Solved

Hi,  We have configured password policy for both admin and ipsec preshared key as below conf system password-policyset apply-to admin-password ipsec-preshared-keyset expire-day 90set expire-status enable Now the strange behaviour is, after 90 days we really didnt get any notification about ipsec preshared key expired neither IPSEC tunnel went down. We tried shutting down the ipsec tunnel and still the old key was working. There is no clear documentation about this in fortinet public document..This is working fine for admin-password where after 90 days, its prompting to change the password. With this scenario, can we assume that this password expiration is applicable only for admin password and not for ipsec preshared key??.. Please clarify it.. RegardsRaja 

Hi,I manage several firewalls using FortiManager, and I’d like to automate the regular backup of each firewall’s configuration. So, how can I set up this automation within FortiManager to export all managed firewall configurations to SFTP?  FortiGate FortiManager 

Hello and sorry for my english, In fortiauthenticator i created captive portal. All works very well ! But now i want to change logo on portal but when i go to 'administration' -> 'images' the button 'create new' is gray out. So i can't do nothing ! I can edit or delete images but not create. I am connect with admin account, i tried with other administratror account : same problem.thanks for help

 I have a virtual IP configured on Fortigate, and I can access the server via the virtual IP from any network, even from my cell phone.From the local network that goes through Fortigate, I also need to access the virtual IP via the browser, but nothing appears on the page.The interface IP address is in the same segment as the virtual IP, and all segments use the same link to navigate.I hope you can help me identify a possible problem.

Hello, Is there any way of determining whether there will be a FortiAP v 7.4.x release that fixes bug ID 1060165: The FAP-231G/233G/234G 2.4GHz radio would stop SSID beaconing? I know there is a 7.6.2 fix for this, however it requires FortiOS 7.6.3 to ensure compatibility and I'm not confortable to push that FortiOS release out yet to production FortiGates. Thanks,

Hello,My account manager has told me that since we have replaced our Fortigate via RMA, that we can't renew support for the replacement device when the contract expires. This doesn't seem right. It's a 101E and is still a supported device.  Any thoughts?

Hi,I have FortiSwitch 108 POE connected to 40F and being managed by the 40F.I didn't configure any password for the fortiswitch - and connected to the FortiLink.yet - I understand that it is needed for manual configuration.is there a way to configure it ? or do I need to reset it ?

 Hi,  I have Fortegate 100F with OS 7.4.x I configured SSO with EntraID successfully and login was working.  I have a questions.Q) Can I use more than one entra id group for separate vpn portal and policy. A user member of group A and assigned the portal A and apply policy A, and B user member of group B and assigned the portal B and apply policy B And I have in troubleT) User can login was successfully with Entra ID, and connected.But SSL VPN client didn't receive internal routing table, only DMZ routing table was received.It add routing table in manually 'route -Add xxx -mask...' then it can be communicated.Anyone have solution like issue, please help me. Thank You. 

I was wondering as for SQL or XSS attacks fortiweb has 3 options for detections what is the order of operations ? Is it first signatures then Syntax Detection and  then attack ML models that are build on the appliance itself after time from the passed traffic? Also what happens it an attack matches all 3 options? My final question is for SQL injection and XSS attacks shouldn't signatures be stopped and just Syntax Detection and attack ML models to be used as I have read that they have less false positives ?  

Hi, We have two Sites, Site A and Site B already connected by telephone line(old), so they share the subnet ip address, now we want to have a VPN tunnel as a Backup with two Fortigate on each side, we cannot change the subnet ip address,  Configuring Site-to-site IPSec VPN in Central SNAT mode with overlapping subnets doesn't work because this will change to new IPs, which is the best solution for this?

Hello team!! I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point thi

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. From the FortiGate, I can ping the ISP gateway successfully.However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.Here’s what I’ve checked so far:Ping is enabled on the WAN interface (set allowaccess ping is configured).The interface is up, IP is correctly assigned, and the cable is physically connected.No local-in policy is blocking ICMP.No trusted hosts are configured under the admin settings.Subnet and default routes appear correct.and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

I have played with FortiWeb trial VM and the demo center (FortiWeb Demo) and after reading some docummentation and watching (9) FortiWeb API Protection: Overview - YouTube and (9) FortiWeb - Machine Learning Based API Protection - YouTube I see that FortiWeb has ML for API discovery but what about discoverying if API endpoints don't enforce authentication or authorization or using weak authentication? The traffic could be legitimate but the devs in some cases by mistake don't enforce API autentication/authorization on some API endpoints or a forgotten old version of an API URL endopoint (shadow API). Can FortiWeb see the requests and still after time with Anomaly detection make suggestions for API security improvement even if all the requests don't have authorization header (not a deviation but still a security issue) ?

