Solved

I’m using the 3-seat free FortiClient EMS Cloud offering that came with my FortiGate licensing and have run into a strange issue enrolling an iPhone.My Fedora 43 Linux laptop registers successfully to the same EMS Cloud tenant, so the tenant and license appear to be working, at least in general. However, my iPhone will not register and always gives:“Registration Failed, Error: The invitation code is invalid.”What makes this confusing is that the invitation code does not seem to be truly invalid, because every failed iPhone attempt still causes the invitation Use Count to increase in EMS Cloud. At the same time, the failed attempt does not consume a license seat.What I’ve already tried:confirmed I am using the full FortiClient iOS app, not VPN-onlytried multiple invitation typestried existing and newly generated invitation codestried bulk invitationstried QR code onboardingtemporarily disabled Enforce User Verificationsigned out and back into EMS Cloudconfirmed EMS now shows user v

Hi everyone,On my FortiGate running v7.4.9, I have a specific VDOM configured for one of my clients.Currently, this VDOM is integrated with a FortiAuthenticator (FAC), which in turn queries two remote LDAP servers to handle MFA for client VPNs. I now need to configure these same two remote LDAP servers directly on the FortiGate (under User & Authentication -> LDAP Servers) so I can use Active Directory groups in our firewall policies. I would like to know if there are any specific best practices to follow, and I have a couple of questions: LDAP Query Load: Are these two remote LDAP servers at risk of being overloaded with too many queries due to this dual integration (FAC for VPN + FortiGate direct for security policies) ? Cache Management: Would you recommend enabling and tuning the cache on the FortiGate (increasing `set cache-ttl` to 300 or higher) ?If so, what is your recommended value for a production environment ? Thanks in advance to everyone for any advice or insights !

Hello dear community, I got a new customer that has an unlicensed FortiGate 50E and FortiAPs 221E on firmware 6.0.x. They want to replace the FortiGate with the 50G model but want to keep the APs for now. The target FortiOS for 50G would be 7.4.12. As the config would be converted/migrated, what would be the best upgrade path to avoid losing the APs management?Put the 50G on 7.4.12 and convert the 50E configuration as is Upgrade the 50E and 221E APs to latest possible 6.2 branch and then convert the 50E configuration for 7.4.12 Upgrade the 50E and 221E APs to latest possible 6.2 branch, convert the 50E configuration for 7.0.19, then upgrade the 50G to 7.4.12 Please let me know if more details are needed. Best Regards

Hi FGT adminsFortiOS 7.4.12. All HTTPS sited are blocked with error: “SSL connection is blocked due to unable to retrieve server's certificate”.In the latest FOS updates the FGT probes the certificate itself (self generated traffic) before allowing or denying the traffic, right.I checked this tech tip and I know we can change cert-probe-failure as workaround.But I my case I know the issue is caused by my WAN interface having one primary private IP and one public IP as secondary IP (ISP constraint). I had to change source-ip for many services like DNS and FortiGuard in order to make them reachable. But can’t find similar source-ip for certificate probe traffic.I know one other workaround is to make public IP primary and private IP secondary but I prefer avoid this change in case there is “source-ip” customization for cert probe.Any useful info would be appreciated.

Hi allI have updated to FortiOS 7.2.3.And then I realized following bad configuration.----FG60F # config system email-serverFG60F (email-server) ## set reply-to noreply@example.comcommand parse error before 'reply-to'Command fail. Return code -61FG60F (email-server) #----By this Document, I can set 'reply-to'.http://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/526019/email-alertssomeone have how to config 'reply-to' in FortiOS 7.2.3?thanks.

I’m having issues establishing a connection when IPv6 is enabled on the Windows client’s Wi‑Fi interface. As soon as I activate IPv6, the connection to the Fortigate fails. Has anyone experienced this or knows what might be causing it?If you want it more technical or more detailed, I can refine it.

Hi I tried migrating the FAZ-400E config to a FAZ-1000G, but after rebooting, the configuration wasn't applied.but migrating the same config to a FAZ-VM works without any issues.(OS versions are identical).

