Solved

Is there an option to add per device mapping for VLANs in FortiSwitch Manager ? I do not want to add it one by one using GUI.

Hello, I'm running FortiClient EMS 7.4.3 with a FG-120G on version 7.4.7. I've configured some ZTNA access on the FortiGate, and it works like a charm. Now, I'm trying to push the ZTNA connection through EMS. The great thing is, my ZTNA applications are automatically detected since my FortiGate and EMS are connected via a connector. My problem is: when I try to create an application, I can't see those gateways. And of course, if I try to create a new gateway with the same IP, I can't.  In the ZTNA destination profile, I see both of my auto-detected applications, but they're not being pushed to the EMS client. So, I'm a little lost here — the "Web Proxy Rules" are not being pushed to the client, and I can't create a rule because I can't create an application, since I don't see the gateway. I was able to create an application with a fake gateway, download the XML, modify the gateway, and re-upload it. But I'm pretty sure it shouldn't be that c

i have fortigate 40F and i'm trying to access the firewall on web browser but it's not opened ! i connect the firewall through fortigate port 1 to computer by ethernet, the ping was okay but its not opened the log in page ! please help me to log in the firewall. Thank you GG FortiGate #support #all 

HiI have a pair of Fortigate 200F running 7.2.3, when i try to configure log disk setting, the option doesnt seem to be availablePlease refer to the screenshots below

Hello Fortinet Community,I’ve configured two identical IPsec remote access VPNs on my FortiGate—each mapped to a different WAN interface for redundancy purposes. On FortiClient, I’ve added both VPN gateways. The issue I'm facing is that when I disable WAN1, FortiClient does not automatically failover to the second gateway. Instead, I have to manually reconnect by clicking "Connect" to establish a session with the secondary gateway. I'd like to know is it possible  to automate this failover process, so users experience minimal disruption? Is it possible to achieve automatic remote access VPN failover in FortiClient without using EMS?Thank you! 

hiI have a server configured as a vip in my fortigate to be accesses from internet. I want to block it's admin page. (my.domain.com/admin) . I tried the policy with deep packet and ssl inspection along with creating a webfilter and blocked *\admin* but still admin page reachable from internet. how can i block admin page?

Hello, everyone. I have a question. The client ZTNA has 1,500 terminals, and each terminal may have two USB mobile devices. The client's requirement is to release them in a whitelist manner. However, with so many mobile terminals, the workload is a bit large. For the mice of the same brand purchased in the same batch, information such as USB Type, Vendor ID, Product ID, and Firmware Revision is still different.I have several questions:Question 1: Is there any way to avoid manual entry one by one? The workload is too large. Question 2: Can the whitelist be released based on a certain brand? For example, HP and Dell mice, Panasonic USB drives.Question 3: For the control of such a large - number of mobile external USB devices, are there any other good suggestions?References:https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-properly-identify-USB-devices-to-configure/ta-p/339955                          

Hello, We recently started migrating our SSL-VPN to IPSec. Something we just noticed is that the IPSec setup is not fully compatible for iOS version of FortiClientVPN application. FC VPN at its latest version for iOS devices supports IKEv1 only on Main Mode (we went with aggressive mode on our initial config).For remote users authentication we’re using a FortiAuth server that communicates with the firewall using RADIUS and to the AD Servers using LDAP. FortiAuth checks if the user exists on AD and then sends an authentication token to the user for 2FA. We started noticing that the last part with the authentication is problematic for FC v7.4.6 on iOS devices and after investigation with Fortinet they informed us that FC VPN on iOS rejects the authentication packets and drops the tunnel afterwards. For testing purposes, we disabled the 2FA option within the ForitAuth for the spesific user we login and the tunnel was able to connect succesfully without authentication j

Hi, We have two firewalls located in different locations: Firewall A and Firewall B. Both setups include an L3 device positioned between the LAN and the firewall. In Firewall A, the relevant subnet appears as directly connected, whereas in Firewall B, the subnet is marked as statically connected. This indicates that in the Firewall B setup, the switch acts as the gateway, causing the firewall to receive the MAC address of the L3 device instead of the end-user device. However, in the Firewall A network, even with the L3 setup, the firewall acts as the gateway for the subnet, enabling it to detect actual client MAC addresses and enforce MAC-based policies. Consequently, MAC-based policies do not function in the Firewall B setup because the L3 device serves as the gateway. In contrast, these policies work in the Firewall A setup, where the firewall directly receives the MAC addresses of the client devices.  FortiGate 

I generated a CSR on one of my Fortigate firewalls that contained over 10 SAN's entries, the certificate was signed by my internal company CA, I then imported the PEM into the Fortigate firewall successfully to use for HTTPS access, then by mistake I deleted the Certificate off the firewall instead of downloading the cert! My signed PEM file doesn't have a private key, I have a PCKS#7 cert, der and cer from my PKI team. But I do not have the private key anymore is my guess after deleting my imported signed Cert on the Fortigate. On another SAN Firewall where I need to install I import any of these signed cert formats, error is "duplicate mismatch" I gather because the signed cert doesn't have the private key and I should be downloading the imported cert from the Fortigate that imported the signed cert where the CSR was generated to the other Firewalls! Any there any way I can install these signed certs on my SANs Firewalls or do I need to generate another CSR again?&nbsp

I like to generate a weekly report that includes any active FortiGate-Policy filtered by some keywords in their name.I'm able to query them from $log-traffic, but obviously this gets only the policies with traffic.Is there a table that includes the configured policies regardless of them having traffic or not?