Hello,  I played with fortiweb trial Evaluation limitations | FortiWeb Private Cloud | Fortinet Document Library and demo https://fortiweb.fortidemo.com/ and I also watched FortiWeb API Protection: Machine Learning based Protection but it is not clear if FortiWeb can  generate swagger or openapi file based on ML/AI learning of the API traffic? Maybe if not the on-prem appliance (vmware or in a cloud like AWS/Azure) if the FortiWeb cloud can ?

can we deploy the User Based policies in similar way we were able to do onsite Active Directory integration using SSO. We normally use FSSO agent for that on AD server, how can we do that on Azure. PS. I am not talking about forticlient or VPN usage here but actual firewall rulebase using the User Groups. 

Hello, I'm reaching out as I couldn’t find the proper place to submit feature requests on the Fortinet website (such as support or partner portals). Therefore, I'm sharing this feedback here in the community forum in hopes it reaches the appropriate team. One of my customers operates a network with approximately 100 FortiSwitches, all integrated via FortiLink with FortiGate. Managing ACLs on FortiSwitches in this environment has been extremely frustrating. Here’s the issue:I want to apply ACLs that allow or deny traffic based only on destination service ports, while keeping source and destination IPs as 'any'. This is a very common requirement in real-world environments. However, this configuration is not possible when the FortiSwitches are managed by FortiGate via FortiLink. The managed FortiSwitch ACL configuration lacks the ability to define service ports. There is also no option to disable FortiGate control over ACLs, which means that even if I manually con

For some reason the  XSS or SQL injections are moved to a seperate WAF profile in Fortigate and not in the normal IPS functions but I saw the below article: Stream-based antivirus scanning for HTML and Javascript files | FortiGate / FortiOS 7.6.0 | Fortinet Document Library      As I have test fortigate I confirmed with proxy mode rule and WAF feature enabled that basic web attacks are detected but in the newer trial versions proxy rules can't be used because of the RAM limit, so I can't test if now the newer versions can scan web traffic with a flow rule not only for antivirus.  If anyone can confirm if not now then in the future flow mode rules will support WAF profiles it will be great as at the moment even the waf profile is not visible under flow rules in the trial option!   I know that FortiWeb is a true WAF that has auto policy building with url, header and parameter learnings, API protections and discoveries, Java

Hi all, we want to switch our FortiClient dial-up connections from IKEv1 to IKEv2, but we are having problems with this. I have created a new IKEv2 Test-VPN on the Fortigate and a test user that is authenticated via RADIUS. Everything in the setup works fine with IKEv1, but as soon as I change the parameters to IKEv2, the login fails. Device is a FortiGate 300E cluster with OS 6.0.10, I tested with different FortiClient-VPN versions from v6.4 to 7.0. Here is what an IKE debug shows me: ike 0: comes 178.2.99.151:64916->20.30.40.50:4500,ifindex=11.... ike 0: IKEv2 exchange=AUTH id=xxxx/xx len=80 ike 0: in xxx ike 0:IKE-v2:31239: dec xxxA65 ike 0:IKE-v2:31239: responder received EAP msg ike 0:IKE-v2:31239: send EAP message to FNBAM ike 0:IKE-v2:31239: initiating EAP authentication ike 0:IKE-v2: EAP user "testuser" ike 0:IKE-v2: auth group IKEv2-Users ike 0:IKE-v2: EAP 1195273714 pending ike 0:IKE-v2:31239 EAP 1195273714 result 2 ike 0:IKE-v2: EAP challenged for user "testuser

Hi Community  Is there anyway to enable Dynamic Threat Detection on the FortiSASE managed Forti Client   Thank You, #FortiSASE

I have the following working Dialup IPsec config working for one of my SAML user groups and now I am trying to expand it to cover other SAML groups.config firewall addressedit "OpsVPN-US2_range"set type iprangeset start-ip 10.254.128.1set end-ip 10.254.128.254nextendconfig firewall addrgrpedit "OpsVPN-US2_split"set member "Internal_10.0.0.0/8" "Internal_172.16.0.0/12" "Internal_192.168.0.0/16"nextendconfig vpn ipsec phase1-interfaceedit "OpsVPN-US2"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes256-sha512set dhgrp 20set eap enableset eap-identity send-requestset wizard-type dialup-forticlientset transport autoset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsVPN-US2_split"set ipv4-name "OpsVPN-US2_range"set save-password enableset psksecret ENC *******nextendconfig vpn ipsec phase2-interfaceedit "OpsVPN-US2"set phase1name "OpsVPN-US2"set proposal aes256-sha512set dhgr

