Solved

I have a problem with FortiClient VPN 7.4.0.1658 versionI need connect to the VNP server in local network.My computer with the client do not have internet access.When I am trying to connect I can observe warning message in FortiVPN_1.log:fortivpn::StateMachine::HandlePreflight_EnvironmentCompliance environment does not permit VPN connections: No Internet.In state: TunnelConnectAbortedI do not need internet to connect to the VPN, because the server is in local network.During startup I can observe in this log:fortivpn::INetworkAvailability_impl::Get LAN is available, Internet is not availableIs it possible to configure the client to not use the internet, but only local network to connect to the VPN server?

Hello everybody, we are actually using on a Fortigate (running 7.0.x OS) the SSL Offloading Feature for checking inbound-Traffic (!) to an Web-Server located in our dmz:  config firewall vip edit "Loadbalancer SSL www.example.org" set comment "for IPS on SSL" set type server-load-balance set extip 1.2.3.4 set extintf "wan1" set server-type https set monitor "192.168.1.22" set extport 443 config realservers edit 1 set ip 192.168.1.22 set port 443 next end set ssl-mode full set ssl-certificate "www_example_org 03-23" set ssl-client-renegotiation deny set ssl-client-session-state-type disable next end config firewall policy edit 99 set srcintf "wan1" set dstintf "dmz" set action accept set srcaddr "all" set dstaddr "Loadbalancer SSL www.example.org" set schedule "always" set service "HTTPS" "HTTP" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "my_certificate-inspection" set ips-sensor "my_protect_server" set application-list "my_app_protect_server" se

Hi everyone, thank you for taking some of your time to read this. We switched ISP a couple months ago for a Bell Gigabit Fibe Ethernet. They gave us a HomeHub 2000 that I had to put in bridge mode to stop it from acting as NAT router (first problem). I then setup the WAN1 connection using the Bell credentials in PPOE and I could not get any signal.I called Fortigate support and we setup a DNS using fortiguard effectively creating a domain name linked to our static IP. Is this correct ?  I found two similar threads but neither mention if they have static IP. Ultimately I would like to remove the fortiguard DNS server causing latency.  - Fortinet 40f PPPOE connection fail on bell canada - Fortinet Community   - Technical Tip: Bell Fibre configuration directly o... - Fortinet Community 

Hello, on my FortiGate I have two users as super-admin. Now I want to delete the one named "daniel" - but I cannot do this. There are no references in the GUI visible, and after searching via full-configuration on the CLI there is one entry. But I do not know how this settings came in the past to this, and also this is not visible in the GUI - or, at least, I did not see this yet. Anyway, I have no chance to get this entry changed so that the user is free to become deleted. Please see attached screenshots. Any idea for this? FortiGate 40F (FortiOS 7.6.3) Regards,Daniel 

Hi community, Looking at the following post, it seems FGT-1 sends the SYN to FGT-2 through the LAN switch. https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-HA-A-A-cluster-3-way-TCP-handshake/ta-p/197467 In the following situation, what happens if link 1 goes down? The SYN cannot be distributed from FGT-1 to FGT-2, then does the active-active configuration stop working? If not, what happens?  Regards,Julián

English is not my first language, and I wrote this post with the help of ChatGPT. If any part of this message sounds strange or unclear, please feel free to point it out Our goal:Users connect to Fortinet SSL-VPN.We want to enable split tunneling, so that only traffic destined for AWS goes through the VPN.All other traffic should go through the user's local internet connection.Challenge:Since AWS services use dynamic IP addresses, it’s difficult to keep the split tunnel routing accurate and up to date. Even when we try to add known AWS IP ranges manually, they change often, which breaks connectivity.We also tried DNS-based split tunneling — defining domains (like *.amazonaws.com) instead of IPs — but this approach hasn’t worked reliably either, possibly due to how Fortinet handles DNS resolution and route injection.Has anyone dealt with similar issues? What's the best way to implement split tunneling to AWS services when IPs are constantly changing? Is there a reliable method usin

Hi, Would like to ask what will happen to our billing if the users onboarded exceed to our current subscription of 1000 users? Right now, we onboarded 1200 users. Does this might cause over-subscription and charge us for it?

Hello,I am facing an issue with fortigate firewall in cluster a-p, both are integrated with cisco ise working as Radius server.Suddenly, we are seeing that Radius settings for ISE is failed; saying " can't contact radius server"Fortigate version is 7.2.4however, there is another set of FGT firewalls which are working fine.Only difference is that these firewalls are in DMZ and ISE is behind mgmt firewalls which are working fine. So DMZ Fws talk via transit vlan.