My scenario for contractor is they login to the network and get isolation network, then after enter the credential the device will connect to guest network and we must change the Host Role from Guest to Contractor then the device can access to the network.Vlan changing from isolation to guest and to contactor network is working fine except if vlan guest doesn’t have internet access then after credential entered then there are pop up in the browser say ‘Failed to detect a change in your network setting’ but vlan already changed to guest. When guest network have internet access then there no popup.Anyone know what url used by fortigate to detect that change ? My goal is to give internet access on guest network to specific url so the popup will not showing.

Hi FNAC adminsFortiNAC-F 7.2.9.Do you know a way to show/set device model configuration in CLI or via Linux shell (enter-shell).

Can we put the url to download the persisten agent on captive portal than the agent downloaded automatically?

Hi everyone,We are facing an issue where FortiGate email notifications are not being received by Outlook.com email accounts (Outlook, Hotmail, Live).Our SMTP configuration is working correctly because all email notifications, including SSL VPN OTP emails and other system notifications, are successfully delivered to our company email accounts.However, when the recipient is an Outlook.com email address, the emails are never received, including the Junk/Spam folder.Has anyone experienced this issue? Is there any known compatibility issue, Microsoft filtering policy, or SMTP configuration that could cause Outlook.com to reject or silently drop emails sent by the FortiGate?Any guidance or troubleshooting suggestions would be greatly appreciated.FortiGate Model: 1101EFortiOS Version: v7.4.11 build2878 (Mature)

I use persistent agent to checking antivirus on the client before the client can connect to the network.My question is what parameter will be checking by PA? Is antivirus realtime protection is on/off, is antivirus batabase signature updated or not, or something else?

Hi guysFGT A with WAN 1 and WAN 2 interfaces with direct public addressFGT B with only WAN1 Created nr 2 tunnel ipsecTunnel 1 = FGT A WAN1    to    FGT B WANTunnel 2 = FGT A WAN2    to    FGT B WAN Created policy and static route with  administrative distance = 10 (Tunnel 1) and = 20 (Tunnel 2) When tunnel 1 is DOWN I get strange output on routing interface.Picture 1, static route works, I can reach LAN on FGT BPicture 2, static route doesn’t work, I can’t reach LAN on FGT B. I get strange IP address on static route, 10.0.04 is not public IP of FGT B Someone can suggest me any other checks?What could it be?

Can anyone confirm me if FortiGate 70G Firewall requires a separate license to operate or does the product comes with a base license when purchased new.

Hi FWB adminsAccording to FWB’s CLI ref we can access to traffic logs and attack logs via CLI.https://docs.fortinet.com/document/fortiweb/7.6.6/cli-reference/561209/logThe user is admin and its profile is prof_admin (has all rights).However when the mentioned command seems not available.fwb01 # diag log all startParsing error at 'log'. err=1Command fail. CLI parsing error.Any idea?

Hello,we have upgraded our FortiClient EMS Cloud instance to 7.4.7 recently, and we can’t seem to upgrade our FortiClients, because we are unable to choose a FortiEDR engine.The dropdown menu to select an engine version for the FortiEDR feature has nothing to select. Even when dropping down to other FortiClient versions we can’t pick any FortiEDR engine version. The fabric connection between the FortiEDR Cloud and FortiClient EMS Cloud instances are up. The installer is for regular Windows Clients.The same problem goes for our customers FortiClients EMS Cloud instance. So it seems to be a problem with the 7.4.7 version of FortiClient EMS Cloud?Also, the docs page for FortiClient EMS is currently down with the code 500 internal server error. So we can’t even look up known issues for the new FortiClient EMS version.

