Solved

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

Hi All, General question about memory optimization and firmware. I have a 60E that does a lot of work and runs quite high in memory, and has recently started hitting mem conserve mode. I'm aware there are a few ways to bring the memory down, and I am exploring those, but what about firmware? Are there any memory efficiency gains from potentially updating firmware from 7.0.11 to another version? If so, would Fortinet be able to advise which version to try upgrading to? Cheers 

Hi, We have a simple architecture :- a wan int for incoming request to our servers with static nat- several int for internal servers and users ressources- a single default route for outgoing and reverse traffic- several static routes for different ressources and sites All goes well. We recently had to manage a new public range, with new internal servers. For different internal reasons, the two public wan have to be separated and using the same vdom. We dedicated a wan int to the new range. Default route is still on the old one.When we try to reach the new public int from outside, the famous "msg="reverse path check fail, drop"" raised. Doc : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Detailed-Guide-on-dual-WAN-setup-for-targeted/ta-p/276308 was very good information, but does it apply only for egress traffic, or is it for ingress traffic too ? In other words, we want to expose services on internet on two separates wan int on the same vdom. B

I've been having issues getting my AP to work while building my network. I have a Fortigate 40F connected to a Fortiswitch 108F connected to a a FortiAP 221E. The Fortigate is running 6.4.15 and the AP is running 6.0. The AP shows up in the Wifi/Switch controller > Managed FortiAPs and shows that it is online. Its broadcasting the SSID I setup, but when I connect to it, it shows connected with no wifi. It also has a VLAN with a manual IP config.I'm confused and need help, would anyone know why this would be doing this?Also does anyone know how to delete VLANS, its not giving me the option to delete them. I want to try and put them on the fortigate instead of the switch

I am accessing the site when I go to generate a file to download it does not download, would there be any way I can check and the domain is blocked, I did the release of the site, it was already F12 in Sources and nothing.

Hello,I’m experiencing an issue with my FortiAP after performing a reset, changing the password, and configuring a static IP address. When I connect or add the FortiAP to the FortiGate and try to log in to the FortiAP, the password I set no longer works.Additionally, I am unable to access the FortiAP via SSH because the password is being rejected.Could you please help me resolve this issue?Thank you in advance for your assistance.

Hello everyone, I’m back with another issue related to FortiNAC... In the client's network infrastructure where FortiNAC is deployed, there is an Explicit Proxy configured on the FortiGate.If I disable the proxy on the test machine, the FortiNAC Captive Portal appears as expected. However, when the proxy is enabled, the traffic bypasses FortiNAC entirely, and I can browse the internet without being redirected to the Captive Portal. I’ve tried creating Proxy Policies to deny traffic from the isolation VLAN subnet, but this still bypasses the FortiNAC registration portal, and I receive an error indicating that internet access is blocked. Is it possible to forward traffic from the FortiGate proxy to FortiNAC? I couldn't find any reference to "proxy" in the allowaccess settings for FortiNAC's port2 interface.Thank you very much for your help!

132>1 2024-09-30T19:28:50.597024Z adadsads61.irasp.etta asd.asdt.gads.asda.com NILVALUE NILVALUE - {"adf":true,"significant":0,"udf":false,"virtualservice":"virtualservice-333afa37-f201-4d1c-bc3f-3fe7a5e337fa","report_timestamp":"2024-09-30T19:28:50.597024Z","service_engine":"z9900001awaf401-se-jmonv","vcpu_id":0,"log_id":123935,"client_ip":"199.19.253.11","client_src_port":25458,"client_dest_port":443,"client_rtt":8,"ssl_version":"TLSv1.3","ssl_cipher":"TLS_AES_256_GCM_SHA384","sni_hostname":"asd.asdt.gads.asda.com","request_state":"AVI_HTTP_REQUEST_STATE_SSL_HANDSHAKING","significant_log":["ADF_CLIENT_CONNECTION_CLOSED_BEFORE_REQUEST"],"vs_ip":"1.1.111.10","ocsp_status_resp_sent":true,"max_ingress_latency_fe":0,"avg_ingress_latency_fe":0,"conn_est_time_fe":8,"source_ip":"199.19.253.11","vs_name":"asd.asdt.gads.asda.com"}

Hi all. Ive been setting up brand new Fortigate 100F.There is only one cable between them: HA port 1 to HA port 1. However it keep saying out of sync because of the table  ips.sensor.I have seen this before on 70F aswell. Im running v7.2.8 build1639 (Mature) I have tried to recalculate #diagnose sys ha checksum recalculate but no result.

