Solved

Currently we have a Cisco Firewall that has multiple NAT rules for Citrix applications. Now we are adding a Fortigate FW in front of the Cisco Firewall and it blocks Citrix applications. Do I need to create the same NAT rules on the Fortigate FW or could I create a range to allow all the NAT rules through the Fortigate. What would you suggest? 

Hello everyone!I am having this problem with my FGT 80F release 7.6.2F build 3462, using a Fortinet SFP model FN-TRAN-SX.Below is my environment:- The device connected on the WAN 2 interface only supports speed 100 full.- Whether connected via copper or fiber the WAN 2 interface is always set speed to 100 full.- The device connected on the WAN 2 has only one fiber NIC. The connection to WAN2 copper interface is made through media converter.Fault description In the current release, the device connected on WAN2 is only seen if it is connected in copper, while the WAN2 interface in fiber remains switched off even if we disconnect the copper cable in the branch, following output when only fiber cable is connection on WAN2 interface FGT-80F-1 # diagnose hardware shared-port wan2Get nic name: wan2 medium type 2, Copper even in the case of both cables disconnected on WAN2 the output of the following command does not change, as per your documentation (ART ID 33393

Hello, I am trying to create an SD-WAN Overlay template but hub field keeps showing None when I try to populate it. Please any ideas on what could be causing this? I'm running  FortiGate 7.6.4 and  v7.6.4  for the FortiManager. Please has anyone encountered this before or any ideas on what to do   Thank You  

Hello! Trying to sort this out a common(?) scenario with a DNAT in an SD-WAN configuration. DNAT is configured in WAN1, inbound rule has SD-WAN zone as incoming interface, inbound traffic to the DNAT works (webpage service loads normally).  SD-WAN rules for catch-all traffic (Internet bound) is set to manual, with WAN2 as preferred interface, followed by WAN1 as backup.  When traffic is originated from the target server in the DNAT, it gets NAT'd to the proper interface (WAN1), however the traffic is being steered through WAN2 due to the SD-WAN ruleOnly way that's working if an SD-WAN rule is above the catch-all with WAN1 as outgoing interface for this server only.  Is this the expected behavior? Any other options to get this working without the extra SD-WAN rule? PBR (WAN1 in WAN1 out, WAN2 in WAN2 out)? Auxiliary sessions and Asym traffic have been checked.   Running 7.2.11 on a 100F in this scenario.  TIA!

Hello FNAC admins,Does the L2 and L3 polling in FortiNAC depend on the network type selected (Layer 2 or Layer 3)? For example, if I choose Layer 2 as the network type, will only L2 polling be used?BR,  

Hi Community,I recently upgraded my FortiSIEM deployment from version 7.4.0 to 7.4.2. In 7.4.0, I was using Automated HA (HA V2) with a Virtual IP (VIP) setup, which allowed customers to access the system via a common IP address. This made centralized access and management straightforward.However, after upgrading to 7.4.2, I noticed that VIP is no longer available as part of the HA configuration. I understand that HA V3, introduced in 7.4.1, improves upon HA V2 and eliminates the need for VIP or DNS configuration.My questions are:How can I now provide a centralized access point for customers without VIP?What is the recommended approach to make this understandable and seamless for customers, especially those used to accessing the system via a single IP?Is there any best practice or workaround to simulate the previous VIP behavior in HA V3?Any guidance or shared experience would be greatly appreciated!@Secusaurus @Anthony_E can you please help here.Regards,Arif

Hello, I am skeptical of purchasing a registered and licensed FG-60 F (  expires  12/2025  )  but need to know if the license can be transferred to a FG-300E . Am upgrading from Cisco ASA5540 to Fortigate FG. Please advise.Best RegardsDavid

Hello, I work for a company with 3 office sites. There are about 30 peoples working on each site.We are planning to replace our actual firewall solution with 3 clusters of 2 Fortigate 70G or 90G and "Enterprise" licences. During my information research regarding the different models and licenses to be sure to make the right choice, I've found this article:Single FortiGuard license for FortiGate A-P HA cluster 7.4.6 The problem is the last Firegate generation (xxG) are not listed in the compatibility list. Do you know if it's planned to propose these kind of licence for the xxG series?I asked to the support but didn't received any response...Thanks.

Himy FG 60F v.7.0.14 is not sending any syslog at all to the configured server. This is a brand new unit which has inherited the configuration file of a 60D v.6.0.14 and was then updated following the suggested upgrade path. I already tried killing syslogd and restarting the firewall to no avail. sg-fw # config log syslogd setting sg-fw (setting) # showconfig log syslogd settingset status enableset server "172.17.100.16"set interface-select-method specifyset interface "management"endsg-fw # get log syslogd setting status : enable server : 172.17.100.16 mode : udp port : 514facility : local7 source-ip : format : default priority : default max-log-rate : 0interface-select-method: specify interface : managementDestination is reachable:sg-fw # exec ping-options source 192.168.101.254sg-fw # exec ping 172.17.100.16PING 172.17.100.16 (172.17.100.16): 56 data bytes64 bytes from 172.17.100.16: icmp_seq=0 ttl=63 time=3.0 ms64 bytes from 172.17.100.16: icmp_seq=1 ttl=63 time=2.7 ms64 bytes