Hi all,I read this article about restricting ipsec connections to certain countries.https://community.fortinet.com/fortigate-3/technical-tip-restrict-ipsec-vpn-access-to-certain-countries-94688When I attempt to implement it, I find that I cannot select any wan interfaces in an address object.In the article example (below image) it shows External (wan1) in the interface field but when I create a new address object it doesn’t show any active physical wan interfaces in the interface field.Would using the Zone that contains the wan interface work? We are running a Fortigate 81F with 7.4.12thanks

Greetings Im having some problems with my VXLAN over IPSec implementation. Im able to establish connection to the remote site. Telnet, SSH, RDP, VOIP is working fine but Outlook and some HTTP or HTTPS application don't work. I have read many article about this issue and all says that is a MTU or fragmentation issue. But I follow all the recommendation and nothing seems to work. First thing I notice is that VPN interface, Software-switch and vxlan mtu were set to 1370. I manage to bring the VPN and vxlan mtu to 9000 and Software-switch to 1500. My physical interface are all set to max mtu (9216). I also disable the honor-df bit but the maximum mtu that i can pass without fragmentation is 1472. And I think that is fine because 1472 + 28(header overhead) = 1500. But still cant get Outlook to work. I also adjust the mss in the policy to 1432 (1472-40). Also I lower my encryption to 3DES SHA1.My main FW is a 100F and the remote is a 60F. Im runnig 7.2.4. I will appreciate any

Sporadically our Fortianalyzer (7.4.9) will stop sending logs to our main syslog log collector (Is still collecting from other systems).  The “Log Insert Lag Time” will get up to 18 or so hours and keep climbing, when it should be like 20-30 seconds.   When the analyzer is rebooted, logs start to flow and the time slowly starts to normal, and everything is ok. I’ve been trying to get that value via a command line, or SNMP to feed our PRTG system to monitor when it happens before it gets out of control.  But, it seems to be allusive.  Maybe I’m missing something?  Perhaps there is another tell sign that I can look at?  Or is it a feature request?Thanks!

Hello everyone,we have a customer who would like to generate a monthly report using FortiAnalyzer that includes the following information:WAN gateway availability over the reporting period (monthly uptime/availability) Reachability of defined WAN targets (e.g. public IP addresses or external services) from the FortiGate Information about when WAN failover events occurred, including timestamps A summary of all failover incidents within the reporting periodThe environment does not use SD-WAN. Standard WAN interfaces and failover mechanisms are configured.Is it possible to create such a report using FortiAnalyzer?I don't have any knowledge of SQL, and despite extensive research, I have no idea how to implement this. If necessary, I would recommend Fortinet Professional Services to the customer.Any guidance or best practices would be appreciated.Thank you.KRNiko

HiIs there a list of the available column names?I like to use:config system settings set gui-default-policy-columnsAnd I’m wondering how to include “Security Posture Tag” or “Hits”.Thanks

We recently upgraded from 7.4.4 to 7.4.5.In the meantime, the workstations have also been replaced with Windows 11 and are now Azure AD (Entra ID) Joined instead of AD joinedDeployment at workplaces is done via Intune / Patch my PCWhen I currently do a search in the Forticlient EMS console for an endpoint, I see the endpoint, but also 3 or 4 other endpoints in the search result. These "extra" endpoints can be seen with every searchI only expect to see the one endpoint I'm looking forIs there a duplicate GUID, Hash, or something like that somewhere?

I am currently preparing for the Fortinet Certified Professional (FCP) certification in Network Security. As part of my hands-on learning and practical lab setup, I have successfully installed the FortiGate VM on my local environment.However i am finding it hard to access the GUI of the FortiGate VM due to absence of a trial license.i have tried this commands execute vm-license-options account-id xxxx@fortinet.comexecute vm-license-options account-password xxxxxxxexecute vm-licenseIt showed the error "Requesting Forticare Trial license, proxy:(null)failed to download VM license"I would like to kindly request help in acquiring trial license for the FortiGate VM. This is meant exclusively for my study and practice and learning experience. Community help will be very much appreciated :'(

I passed my exam 7 days ago. I made mistakes with the registered email on PearsonVUE. I know know that was the problem. I should have used my company's email when I registered. I contacted Fortinet support to associate my FortiID but no response.https://ftnt.freshdesk.com/support/solutions/articles/73000524133 I contacted PearsonVUE, but they asked me to contact Fortinet. How? How can I reach Fortinet training support?They said I can create a ticket with them on the above link. But nobody is monitoring that ticketing system. Just wait for another 2-3 weeks? I need to provide it to my company. :( 

Can we use third party authenticator like google auth in Fortigate?