Solved

Hi , Fortinet Community, I want to install Fortiweb 600F in my Client Infra. I want to install it in Reverse Proxy Mode. Client Network design is this1. Server->Distribution->Core Switches->FortiWeb->Fortigate FW-> ISP Internet + MPLS Links Client has multiple branch offices in country hospital which run erp/web applications from remote locations which will be sitting behind Fortiweb.  Please suggest me either reverse proxy mode is perfect for it?And Suggest what will be network topology and subnets/VIPS.Lets Suppose my server form is using 20.20.20.0/24 subnet and Fortigate firewall working as edge firewall running 10.10.10.0/24 subnet.needs experts and seniors help. Kindly suggest better approach. Can be vips subnet different, how it will route , how other traffic will route, currently gateways of servers configured upon fortigate firewall 

Hello,In one of the company’s offices, we are planning to completely replace the hardware equipment, which includes the following:1. FortiGate-120G Hardware2. FortiSwitch-1048E4. FortiSwitch-148F-FPOE5. FortiAP-234FWhat concerns me is that, for some of the offices, the only available option for a SSTP VPN tunnel is, due to the fact that the providers block our other VPN solutions.From forums, documentation, and various sources, it is stated everywhere that SSTP cannot be used.Is it true that it is not possible to use SSTP at all?The other question is whether it is possible to control Layer 2 traffic between computers.By this I mean: if one computer attempts to attack another computer, and both are connected to the same switch, is there an integrated tool on the switch that would allow me to detect and block such an attack?Thank you in advance for your time.

Hello Fortinet Community,I Am experiencing an issue with Security Posture Tags on FortiClient EMS Cloud.Environment:FortiClient EMS CloudVersion: 7.4.4 build 2034 (Feature)Client OS: Windows 11Feature tested: Security Posture TagsTag type: OS VersionRule configured:OS Version = Windows 11 (Latest update within 30 days)Issue description:The posture tag is not applied consistently.Sometimes the rule is correctly evaluated and matched, but shortly after, the same endpoint becomes non-matched, even though the system remains compliant (Windows 11 fully up to date).  Tag is matchedTag is not matchedObservations:The endpoint remains compliant (Windows 11 + recent updates)The tag Is sometimes matched, then later not matched without any OS change (always)Questions:Is this a known issue or bug in EMS Cloud 7.4.4?Is There any workaround or recommended fix?Are there specific EMS or FortiClient settings that should be adjusted?Thank you in advance for your help and feedback.

Hi all,Regarding the newly published CVE-2025-62631 (https://www.fortiguard.com/psirt/FG-IR-25-411), I was unable to find any information about a fixed release for FortiOS 7.2.x. Not sure whether a fix for 7.2.x branch is planned, and if so, when it is expected to be released?

HiCustomer have web connection to local server and I get following error:Profile defaultAttack Name HTTP.URI.SQL.InjectionAttack ID 15,621Reference https://fortiguard.fortinet.com/encyclopedia/ips/15621Incident Serial 73,033,816Direction outgoingSeverityHighMessage web_misc: HTTP.URI.SQL.Injection It seems that Firewall discovers and block malicious access.Now i disable ips on policy rule.How can enable it on this specific server?  

We currently have a dial-up SSL VPN configuration that requires a user to connect using both their Windows AD (LDAP) credentials AND a local computer certificate issued from our internal Windows CA.  On top of that, we use FortiToken with push notifications for MFA on the LDAP user accounts. With the recent push to migrate away from SSL VPN and switch over to using IPsec IKEv2 VPNs instead, I have not been able get the same requirements to work via IPsec. Our setup includes:FortiOS – 7.4.8FortiEMS – 7.4.3FortiClient – 7.4.3FortiToken  Subscription (not cloud)Windows NPS for RADIUS (not FAC) Is this even possible with the above?  Seems like it is supported, but I can not get it to work with NPS. According to the article below, I should be able to get FortiToken MFA push notifications working using local RADIUS user accounts:https://community.fortinet.com/t5/FortiGate/Technical-Tip-IKEv2-Dialup-IPsec-tunnel-with-RADIUS-and/ta-p/220818 …but as soon

I have been making no progress on this for weeks now.  Using FortiClient 7.4.4 I am unable to successfully configure an IPsec IKEv2 remote VPN connection using LDAP machine certificate (not a user certificate) authentication.  We have an internal Windows CA.  All clients have a Machine certificate issued by our internal CA with an EKU for Client Authentication and the FQDN set in the certs subject name (ex:  CN= ComputerName, OU=Computers, DC=domainname, DC=local) in their local computer personal store.  All client machines also have our internal CA’s root certificate in their local computer Trusted Toot Certification Authority store.  The FortiGate has a server certificate installed that was issued from our internal CA (appears properly in the FG Local Certificate store) and it also has our internal CA’s root certificate (appears properly in the FG Remote Certificate store). All of the Certificates mentioned above are still valid and not expired.&nbs

Model: ForitGate-50GI would like to assign the same IP range subnet to between physical interface and internal wifi interface:Lan 1: 192.168.1.1/27internal wifi: 192.168.1.1/27 by default system be return warning msg some Lan1 or wifi interface subnet used. as above case, does it should be add a FortiAP or switch device to solve it? 

Hello everyone,We need to replace our Sophos UTM and were thinking of doing so with Fortinet systems.Since we use quite a few Sophos UTM services, I'm wondering which Forti system I can use to map which services, or whether it's even possible to map all services.Here are the “services” I need to provide: Network ProtectionFirewallIPSVPN: IPSec / SSLReporting Email ProtectionEmail receptionVirus protectionEmail encryptionSpam protection (Quarantine , daily SPAM-report) Web ProtectionWeb-ProxyVirus protectionHTTPS-ScanningWebserver ProtectionWAF (Web Application Firewall) for On-Premise Exchange OWA access GeneralActive-Passive ClusterAD synchronizationReportingIs it possible to deploy all services with Fortinet?

Hi, I'm trying to configure an IPSEC VPN dial-up with saml and fido2 (yubikey) using the External Browser as User-agent for SAML Login option - it's not working. It works for SSLVPN, but not for IPSEC. The client version is 7.2.12. Could it be that it's not working? It works without problems using credentials via Microsoft Authenticator with the External Browser as User-agent for SAML Login option disabled, but when I enable it and use the FIDO2 key method, the browser displays a message that I've logged in, but the tunnel doesn't establish. The tunnel is configured based on ike2 with the networkid parameter. Has anyone else encountered this problem?Regards 

Dear Concern, I have purches VON/ZTNA on premise deployment and it is working fine standalone. But I want to need HA configure, at the moment required another license or existing one is enough. How to configure HA any suggestion.We have purchased FortiClient VPN/ZTNA (on-premises) deployment, and it is currently working fine in standalone mode.Now we are planning to configure High Availability (HA) and would like clarification on the following: 1. Licensing:Is an additional license required for HA, orCan the existing license be used for both primary and secondary nodes? 2. HA Configuration:What is the recommended HA architecture for on-prem VPN/ZTNA?Any best-practice guidelines or official documentation for configuring HA? Any suggestions or real-world experience would be highly appreciated.Thank you in advance. ForticlientEMS os version: 7.4.4 #FortiClient #FortiEms @support 

We are trying to get detailed information for where our users are going.  Say we have a user that goes to their facebook page and then to the company facebook page and then back to their own.  The detailed "User Detailed Browsing Log" only says they went to facebook.com.  Is there a way to see more details that might show if they are doing company business or personal?

hi,i got a brand new FGT and it got a default OS 7.4.8M.i need to downgrade to 7.2.10M to be consistent in our environment.per checking the upgrade path tool, it is a direct path.since this is a brand new chassis with no config yet, can i safely downgrade directly from 7.4.8M > 7.2.10M?  

Hello Community Contributor, I am facing that FortiPAM disk size issue. I configured VM Size to 8GB for System, 200GB for Log and 600 GB for Video Record.  But if i run exe disk list, it is not like my configuration. It is less than VM Actual size. How can I resolve this? FortiPAM size Thank you in advance.  Best Regards, Henry

I have Fortigate 2201E and want to setup active-active multi-home setup with 2 x ISP for web/app hosting on servers in the datacenter I have 10G from each ISP and will like a truly redundant HA setup that is active-active, not primary-failoverI use cloudflare as firewall/proxy/DNS in front of the fortigate for reference and wanted to check what the best route for this setup is I know most people go for primary/failover like mentioned in this guide https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-SD-WAN-with-Primary-ISP-and/ta-p/268524 by @lcamilo but what i want is active-active setupIs this a common setup especially when not putting a router in front of fortigate and instead want to connect directly to the ISPs from the fortigate.  What i have heard so far is use SD-WAN feature and get ipv4/ipv6 blocks from each ISP. I will be getting /24 ipv4 and /48 ipv6 from each ISP. And then connect each ISP to an interface and set

Hi,We bought an Microsoft Surface Pro 9 which has an ARM processer.The point of buying this was to hook it up with the Fortinet VPN, so we could go anywhere and still be connected.Problem is i can't install it on the Surface Pro 9, due to having an ARM processer.I was wondering if there was any early access or beta for Forticlient VPN for ARM processers that we could try?Or is there any other solution?I tried the Microsoft store app, but that doesn't seem to work with SAML.The VPN connection is SAML with Azure.

