when I RDP from an in-house terminal(PC1) to a remote access terminal(PC2), the FortiClient disconnects.The forticlient notice states that the tunnel "SSL-VPN connection" has been disconnected because another user has logged in to this computer.The screen on the PC1 side showed the RDP screen, but remained dark. I would like to know why forticlient disconnects when I do RDP. If anyone knows the cause of this, please let me know. FortiGate  FortiClient  

Hi , Fortinet Community, I want to install Fortiweb 600F in my Client Infra. I want to install it in Reverse Proxy Mode. Client Network design is this1. Server->Distribution->Core Switches->FortiWeb->Fortigate FW-> ISP Internet + MPLS Links Client has multiple branch offices in country hospital which run erp/web applications from remote locations which will be sitting behind Fortiweb.  Please suggest me either reverse proxy mode is perfect for it?And Suggest what will be network topology and subnets/VIPS.Lets Suppose my server form is using 20.20.20.0/24 subnet and Fortigate firewall working as edge firewall running 10.10.10.0/24 subnet.needs experts and seniors help. Kindly suggest better approach. Can be vips subnet different, how it will route , how other traffic will route, currently gateways of servers configured upon fortigate firewall