I have created Fortlink with dedicate to Fortiswitch checked. I setup internal DHCP and connected POE switch with Access Point. I am getting DHCP management address to switches but not getting DHCP from downstream port where access point is plugged in. There is no way to tag Fortilink interface in any downstream switch port unless I create interface type vlan. My question is, is there any way to use Fortilink as management vlan to provide DHCP for switches and DHCP also for  access points only using Fortilink rather creating a separate interface type vlan under Fortilink and add downstream switchports to it. I would like to know if this is possible.   

I have a question regarding Radius Server with Dynamic Vlan Assignment for SSD profiles. Basically I would like to have Dynamic VLAN Assignment and VLAN pooling enabled. I am running 7.4.5 code version and whenever I enable Dynamic VLAN Assignment, it disabled the VLAN pooling. I did find a documentation that it is possible 7.4.1 version came that both dynamic vlan assignment and vlan pooling is possible, reference: https://docs.fortinet.com/document/fortigate/7.4.0/new-features/924614/support-dynamic-vlan-assignment-with-multiple-vlan-ids-per-name-tag-7-4-1However; this is not working in code 7.4.5 code version. I would really like to have this feature that support vlan pooling with Radius because this setting in Cisco called RADIUS Server Overwrite interface, Meru called Radius With VLAN Pooling, allows us to have restricted access and unrestricted access at the same time based on the Network Policy server rules. This makes it easier to have users in groups tied to authenti

Fortimanager version 7.4 and Fortigate version 7.4.3. Fortigate is 40F.While pushing any config to Fortigate below line automatically come sin the config preview. The installation faisl due to this config too.config web-proxy global set proxy-fqdn "default.fqdn" endbelow is the error getting. Any idea to fix this please.------ Start to retry -------- 40F-TEST $ config web-proxy global 40F-TEST (global) $ set proxy-fqdn "default.fqdn" 40F-TEST (global) $ end ---> generating verification report (vdom root: web-proxy global:proxy-fqdn) remote original: to be installed: "default.fqdn" <--- done generating verification report install failed 

HiYesterday I had to disable full SSL inspection in our proxy policies due to poor browsing performance. Fortigate 200E running 7.0.15 No policy changes were made, and user numbers, session numbers and interface throughput are average for daily use. This is an edge firewall. I tested early this morning before most users were in, and still had slow performance. I tried restarting the WAD processes, to no avail. CPU and memory are both fine, with no change when DPI is disabled/enabled. I notice no change in CPU/SPU ratio when turning DPI on/off either. Any ideas where I should look to diagnose this, and has anyone else experienced a similar problem?  

Hi, The Fortigate 50G-SFP documentation does not specify whether the SFP port can function as a secondary WAN. Does anyone have information about this? Thanks!

Our health check has come back that our login pages are viewable over the internet.I have disabled HTTPS/HTTP over the WAN but page still shows.Any quick fix please?Thanks

Hi,I've looked on Broadcomm's (nee, VMware) support site, but I was hoping someone here has already delt with this and might share the port list to successfully connect 1 vCenter server to 1 host and 2 VMs over a site to sire IPSec tunnel. I'm looking to limit access of the whole remote network to the vSphere infrastructure.TIA 

We have some hyper-v VMs that we upgraded from 7.2.3 to 7.2.5 forticlient. SSL VPN no longer works after upgrading.We can repeat the problem by downgrading to 7.2.3 and then successfully connecting then upgrading to 7.2.5 and breaking it again.we need to run 7.2.5 to fix a wild card FQDN issue with ztna destinations that we were experiencing on 7.2.3.

