Support Forum

Dear Community, I have three question about changing parameters in a production environment ha cluster. This cluster has two hw fortigate on one location, which work nicely. Now I have to add a third one but in this time this should be an another location. So I have to prepare the working cluster to add a far third one. 1) I would like to make the Ha cluster more latency tolerant. Current config:  hb-lost-threshold 3 hb-interval 2 hb-interval-in-milliseconds 100ms Is it enough to raise only the hb-lost-threshold, or should I change the hs-interval as well? And more importantly what should be the changeing sequence of these parameteres? Should be change one parameter at once on the primary and secondary member? 2) My dedicated hb interfaces direct connected with cable, and set up that the sync packets use this ha intercae. Now I would like to change this that every packets related to ha goes through a switch/vlan. So I have to add a new ha interface (port1 through switch) with lower pri

Hello, I'm trying to do a lab with a trial version of fortianalizer (7.4.10) and fortigate (7.4.11) and I can't do the connection. When setting the IP of the analizer on the logging settings on the fortigate I get "no connection".They are on the same network, already enable the fgfm on the interface. Can ping both analizer from fortigate and vice versa.  The config that I have on Fortigate:config log fortianalyzer setting    set status enable    set server "192.168.0.102"    set certificate-verification disable    set ssl-min-proto-version TLSv1end The config that I have on Analizer:config system global    set adom-status enable    set enc-algorithm low    set global-ssl-protocol tlsv1.0    set hostname "FAZ-01"    set oftp-ssl-protocol tlsv1.0    set ssl-low-encryption enable    set timezone 91    set usg enableend Log from analizer

We are experiencing a critical and recurring issue with our FortiGate 401E.The device hangs once or twice daily Issue has been ongoing for ~2 years During the hang: No traffic passes through the firewall GUI and SSH become inaccessible Console is completely unresponsive Only manual reboot restores operationThis is impacting production services significantly.🔧 Troubleshooting Done:Firmware upgraded from v7.4.0 to v7.4.8 Issue persists even after upgrade No configuration changes correlate with the issue Problem occurs randomly without a clear pattern

Hello, I am trying to update FortiSIEM content version from 901 to 908, but I receive a “server unreachable” error during the update.For testing, I allowed all-all access on the firewall for FortiSIEM, but the issue still persists.Has anyone experienced a similar issue? Are there any specific URLs/FQDNs, ports, or log files that should be checked for FortiSIEM content updates? Best Regards,İsmail ÜREK

Hey everyoneI’m deploying FortiSandbox for the first time and integrating it with FortiGate, F5 Load Balancer, and an internet modem.Before starting, I want to make sure the environment is ready.What are the required network prerequisites and ports that should be open?Also, are there any common mistakes or best practices I should be aware of for a first-time deploymentn? 

Hello :)I have a question about connecting via Putty or PowerShell. How do I clear the history of entered commands that are substituted after pressing the up and down keys? Connecting via SSH to the FG900, I don't know where the history of such commands is located. Please help.

Hello there,can anyone suggest any other tutorial for agentless ZTNA rather than fortinet official documentation. I don’t understand it how to implement correctly. any video, documentation, guides, articles would be appreciated. 

Hello,I need help about our issue with connectivity FG<->FAZ. We are currently troubleshooting connectivity between a FortiGate 200G and a FortiAnalyzer VM.Environment overview:FortiGate 200G running in multi-VDOM modeDedicated management interface configuredFortiAnalyzer VM reachable through data-plane routing from the root VDOMManagement and data interfaces are located in different VDOM/routing contextsObserved behavior:FortiGate is attempting to establish a connection toward the FortiAnalyzer using:TCP/514 (reliable logging / OFTP)UDP/514diagnose test application fgtlogd 1 shows:state=disconnectedoftp-state=connectingPacket sniffer on FortiGate shows:mgmt out -- 10.0.0.2 -> 192.168.0.4:514Packet sniffer on FortiAnalyzer VM does not see any packets from the FortiGate.Traceroute sourced from 10.0.0.2 toward 192.168.0.4 does not pass the first hop.FortiGate configuration notes:The management interface is configured as:set dedicated-to managementBecause of this, FAZ/FMG/DNS/NTP

I want to make Forti Sandbox take copy of all internal mail which sent between the staff internally and scan it “URL & Attachments”How can I do this step by step on Forti Sandbox ? 