 Hello everyone,I have two Fortigates:A Fortigate 60F and a Fortigate 70G.On the Fortigate 60F, there is a WiFi network, where I reserved the IP address 172.16.10.110.The Fortigate 60F is connected to the 70G via a link and a static route:  All traffic destined for the 70G must pass through the 60F.Conversely, on the 70G:   The connection works well, everything works fine.Now, I tried to restrict access to the 60G GUI (https://10.0.1.0:40443) using two local-in-policies: config firewall local-in-policy    edit 1        set uuid 5c0a2180-47a5-51f0-1e8d-733b986f1a94        set intf "any"        set srcaddr “My_IP_ADDRESS”        set dstaddr "login_group"        set action accept        set service "HTTPS-40443"        set schedule "always"    nextedit 2        set uuid 71f5a26c-47aa-51f0-2

I have a home lab environment, and I have created a VIP for my Citrix Lab with NetScaler frontend. Regardless of what I try traffic to the VIP is being dropped based on debug view, but I don't see any traffic in the logs. This used to work with another service but that stopped working as well. Fortigate-70FFirmware: 7.6.1   Debug Trace 2025/06/12 09:31:54,"vd-root:0 received a packet(proto=6, X.X.X.X:30212->X.X.24.153:8445) tun_id=0.0.0.0 from wan1. flag [S], seq 3633665461, ack 0, win 65535"2025/06/12 09:31:54,allocate a new session-0005eb2b2025/06/12 09:31:54,"in-[wan1], out-[]"2025/06/12 09:31:54,len=12025/06/12 09:31:54,checking gnum-100000 policy-10612025/06/12 09:31:54,"result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000"2025/06/12 09:31:54,find a route: flag=80000000 gw-X.X.24.153 via root2025/06/12 09:31:54,"in-[wan1], out-[], skb_flags-02000000, vid-0"2025/06/12 09:31:54,"gnum-100017, check-ffffffbffc02ca54"2025/06/12 09:31:54

Hello Folks, i need to deploy 2 ipsec vpn for remote access.the ip address of each client is associated in the radius server (NPS) as radius attribute, how can i replicate this configuration for ipsec?i read i need to enable the "set mode-cfg enable" and "set assign-ip " commands, unfortunately as per the configuration below, i'm unable to change the latter commad (in gui i'm returned "-1: Invalid length of value" as i set the group, and in cli i can't edit nor delete it).furthermore i need 2 vpn, the first allowing user to use split tunnel and the other denying it, how can i achieve this scope?is it possibile?For the ip assignment i don't have fortiauthenticator so i'm forced to use the NPS. FORTIGATE (phase1-interface) # showconfig vpn ipsec phase1-interface edit "VpnRaNoSplit"set type dynamicset interface "Wan_vpn"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 10.2.22.18set proposal aes256-sha256set dpd disableset dhgrp

I have two Fortigate devices: FG1 and FG2. There's a tunnel between them, with a computer connected to the LAN port on FG1 and a file server on FG2. I would like FG1 to resolve the domain to an IP address, which is why I set up a DNS server on FG1. Now, the question is: what should I enter in the DNS Forwarder, and should I check "authoritative"? I don't know what that means, but I think I should check it because I don't want the query to go to the internet, but rather to stay within my network. The DNS forwarder is set to 8.8.8.8, and it works, but I don't know why. If I set the DNS forwarder to 8.8.8.8, I understand that addresses not found in the local database will go to the internet. But why does it work if I'm setting up a new zone? Shouldn't this option be in DNS Service on the interface, not in the DNS database? And when I add a second zone because I want it to resolve another domain, what should I enter in the DNS forwarder? When I leave it blank, everything still works,

I have a problem with FortiClient VPN 7.4.0.1658 versionI need connect to the VNP server in local network.My computer with the client do not have internet access.When I am trying to connect I can observe warning message in FortiVPN_1.log:fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: No Internet.In state: TunnelConnectAbortedI do not need internet to connect to the VPN, because the server is in local network.During startup I can observe in this log:fortivpn::INetworkAvailability_impl::Get LAN is available, Internet is not availableIs it possible to configure the client to not use the internet, but only local network to connect to the VPN server?