Hi Forticollegues,I'm implementing a Fortinac solution to manage dynamic vlans via unique WiFi SSID.The wifi networks and all wired networks are managed by Fortigate.In Fnac inventory I see all Fortigates ports mapped and FNAC learn all client mac address from wired and wireless ports.There is some methods to instruct the Fnac to learn mac address only by wireless networks? I don't need to manage all wired networks and I see a lot of rogue devices from Fortigate wired ports.Thank youVincenzo

Hi,we are sw company, and have own security product (authentication server). It can work like radius + otp (and many others methods) so I try to integrate OTP to ftgt. It works (with free ssl vpn client). But after I try use 2FA online method, with push notification. And here I have problem. Forticlient send AD user name and correct password, mobile app recieve notification, but FortClient instantly shows OTP dialog. With no reason, I not send more validation req. -- UPDATE ---This is because I have second functional radius server with MS365 MFA on it. And fortigate from unknown reason switch to this, second server, almost instantly after password send. When I change IP of second radius to nonsense, everything works.Fortios have only 2 parameters I know, timeout in radius definition, and global, remoteauthtimeout. Both set to 120s and not helping.This seems now like some error in fortigate logic, so I create ticket on it, sorry for this post, I believe in time of writing that this can

Hello Community. Please give some tip on how to create lists like (words, emails, names, etc) for later use. case scenario: using the filter "Mail Sender" --> IN --> (select from cmdb the list emails)   Regards.

 Hi,I am using a FortiNAC-CA 7.2.4 (FortiNAC-OS) with a basic FortiNAC license. Network Infos:The FortiNAC is connected via cable to a switch and terminates on a FortiGate through port6 (0.0.0.0/0) with a VLAN stub and VLAN Isolation. I have configured port1 for MGMT (Layer 3) and port2 in L3 Isolation mode, with an IP on the VLAN stub and a Range Scope for the VLAN Isolation. The FortiGate acts as a DHCP relay towards the IPs of the FortiNAC (both port1 and port2). FortiNAC infos:I created two groups (MAB_VLAN2 and MAB_VLAN3) and two roles (ROLE_VLAN2 and ROLE_VLAN3). I then set up user configurations with the following logic:If the user does not belong to the groups VLAN2, VLAN3, or Registered_Host → Logical Network IsolationIf the user belongs to group VLAN2 and has ROLE_VLAN2 → Logical Network VLAN2If the user belongs to group VLAN3 and has ROLE_VLAN3 → Logical Network VLAN3I am using a test switch and a test PC, and from manual testing, it seems everything

Hi I'm trying to migrate from EMS 7.2.5 to 7.4. I have gone through all the steps in the Admin guide and have now hit a brick wall.  I am getting an error "Authentication (publickey) failed" and "encountered RSA key, expected OPENSSH key" and the migration is failing. I found this article at  https://community.fortinet.com/t5/FortiClient/Troubleshooting-Tip-Getting-an-error-when-performing-EMS/ta-p/328415 which did help with another error I had. However, the article just says to the generate the public key, which I have done and re-done several times with no effect.  Has anyone had this issue? Can anyone help please? ThanksRoy

Hello everyone, I'm facing an issue after enabling VXLAN over IPSEC and creating software switches on my FortiGate. I have several scripts that connect to various Microsoft services (e.g., Office 365, Azure), and they were working perfectly before these changes. However, since enabling VXLAN over IPSEC and configuring the software switch, the scripts are no longer able to connect to the Microsoft services. If I remove the VXLAN from the software switch, the scripts start working again, which suggests that the problem is directly related to the VXLAN configuration or software switch. Does anyone have suggestions or insights on what to check in the VXLAN over IPSEC or software switch configuration that might be causing these connection issues? Thanks in advance for your help!

For example, for TLS 1.2, i want to enable / use only these cipher suites and in order / priority. Meaning that all other TLS1.2 not in the list below, will not be accepted / allowed. Is there any possible way to do so, if so how? If not, what would be the best / closest method in achieving something like this or similar. THANK YOU SO MUCH!!! I really appreciate any sort of help.TLS1.2 Ciphers1 TLS_DHE_RSA_WITH_AES_256_GCM_SHA3842 TLS_DHE_RSA_WITH_AES_128_GCM_SHA2563 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA3844 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA2565 TLS_DHE_RSA_WITH_AES_256_CBC_SHA2566 TLS_DHE_RSA_WITH_AES_128_CBC_SHA2567 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA3848 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA2569 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA10 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA