Solved

Hello I created a Performance SLA to monitor the quality of a link to connect to a specific server on the Internet. The measurement uses tcp-connect and makes requests to a specific IP and Port. The defined check interval is 500ms and the time to consider the packet as lost is the default of 500ms. Let's say I'm having 20% ​​loss, does fortigate calculate this percentage based on the N number of previous packets? Or does it calculate based on the last N minutes? Is it possible to change this?Update:Based on some observations, I assume that the percentage of the "Packet Loss" metric is calculated based on the "Failures before inactive" parameter. For example, if I set 10 for "Failures before inactive", Fortigate will consider the last 10 packets for sampling. If 2 of the last 10 packets fail, I will get 20% for the "Packet Loss" metric. I did not find this information in any official Fortigate documentation, I would like confirmation.

It cuts in and out several times a day, sometimes dropping in strength and sometimes just cutting out. The ISP suggested connecting to the supplied Eero router to test it and since then it has been stable. The WAN on my 60F is set to DHCP and automatically sets itself when connected.  The set up worked seamlessly with the ONT directly connected to my WAN port on the gate for 5 or 6 months since installation.Edit: Should not have tagged this Fortiwan as it that is a product.....don't know how to remove

Hi, I have 2 computers in 2 separate VLAN's, and I need to make them see each other. There are many other computers in both VLAN's but I only want these 2 specific computers to talk with each other. I made Addresses for both computers (for their mac addresses) but it doesn't let me chose that as source and destination. Any ideas ? Thanks

Hi, the title says it al, how to block internet except one (or two) address (or IP) without using web filtering. We don't want to make a rule to enable internet then filter, that's something our auditor does not allow, so we have to make a rule that denies internet, then add exceptions.I tried to make a firewall policy from the Internet interface to the VLAN we want to block for internet, but then if duplicate the same rule but this time add one previously created FQDN address to allow, it does not work, all internet is still blocked

Goal is to create identity based FW policy.  We are looking at using FCT Mobility Agent and FAC Cloud. Trying to wrap my head around the impact in the event of a loss of connectivity anywhere in this path. SSOMA <--> FAC Cloud <--> Fortigate.  How long by default does the Fortigate cache the user/ip correlation ? Any ideas ? Don

Hello everyone, I have a connection issue with the FortiClient VPN. I am using the Ubuntu 24.10 operating system and have installed the forticlient_vpn_7.4.0.1636_amd64.deb client. The installation has no issues, but when I try to connect using the graphical interface, it stays pending on the connection without being able to establish it. Could you please help me resolve this problem?

Hi, Anyone else noticing issues with login to SSLVPN using SAML with Entra after upgrade to 7.0.17 for users with FortiClient 7.4.X ? Did an upgrade on FOS to a client and it broke the connection for newer versions butwith FortiClient 7.2.X it appears to work just fine and it used to work also with this version up until upgraded .A similar issue was also brought up here 

Hello everyone, When generating a DKIM key for multiple FortiMail appliances across different sites, should a unique key be generated for each FortiMail, or can a single key be used for all of them? If it's the second case, how would the other FortiMail appliances obtain the private key? If it's the first case, do I have to upload all public keys on the DNS ? Thank in advanceBest regards,

We are planning to utilize a RADIUS server for LDAP and OTP authentication. Our objective is to send the Username, Password, and OTP in a single request. To achieve this, we need to create a Custom Vendor-Specific Attribute (VSA) in the FortiGate firewall. This will enable us to include the OTP along with the Username and Password for authentication purposes. Could you please provide the detailed procedure for creating a Custom VSA in the FortiGate firewall? FortiGate 

Hi All, I have a question regarding a FortiSwitch managed by FortiLink. We have two data centers (DC-A, DC-B), each with a standalone FortiGate. Under each FortiGate, there are two 1048E switches serving the servers. There is a dark fiber link between the two data centers, which connects the FortiSwitches.Since there is L2 connectivity between the two DCs, I encountered an issue where the FortiSwitches from DC-B also appear on the FortiGate in DC-A (and vica-versa), prompting me to authorize them. Currently, I have set them to "Reject," but I'm not sure if this is the official solution or if there is a better approach.Could you provide guidance on the best practice for this scenario?