The goal is split multiple JSON events sent in a batch into separate events. Going through the docs available to me, I've gotten to this - <patternDefinitions> <pattern name="patSplitEventsFromAkamai"><![CDATA[\{.*]]></pattern> </patternDefinitions> <eventFormatRecognizer><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></eventFormatRecognizer> <parsingInstructions> <switch> <case> <!-- Individual event format, process like normal --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,\[json\]=<_json:patSplitEventsFromAkamai>]]></regex> </collectFieldsByRegex> <when test="exist _json"> <collectAndSetAttrByJSON src="$json"> <attrKeyMap attr="format" key="format"/> <attrKeyMap attr="version" key="version"/> <attrKeyMap attr="eve

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '

Hi, I'd like to share with all of you a python script to perform full FortiGate config backups. It started as a simple automation for my work two years ago and has become a hobby. Along with today's new release i decided to do this post and maybe help some of you who do this task often. As i no longer have access to an appliance, my tests are done with a FortigateVM. Feel free to try out this tool and share your thougs here. All suggestions, comments and feedbacks are welcome. It requires Python 3.8+ and support FortiOS 6.x and 7.x versions. https://github.com/mcarneir0/fortigate-backup-api 

I'm very new to networking, and I'm a bit over my head. The current situation is we have two firewalls (Firewall 1 and Firewall 2) and two different WANs (VDOM Prod = 1.2.3.4/32, VDOM Nonprod =5.6.7.8/32) on physical ports on Firewall 1. There are no WAN connections are Firewall 2, so when there's a failover, we lose connection to the outside.  My end goal is to have a physical port on each that can support both VDOM WANs without adding more physical WAN drops to the greater network. So, here is my concept:Firewall 1:Physical Port-1 1.2.3.4/32 (Prod VDOM)   VLAN 5.6.7.8/32 (NonProd VDOM)Firewall 2Physical Port 2 5.6.7.8/32 (NonProd VDOM)   VLAN 1.2.3.4/32 (Prod VDOM)Is this a feasible solution? Should I make the connection identical?  Thank you for your time. 

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.

Hello, So i have a problem and cant solve without some help. We have two Fortigates, Main office (Site A) and the new one (Site B). I connected them by IPsec tunnel, with ph2 address 0.0.0.0/0 to both sides. Tunnel is up and working fine, but now i want to route two local subnets  of SiteB to go to internet over SiteA. and other subnets go to internet from local WAN. Topology: 10.20.1.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.20.2.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.99.99.0/24 -> SiteB FTG ->Internet I am trying to use policy routes but its not working or i am doing something wrong. Any help would be nice. 

Hi all, I have setup a new Fortigate 1101E cluster with FortiOS 6.2.10. Now I'm trying to configure radius authentication for administrators but when I try to set as source-ip the IP of the MGMT interface I get this error: x.x.x.x is not valid source ip.node_check_object fail! for source-ip x.x.x.x value parse error before '10.119.254.120'Command fail. Return code -8 What am I doing wrong? Thanks,M. 

Dear All,We are having following issue ClickHouseServer service on the worker is currently down, and no incidents or events are being ingested.Could someone help me to solve this issue ?  What could be the possible reasons for it ?@Anthony_E @Secusaurus   please help  

Hi Everyone! Would like to ask if anyone had experience connecting a breakout cable LC to Fortigate 200FThe breakout Cable in question is the HPE/Aruba K2Q46A MPO to 4 LC.This will be connected on an Aruba Switch using JH233A MPO Qsfp+ so the LC side will be on the Fortinet using a fortinet 10GBase-SR  Sfp+ transciever FTLX8574D3BCLFTN.Would this work having the Aruba switch do the splitting to 4x 10G per breakout cable? Your thoughts on this is much appreciated. Thanks 

Need to shift traffic on MPLS when Packet loss & latency has been increased.Currently when both the link get down traffic is being shifted but we want to shift the traffic when packet loss & latency has been increased.

I have already enable radius on fortigate and fortinac and then the connection is successiful.But when guestusers authenticate from wireless NAC radius log  show like as below i have attached   

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hello All, I'm configuring FortiSIEM 7.3.0, but some of the use cases aren't clear to me, and I kindly request some advice about whether the following use cases are possible to configure and display on the FortiSIEM dashboard. if so, please give advice, or does it need some other solution to be integrated as a source? Insider Threat & Lateral MovementEnable detection of unusual user activity (e.g., access to sensitive data). Correlate logins from multiple locations within a short time frame. Flag mass file downloads from internal systems. Vulnerability scan and\ assesment Identify the Vulnerability of the assets Regularly Test Security Systems & ProcessesDetect failed or overdue security scans. Alert on new vulnerabilities detected in PCI systems. Track & Monitor All Access to Network Resources & Cardholder DataEnable File Integrity Monitoring (FIM) for critical cardholder files. Configure correlation rules for unauthorized d

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.