Hi , I'm Currently facing an issue with My Fortinac-VM i already Download the new version 9.4.7 but when i press install it's sending me to the page to start the download when i press it nothing happen any suggestion  

Hello,I have to go through the "Automatic Patch Upgrades" wizard each time I connect to my FortiGate. I am using version 7.4.6 of FortiOS.Does anyone know the solution to this problem?

Hello,I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.Could you please provide information on how automatic updates are handled in this setup?As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?I would like to perform updates manually when I want, and I do not want automatic updates to be applied.Is there anything that needs to be configured separately on the FortiManager side? Thaks all.

Hello, I have been search the posts here and I am seeing a few different replies to this.Can some one please clarify the reason for this error? One suggests Adding the ip hostname of supervisor to  /etc/hosts. Is that all that has to be done?   I still get the error when I select to down load to the client, does some DNS cache need to be cleared or something?  Another suggests In some of these cases we will need to see the error from the Collectors side. There are 2 locations for collector upgrade logs to find out why the collector failed : /usr/local/upgrade/logs/ansible.log /opt/phoenix/log/collector-upgrade.log  we will need to see why Your have 3 options 1- Spin up a new collector in the customers environment with the build that we need This will bypass the upgrade all together and just spin up a new collector and provision it as the same hostname and IP as the old one 2- A

FortiClient 7.4.3.1736 has no reaction after set username, password and click on Connect. In forticlient-logs/confighandler.log are messages as:20250428 16:00:13.520 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:13.644 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:30.087 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:31.506 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:57.295 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250428 16:01:01.375 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:01:29.

Hi, just wanted to point out an spelling Error in the second image of the guide from this link:https://docs.fortinet.com/document/fortiextender/7.6.0/admin-guide-fgt-managed/201700 The image shows a FortiGate with the description ForitGate. This has been the way since 7.0.0 till 7.6.0. Version 7.6.1 uses a new image without the spelling error.Old:New:   

I opened a ticket on this but maybe this will be faster...  I am running FortiClient 7.2.4.0850 on a MAC runing macOS 14.5.  But I also have a need to run CloudFlare WARP once a week.  But the logs for WARP show that the ztagent is running and that port 53 has been redirected to the Fnet app. I do not currently have ZTNA setup at all in FortiClient.  But regardless, there must be a way to shut down the client fully for a short time so I can run WARP for a few hours a week.  When I do try to shutdown the forticlient processes they auto restart on my MAC. Does anyone know if there is a way to kill them off for a few hours then manually start them up?  And yes I am connected to an EMS. 

Try to config ZTNA Shortcuts on SASE end point already integrated with Entra ID. Need clarify  config user samledit "saml_ztna"set cert "Fortinet_CA_SSL"set entity-id "https://fgt9.myqalab.local:7831/samlap"set single-sign-on-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/login/"set single-logout-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/logout/"set idp-entity-id "http://MYQALAB.LOCAL/adfs/services/trust"set idp-single-sign-on-url "https://myqalab.local/adfs/ls"set idp-single-logout-url "https://myqalab.local/adfs/ls"set idp-cert "REMOTE_Cert_4"set digest-method sha256set adfs-claim enableset user-claim-type upnset group-claim-type group-sidnextend The entity-id single-sign-on and single-logout URLs from SASE and  idp URLs from SMAL authenticator ( In My case it's Entra ID )  i follow below guidelines https://docs.fortinet.com/document/fortisase/latest/spa-using-ztna-deployment-guide/976373/configuring-authen

Hi FortiSIEM Community,I have a question regarding the requirements for High Availability (HA) and Disaster Recovery (DR) setups in FortiSIEMMultiple Instances Requirement: Is it correct that both HA and DR require more than one FortiSIEM instance? Specifically, can HA or DR be configured with just a single FortiSIEM instance, or do they both necessitate multiple instances?Thank you for your assistance!

When I tested it through FortiVPN with a Windows 10 laptop, it worked fine, but when I tested it through FortiClient with a Windows 11 laptop, it didn't work.It is the same environment except that Windows 11 laptop has EMS interworking as FortiClient.What is the problem? 

I can't add any FGTs to my FMG within Eve-NG, debugs are showing it to be a SN issue, found several post to do below, but I don't seem to have that option on 7.4.6 The fix is to disable cert check:FMG-VM64-KVM # config system global(global)# set fgfm-peercert-withoutsn enable Any help would be greatly appreciated? Thanks

Hi everyone.I would like to display antivirus log in my Fortigate F60 (OS 7.2.11).In the forum I've noticied that I have to set the value "av-virus-log" to enable.In the CLI, I've edited the profile and I've entered the command "set av-virus-log enable".But there is no impact, when I want to show the different value of my profile, the value does'nt exist.Have you an idea ?Thank you in advance  

Hello everybody,regarding ZTNA, we found a bug after yesterday Forticlient EMS 7.2.5 upgrade.This is happening only on macOS devices.We have a ZTNA destination profile:On Windows device, rule are correctly retrivied. But, on macOS, I can see no destination (I have all the tags I need):Debbuging this problem, I was looking at the Forticlient ztna.logs, and I found (I removed some rules for simplification): 2024-10-11T16:24:28.238 TZ=+0200 info ztna mergeCfg:{"enabled":1,"rules":[{"name":"EMS","mode":"transparent","enabled":0,"destination":"10.1.0.217:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"},{"name":"VMAgostini","mode":"transparent","enabled":0,"destination":"10.1.0.215:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"}],"portals":null,"gateways":null,"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-10-11T16:24:57.148 TZ=+0200 info ztna sync portal select portal err:e

Hi Team,Is there a way to enable Interface Pair View on a FortiGate 121G without removing the existing policies? From what I’ve found, it seems that enabling this option via CLI may result in the deletion of current policies.I’d appreciate any guidance that would allow this without impacting the existing configuration.