Hello, I would like to install a Fortigate 200G with active/passive HA.That's mean that only one Firewall is running, the second, just in case of problem on the primary. Our reseller said that's it's required to have both licences and maintenance same on both firewalls.Is that's correct ? Thank you. 

Hi guys,I need some assistance in clarifying some of the information I'm seeing in log 99 from my fortiproxy, particularly the rcvdbytes and sentbytes.Question 1: Does the received bytes refer to the amount of bytes received by the fortiproxy from user or vice versa?Question 2: Does the sent bytes refer to the amount of bytes sent by user to the dest or vice versa?Question 3: Does the HTTP method or any other telemetry within the rawlogs that may affect the order of how we see the bytes?This is crucial because it allows me to understand if there are potential malicious exfiltration happening in my environment.Thanks!

I have challenge concerning the setup diagram provided below. In this diagram, VLAN 30 is designated as the out-of-band (OOB) management VLAN, with the corresponding OOB management network IP address being 192.168.30.0/24. Each device intended for management via the OOB network is connected to the management VLAN ports of the Forti-switch through their respective physical management ports, as illustrated in the diagram. My objective is to manage the Fortigate firewall B using its IP address, 192.168.30.10, which is configured on the physical management port. In pursuit of this objective, I attempted to configure the static route outlined below. However, I encountered an issue where the command SET DEVICE MGMT was not accepted, even after I had removed the management port from being designated as a dedicated port. Could you please advise on the most effective method to achieve my goal of managing the Fortigate firewall B through its management port? config router staticedit 12set d

 AWS EC22 is running Fortigate 7.2 on vCPU, and the license is using 2 vCPU.Display 1/250% of allotted vCPUs after license change.I'm using 2vCPU, is there a reason why it only shows up as 1?Can't I get them to use both as basic?

I've setup ADVPN using BGP on loopback design with SDWAN. Traffic flows and failover to another link when when it disconnected on all devices.  Right now I have 1 hub and 2 spoke. I can steer traffic from spoke 1 out the correct interface - but the ADVPN shortcut is sending traffic into a different interface on spoke 1.  A practical example - I would like to send all backup traffic out our second ISP - WAN2 on spoke1. This works no issues. The traffic however ends up coming in on WAN1 on spoke2. This would normally be fine - except when it comes to traffic like an off-site backup I would prefer it not to be on our primary link.Is it possible to steer traffic to take a certain path if using BGP on loopback - I believe this is possible with BGP per overlay but don't want to invest a significant chunk of time on that design if what I'm trying to accomplish is possible with the loopback method. I am also waiting for a call with Fortinet support but hoping to get so

I have installed the latest VPN client from https://links.fortinet.com/forticlient/win/vpnagent  After installation accomplishied, I promptly noticed the lack of the tray icon (that indeed arise on other Win10-22H2 Win11-23H2 installations). Anyway I tried launch the client console configured and saved VPN settings according to my firm's guidelines (SSL-VPN on custom port).Unlike the other OSs mentioned above, the client remains stuck on the connection mask without any status/progress expected (indeed the client doesn't connect). I have already tried the solutions proposed herein, but without any success:https://community.fortinet.com/t5/Support-Forum/FortiClient-VPN-only-with-Windows-11-24H2-issue/td-p/348662 https://windowsreport.com/windows-11-forticlient-vpn-not-working/  

Planning on doing some route-map and prefix-list renaming. When testing i didn't see any impact when i just create new routing objects with the same content but different names. When i then change them for example at router bgp route-map-in or out it shouldn't cause any interruptions, might have to do a execute router clear bgp ip x.x.x.x soft though. Anyone with different experience?