The documentation states you can define multiple certificates in an SSL profile in replace mode and it will compare the server name identification (SNI) and the common name (CN) with the certificate list in the SSL profile, and use the matched certificate as a replacement. If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.However, this does not seem to work if you are using wildcard certificates. I have an SSL profile that has multiple separate wildcard certificates defined in the profile that is used to protect a highly available reverse proxy for several domains and subdomains.e.g. SSL Profile in replace mode has separate wildcard certificates for *.abc.net, *.abc.com, *.io.abc.com, *.abc.org, *.bbc.com, *.bbc.org. If a request comes in with an SNI of www.abc.com it will instead return the first certificate *.abc.net as the exact CN name matching does not match the wildcard.Has anyone else experienced this is

Hello, Can the regulatory domain be changed on an FortiAP form -E (sweden) to -S (Philippines). Or does the sale have to be done locally in Philippines through local partner on local pricelist? BR Andreas

I was able to establish a connection for a very long time, but it then suddenly stopped working. The connection is established, but no data is received. The connection then closes after about 25 seconds.I noticed the following in the fortitray log which only appear after the time it stopped working:[2026-04-30 07:21:32.5496135 UTC+02:00] [17640:15916] [sslvpnlib  510   error] [ERROR]SslvpnAgent: Pipe is broken for writing. Error=233[2026-04-30 07:21:32.5532904 UTC+02:00] [17640:15916] [sslvpnlib  510   error] DoSendSslvpnReq() failed. Need to restart Pipe.[2026-04-30 07:21:32.5534866 UTC+02:00] [17640:15916] [sslvpnlib  510   error] Failed to connect to SslvpnDaemon, LastError=2[2026-04-30 07:21:32.5535905 UTC+02:00] [17640:15916] [sslvpnlib  510   error] CSslvpnAgent::SendSslvpnReq() 447 InitPipeHandle() failed.[2026-04-30 07:21:32.5537786 UTC+02:00] [17640:15916] [sslvpnlib  1261   error] CSslvpnBase::UpdateFortiSslvpnStatus() GetSslvpnStatus() failed.[2026-04-30 07:21:32.5538736 UTC

Hello community,I am currently configuring FSSO in FortiGate to create identity-based firewall policies using Active Directory usernames/groups, and I have a question regarding two different configuration sections that seem related to AD integration.I noticed there are two separate options in the GUI:Security Fabric > External Connectors > FSSO Agent on Windows ADUser & Authentication > LDAP ServersAt the moment, I configured only the FSSO option and it is already learning users/groups correctly from Active Directory.My question is:What is the functional difference between these two configurations? What is each option specifically used for? Is it necessary to configure both for identity-based policies? In which scenarios would LDAP configuration still be required if FSSO is already working?From my understanding so far:FSSO is mainly used for transparent user identification (User ↔ IP mapping) based on Windows logon events. LDAP seems more focused on direct authentication a

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

Hi ti all, Our FortiGate 50G is protecting 2 different routers from 2 different ISPs. One is plugged to Wan and the other to Lan1 (=Wan2). Domestic use network. Only ethernet. No WiFi. A few days ago, I tried to protect a TV decoder with the FortiGate. Creating the multicast policies, I have surely changed something I should not have to. The TV decoder was plugged into lan 2 which belongs to a Vlan switch (called "lan". Members: lan 2 + lan 3). This Vlan provides internet from only one of the routers Now I have the following symptoms: - When using this routers's internet and plugging the ethernet cable to my computer, my Airbook gets an auto-assigned IP first (yellow led) and, after 30 seconds, it switches to a normal IP (green led): Internet is available then. This symptom happens only with one of the routers (plugged to lan2 or lan3... Where the TV decoder was plugged to). I tried to disconnect "STP". then the symptom disappears. But comparing with the old configuration file, I notic

All Internet access must go though a proxy server in my company.  Now I am testing to use FortiClient EMS for my FortiClient users.  But I found that FortiClient cannot connect to FortiClient EMS for telemetry connection via a proxy.  Any work around can make this work?

Hello Team, I have Fortinet firewall configure on Azure cloud as Active-passive with more than 400 Tunnels, Now i want to change mode from Active-passive to Active-Active. Any official documentation to achieve the same ?