Hello NAC admins,My question is, which scenario is recommended, FortiNAC acting as DHCP server for isolated devices or Fortigate acting as a DHCP server ?BR,

Hello NAC admins,I would like to know which network type is recommended in FortiNAC configuration, Layer 2 or Layer 3 ? What's really difference between the two ?Thanks in advanceBR,

I have installed FortiClient VPN on two Win 11 machine, one on a domain the other one as a separate workstation. First, I don't know why but you need to add the FortiClient to the firewall either manually or through some gpedit modifications, crazy extra process! Can't it just show a pop up like other apps to ask for network access?Anyway, the computer on the domain is still struggling to connect to the SSL VPN server. FortiClient has been added to the firewall on the machine. The configuration is 100% correct on FortiClient. And, if you are asking for the error message, there is not. After entering user and pass and pressing connect button, it immediately shows the disconnect button. Additionally, if you hit disconnect button, it turns to "disconnecting..." and just freezes there and you need to "X" FortiClient.   What I expect or what I usually see on FortiClient on other machines is to show a percentage on the top and ask for MFA.I used the same login creds

I have a Fortigate firewall. The management IP block is 172.16.1.1/24.Fortianalyzer(172.16.1.10) is in this range.. I have an SMTP server, and only the IP address 192.168.1.100 is allowed to access it. I can access the SMTP server by NAT my 172.16.1.10 server. However, I cannot access the SMTP server using the Fortigate management interface (172.16.1.1). NAT is not working.

Hi Team,I’m currently working on a custom parser for Cisco FTD logs in FortiSIEM, but I’m facing an issue where the events are still being shown as “Unknown Event Type” even though the parser validation is successful.  These are the logs being ingested from the FMC:<46>Oct 22 10:09:04 FTD1: IPRep.pl: csm_processes@Default User IP, Login, Login Success<46>Oct 22 10:03:28 FTD1: cluster_plug.pl: csm_processes@Default User IP, Login, Login Success<46>Oct 22 10:03:26 FTD1: vpn_plug.pl: csm_processes@Default User IP, Login, Login Success<46>Oct 22 10:03:22 FTD1: deploy_telemetry.pl: csm_processes@Default User IP, Login, Login Success<46>Oct 22 10:03:19 FTD1: devices_plug.pl: csm_processes@Default User IP, Login, Login Success<46>Oct 22 02:00:00 MFTD1: sfdccsm: System@Default User IP, Purge, System purged 0 number of Deployment Jobs  <eventParser><eventFormatRecognizer><![CDATA[.*FTD1.*@.*]]></eventFormatRecogni

Hello,i need to move my on premise Fortianalyzer to Azure.How can i move my license actually associated to the on premise faz to the new one on azure?Is it feasible?I would like to do the following: create the new faz on azureimport the old faz configuraziontransfer the on prem license to the new azure Fazchange the ip on all the fortigates to the new Fazbe able for a short period to access the on prem faz to see the old log (i.e. for two weeks), i these case i need a trial license or because it's receiving no logs i'll be able to access the machine with no license?haven't found documentation about transferring the licence, so i think i just need to go on my forticloud and change the serial number of the old on prem faz with the new one, is it correct?And at which stage of the deployment should i select the BYOL ? Thank youRegards

I have a FortiGate71F (v7.4.8 build2795) "FortiLink'ed" to a FortiSwitch124F (7.6.1-build1047)I have a Dynamic Port policy:config switch-controller dynamic-port-policy edit "typcialdevices" set description "A port policy for typical devices we know about." set fortilink "afortilink" config policy edit "forti-aps" set description "The FortiAPs" set mac "b4:b2:e9:*:*:*" set hw-vendor "Fortinet" set family "FortiAP" set vlan-policy "vpapmgmt" next edit "pmsi-default" set description "LAST policy rule. This indicates the default properties for any" set mac "*:*:*:*:*:*" set 802-1x "nps-even" next end next endI have a Security Policy:config switch-controller security-policy 802-1X edit "nps-even" set security-mode 802.1X-mac-based set user-group "nps-radius"

We received this notification from our Fortinet support team regarding SSL VPN tunnel mode.is this referring to SSL VPN for users using forticlient SSLVPN or site-to-site IPSec VPN tunnel ?We are still using SSLVPN mode in our forticlient VPN.SSL VPN tunnel mode replaced with IPsec VPNStarting in FortiOS 7.6.3, the SSL VPN tunnel mode feature is replaced with IPsec VPN, which can be configured to use TCP port 443. SSL VPN tunnel mode is no longer available in the GUI and CLI. Settings will not be upgraded from previous versions. This applies to all FortiGate models.To ensure uninterrupted remote access, customers must migrate their SSL VPN tunnel mode configuration to IPsec VPN before upgrading to FortiOS 7.6.3 and later.See Migration from SSL VPN tunnel mode to IPsec VPN in the FortiOS 7.6 New Feature guide for detailed steps on migrating to IPsec VPN before upgrade.A complete migration guide can be found in the following links:For FortiOS&