I noticed a problem. When the updated version is the same (31.962 at the time of posting), the signatures under the v7.2.10 build1706 (Mature) version are much less than the total signatures displayed on Fortiguard, only 12,346. On the 0S6.2.16 system, it is 18,861, which is close to the total number of entries, and on another OS7.4 device, it is also close to the total number of entries. I have followed the tutorial to turn on extended signatures and set exclude-signatures to none.Will this affect Fortigate's security features?Update record query:Intrusion Prevention Service | FortiGuard Labs

greetings all,I created two SLAs, they have the same settings (same interface participants, same SLA target, same link status metrics) but only with different detect server (probing target). SLA 1 probing 10.74.a,b, SLA 2 probing 172.29.x.y. And, I added the two SLA under the same SD-WAN rule, which is with lowest cost (SLA)the question is , what is the Boolean logic here? Let's say, 15 consecutive times of probing failure occurs to either one of the two (1 out of 2) SLAs , will the related interface become inactive? and will the SD-WAN switch to the secondary interface (the interface with higher cost)?AND, what about if I add the two probing detect servers to the same SLA? and only use the one SLA under the SD-WAN rule?Thanks,Sean

HI guys, Due to a ISP change my local Fortimanger is no longer reachable with the old address. I want to deploy a new FGT to my Fortimanager, but when I try this, the old IP is listed. Where can I change the IP to the new one? Best regardsVolker 

Quick question.  Is it possible to use a SAAS SSO provider such as Okta, MS etc and using SAML? This is our current setup for VPN, but there seems to be a hitch when you need to involve Authentication rules because of the interface and protocol preference. Is the LDAP portion required for this? And not just relying upon the SP user data base? 

Hello :), I've previously had an offline CA setup and used it to sign certificate request for Fortigate. It was an easy process overall.  However, I now have an enterprise CA. A new folder under my CA was created as "Certificate Template". I understand it's utilization and whatnot, but my troubles come with accepting Fortigate CSRs. I immediately get shot an error "Denied by Policy Module 0x80094801, the request does not contain a certificate template extension or the CertificateTemplate request attribute."That's fine and dandy but I can't seem to be able to add that attribute anywhere before generating the CSR. I've looked online and I'm instructed with a CMD process that applies the Template to use, but I have the upcoming project of signing more than 80 of these certificates.  I'd appreciate the guidance on making this as simple as it was with my offline root CA :)

Hi, I have a simple setup right now, with a Fortigate 600E on Floor 2, and a Cisco SG350 10G besides this, and I also have another Cisco SG350 10G on Floor 1. Each floor also have a storage server.Workstations from Floor 1 and Floor 2 are connected to the respective floor Cisco swich, and the Fortigate has X1 interface for internet in, and x2 interface to connect to the Floor 2 switch. The Fortigate is the router and dhcp server. But now the bosses want Floor 1 and Floor 2 to be completely separate, and only share the x1 internet connection (which should be also be filtered to only allow certain internet destinations) but worksations from Floor 1 cannot "see" workstations from Floor 2, and viceversa. Can you guide me how to setup something like that, preferably from the GUI of the Fortigate 600E ?I assume I will setup different VLAN's on each switch, with Trunk configured to communicate between them, but then what should I setup on the Fortigate ? Thank you 

Good day, This is URGENT.I am seeing “No license” for features Virus Outbreak & Antispam. These features were always in the green during my 2024 subscription and even after renewal license in January 2025. Last time I checked, even last week, these 2 features were in the green/licensed. I Logged on this morning and now realizing this. What is the cause for this change? Contact Fortinet support or something i can do from cli etc.? This is very strange. HELP!  

Hi Guys, We have two sites connected together but we want to have two guest portals so that we can get a user from each site to approve the requests. Currently it is setup as one guest portal. Any guides or help to achieve this? We are on FortiNAC 7.6.2.0715 (GA) Thanks John