I need help understanding an unexpected FortiEDR Manager restart.We observed the following event:Component: ManagerComponent Name: FortinetDescription: Server was restartedBefore this event, several FortiEDR components changed state to Disconnected:XX:XX:XX - Aggregator [aggregator-cloud] changed to DisconnectedXX:XX:XX - Core [core-cloud] changed to DisconnectedXX:XX:XX - Core [fortiedr-core-jumpbox-onprem] changed to DisconnectedXX:XX:XX - Warning: The following connectors will become inactive: Firewall FW (name)Then the services recovered after 20 seconds:YY:YY:YY - Manager: Server was restartedYY:YY:YY - Connection to Syslog succeeded: FAZ1YY:YY:YY - Connection to Syslog succeeded: FortiSIEMYY:YY:YY - Aggregator [aggregator-Cloud] changed to RunningYY:YY:YY - Core [core-cloud] changed to RunningYY:YY:YY - Core [core-onprem] changed to RunningWhat can cause the FortiEDR Manager to restart with the message “Server was restarted”?Any guidance on where to investigate further would be a

I am working as an intern at a startup and the website I am handling https://www.gazfull.com/ is being flagged as malicious by FortiGuard and getting blocked.There is no intentional malicious content on the site. We want to fix the root cause instead of just requesting whitelisting.What are the common reasons FortiGuard flags a website as malicious?Are there specific security loopholes, misconfigurations, headers, SSL issues, third-party scripts, or deployment patterns that typically trigger this?Also, after resolving potential issues, what is the correct process for requesting reclassification/whitelisting with FortiGuard?Any guidance on debugging this systematically would be really helpful.

Hi everyone,We are using a FortiGate 60F firewall with SSL VPN configured for remote access, and users connect via FortiClient VPN.Issue DescriptionSSL VPN connects successfully every time via FortiClient Users receive VPN IP and session remains connected without disconnecting Internal resources (servers, RDP etc.) are intermittently not reachable When the issue occurs, VPN reconnect does NOT resolve the problem Users must either wait or restart system/network stack, but behavior is inconsistentKey ObservationThe issue does NOT occur on all clients at the same time Some users continue working normally while others lose access randomly Affected clients remain “connected” but cannot reach internal network resources Once the issue occurs, re-establishing VPN session does not fix itWhat we have checked so farVPN tunnel remains up with assigned IP Issue appears random across users and sessions No clear pattern related to user group or time   Has anyone faced a similar issue on FortiGate SSL

Hello COMMUNITY,I am facing some problems, I would really appreciate if you can assist me with that. I have installed fortigate on vmware on ubuntu and configured it per this document (https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/545125/ztna-agentless-web-based-application-access).I added the fortigate ip (172.169.173.132) as portal.ztna.com to /etc/hosts to resolve the DNS. The issue is that web portal is not accessible. when I wrote the address to the browser, it shows  with HTTP   This page isn’t workingportal.ztna.com didn’t send any data.ERR_EMPTY_RESPONSE with HTTPSThis site can’t be reachedportal.ztna.com unexpectedly closed the connection.Try:Checking the connection Checking the proxy and the firewallERR_CONNECTION_CLOSED-----------------------------------------------------------THIS IS MY CONFIGURATION FGVMEVYLSWRHYA98 # show firewall vip config firewall vip    edit "ZTNA-web-proxy"        set uuid 65006b6c-42f6-51f1-97c1-5c559a60d09e        set type

Hello there, if anyone has experience with implementing agentless ZTNA, I would really appreciate your help if you look at this issue and help me with that. i am trying but it is not working somehow. It is also very appreciated if you can offer consultation voluntarily or you know someone who can do it, please refer to them. Here is the ticket:  https://community.fortinet.com/support-forum-92/agentless-ztna-tutorial-227295?postid=228019#post228019

I have yet to find a working solution for what seems like a normal networking scenario. Here are the requirements:ports 1-5:  port1: access vlan 5 (untagged vlan 5) should share l3 gateway with any hosts connected to trunks  port2: access vlan 10 (untagged vlan 10) should share l3 gateway with any hosts connected to trunks  port3: access vlan 15 (untagged vlan 15) should share l3 gateway with any hosts connected to trunks  port4: trunk all vlans, native vlan 99. non-aggregate  port5: trunk all vlans, native vlan 99. non-aggregatel3 interfaces of some kind. cannot be under a physical interface because two trunks must carry vlans:  vlan5: 10.0.5.1/24  vlan10: 10.0.10.1/24  vlan15: 10.0.15.1/24  vlan99: 10.0.99.1/24 (native)I’ve read the documentation. I’ve asked open.ai several different times, I’ve had Claude read through multiple FortiOS version documentation. The documentation is not great in this area. So no great that claude cannot figure it out.I can make something like this work w

We are using a FortiGate-200G running FortiOS v7.6.6.We would like to know if there is a way to send alert email notifications when there is a sudden increase in the number of sessions, such as RDP sessions, passing through the FortiGate.If there is a method using FortiAnalyzer, please let us know.Alternatively, a solution using only the FortiGate would also be acceptable.

Go stdlib vulnerability detected in FortiTcs.exe (possible GO‑2026‑4865). Version Forticlient: 7.2.13.1287. Is there a fix that will release soon? Does the version 7.2.14 can fix this vulnerability?