Hi all,  We are working through setting up SOAR platform. We noticed that many connectors are referencing dependencies on solution packs which are not of relevance to us. Is there a way to install the connectors without the Solution Pack dependencies?FortiSOAR Thanks, S

Hi folks, is there any way to re-send the activation email via FortiManager? The customer says it happens very often that this email is not received when a new user is added. When I tested it, email sending from FortiGate (version 7.4.8) worked fine. Platform Type : FMG-VM64Version : v7.4.7-build2685 250527 (GA.M) I know how to re-send the activation email from FortiGate and I also know how to find the activation code in the logs on FortiGate. I'm only asking if there is a way on FMG for this one customer. Many thanks in advance! FortiManager FortiToken  

I’m trying to create a policy to block IPs from the EmergingThreats list using an External Connector feed, but it doesn’t seem to be working as expected.I have an External Connector > IP Address External Feed configured, and it shows approximately 1500 valid entries.Connection Status 2025/10/28 08:31:32Last Content Update 2025/10/27 16:31:24Entries 1490  Valid  I can view the entries, and if I manually test one of the IPs by browsing to it, the connection succeeds, it’s not being blocked. If I add a single IP address directly to this rule, it does block that address correctly. However, when I rely on the external feed, it does not block any of the listed IPs. I’ve also tested with other external IP lists, and I’m seeing the same issue.Is there something wrong with my configuration, or should I be implementing IP blocking in a different way?Here’s the policy configuration I’m using:config system external-resourceedit "Emergingthreats-block-IPs.net"set uuid 05a9ff8e-cf9

Hi I have an issue with change SSL to IPSec configuration.I follow instruction to build FortiClient Dial UP connection.https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Dialup-IPsec-VPN-Split-Tunneling/ta-p/192207I have an issue with split tunnel, on windows enviroment doesn't appear single routes that assign via split tunnel but only default router. From android trablet it seams work. I am created n°2 policy,1st Dial Up Tunnel -> Local LAN                                       OK2nd Dial Up Tunnel -> to other IPSec tunnel                  KO 2nd policy doesn't work, in diag I see the packet sent but i can't receive answer What can i test? 

Hello team!!! We have a Fortigate 100F with many IPsec VPNs for FortiClientI configured all IPsec VPNs with IKE v1 and allways used an AD group synchronized in the Fortigate for user authenticationAlso, I use the peer ID field to select an specific VPNAll these VPNs are workingNow I created an IPsec VPN with IKE v2, but when I try to connect, I get an error:In FortiClient: Wrong Credentials EAP failed connecting to VPNnameIn Fortigate: date=2025-07-23 time=16:06:15 eventtime=1753297576267021760 tz="-0300" logid="0101037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.3.5.7 locip=1.2.3.4 remport=4500 locport=4500 outintf="port9" srccountry="Argentina" cookies="b51c1f1809859ab8/7f365d0b1f864add" user="1000" group="N/A" useralt="N/A" eapuser="testdomain" eapauthgroup="N/A" assignip=N/A vpntunnel="IPsec-dom-W3" status="failure" result="N/A" peer_notif="NOT-APPLICABLE" fctuid="E2D4BA7

Hi everyone,I’m currently facing an issue in FortiSOAR. I’ve created a playbook that works fine, but it requires a manual trigger every time a new alert is created.My goal is to have the playbook run automatically whenever a specific type of alert is generated from FortiSIEM (for example, based on alert name, severity, or category).Could anyone please guide me on how to configure FortiSOAR so that the playbook is automatically triggered based on certain FortiSIEM alert criteria?Thanks in advance for your help!

We have some clients using the Forticlient VPN who get looping at 98%. Others are connecting with no issues.The login is set up to use SAML from EntraID. They successfully log in and this can be seen in the EntraID logs. The connection process gets to 98% and the user is prompted to log in again. I have tried this on a failing device with both the latest 7.4 version and with an old 7.0.8 version and get the same result. The FortiGate the VPN connects to is running 7.4.9.Checking the logs on the FortiGate, there is no indication that the user attempted to connect. Checking the event viewer on the failing client there are no errors listed refering to the FortiClient or for the time the login was attempted.The clients are all Windows 11.I did find one article about setting the global ssl_vpn_webmode to enabled but this was already set when I checked.

I have a customer using FortiSiem Cloud version 7.3.4, the customer wants to integrate Google Soar via API with FortiSiem, there is documentation from google regarding this integration:   https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/fortinet-fortisiem?hl=es-419   We created a user with full admin permission, but when we try  the connection from google Soar we see a 401 not authorized response, according the fortisiem cloud documentation the API is supported with some restrictions.   Differences between FortiSIEM Cloud and FortiSIEM | FortiSIEM Cloud | Fortinet Document Library   I would like to know if someone have done this integration in the past, and maybe what are we missing in the configuration.