I am looking for a best-practice and supported configuration for setting up two FortiGate 901G devices in an HA cluster and connecting them to a Cisco switch stack/cluster using LACP.Environment Details:FortiGate model: 901G (2 units)HA mode: Not decided yet (Active-Passive or Active-Active)Switching environment: Cisco switch stack / clustered switchesLink aggregation: LACP (802.3ad)Objective:High availability at the firewall levelRedundant and aggregated uplinks to the Cisco switch stackStable and supported HA + LACP designAvoid split-brain, MAC flapping, or failover issuesQuestions:What is the recommended Fortinet-supported topology for FortiGate 901G HA when using LACP to Cisco switch stacks?Should LACP be configured using a FortiGate aggregate interface, and should it be created before or after HA is enabled?Is Active-Passive HA preferred over Active-Active when using LACP with Cisco switch stacks?How should the Cisco side be configured (single port-channel across stack members, tr

Hello.I'm moving away from a HP switch (no cli access) and a Sonicwall firewall to the Fortigate side. I have a 91G and 2x148fpoe switches connected.  They are currently configured in Fortiilink and managed so all ports are being managed from the 91G. I have 2 Proxmox servers that I will be moving over to the new environment and am trying to understand how LACP/LAG works on the Fortigate.  It seems similar with Active/passive mode and 'bonding' 2/or more interfaces into the same LAG group so traffic can travel across both if/when needed. I'm trying to understand, and it seems like I would do the following:1. Open the fortiswitch ports tab2. Choose Trunk ports3. Give it a name and add ports either from the same switch, or specific ports on different switches.4. Set the mode to 'active' and hit 'ok'. If I'm thinking correctly then this would set up, say port 1 on sw1 with port2 on sw2, in a LAG/LACP group as active.  Correct? Is that all there is t

Hello team!! We have 2 Fortigates in 2 different sites: FGT80F in site1, and FGT40F in site2I had created a P2P IPsec VPN between both Fortigates some time ago (Connected through Internet)This VPN was working fine for more than 2 years until now.Recently I realliced that although the VPN was up, I couldnt access to anything in the other site through the VPN.  Both Fortigates have Firmware 7.6.4In "Dashboard -> Network -> IPsec", I used the "Bring down -> Entire tunnel" option to "restart" the VPN.After few seconds, the VPN was up again, and started to work (I started to reach anything in the other site through the VPN)After some time (less than 2 hours, IDK how much time exactly), happened the same issue and I "solved" this again by "restarting" again the IPsec VPN, using the "Bring down -> Entire tunnel" option. I cant see any related log.Do you have any suggestion to try to diagnose why did this happen?We didnt change anything recently. Thanks in

Dear Fortinet Support Team,We kindly request your assistance in reviewing the current “Phishing” classification applied to our domain horecathanglong.com .This domain belongs to Horeca Thang Long, a legitimate business operating in the commercial kitchen equipment sector in Vietnam. Our website contains no Phishing, or deceptive content, and we believe this classification is a false positive.We respectfully ask your team to re-evaluate the domain and update its status accordingly.Please let us know if any additional information is required from our side.Thank you for your attention and support.Best regards,Pham Van DoanhHoreca Thang Long CompanyAdd: B1.1-BT101-08, Thanh Ha B, Phu Lương Ward, Hanoi, Vietnam

Hello, I am trying to configure 802.1x authentication on FortiSwitch 148F (firmware 7.6.4) connected to a Fortigate-80F (firmware 7.4.9) using FortiLink but it looks like the FortiSwitch doesn't send any authentication requests to a FreeRADIUS server. I created a firewall policy using CLI as fortilink is not available in GUI, selected "fortilink" interface as source and enabled NAT, policy is also set to allow traffic.I configured RADIUS server on FortiGate, created User Group with RADIUS as a mameber and FortiGate is able to connect to a RADIUS server. Unfortunately when I assign security policy to a FortiSwitch port, the client is not authenticated because FortiSwitch does not send any packets.I thought maybe there is a problem with 802.1x supplicant, so I enabled MAB and still no packets going to RADIUS. I tried to run sniffer in CLI and it doesn't capture any packets.Diagnosed NTP and Fortigate and FortiSwitch say NTP is reachable.  I tested sync status and

Hi EMS adminsStarting from 7.4.4, in addition to the EMS binary installation method on Linux VM, Fortinet introduced a new installation mode which is VM image: a customized/hardened Linux with pre-installed EMS software, where we can't access the Linux shell, and only the new EMS shell is available.My questions are:As there are now 2 installation modes, is there one specific mode that is recommended?As this is the first release with the VM image install mode, is it recommended to install it in production? I mean is it enough stable? Will I find all the commands I need for all kinds of configuration and troubleshooting that I may need? E.g.: Can I check OS and DB log files? Can run tcpdump or similar sniffer command for traffic troubleshooting?I guess the standalone installation mode (with binary file) will be discontinued and the VM image install will be the unique available mode, right? So if I have now a standalone installation in my current prod and want to anticipate by moving to V

Hello everyone,I’m currently working with FortiGate and FortiWeb, I'm new to Fortinet, and I’m looking for a step-by-step PDF or guide that shows how to configure and set them up properly.If anyone has a detailed guide, tutorial, or official documentation in PDF format, I would really appreciate it if you could share it.Thank you very much for your help!

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance ! 

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM applianceWe backup our VMs with Veaam.We have the following settings for most backup jobs.But I'm getting the following error with the Forticlient EMS 7.4.4 server.If the "Enable application-aware processing" option is deselected, the backup completes successfully.Regarding Postgres, I thought it wise to check the "Enable application-aware processing" option.Is a VM backup without this option a reliable restore?