Support Forum

Anyone using FortiTester and can confirm / deny if test case configuration is not shared among users? If I create test case configuration and another user logs in they don't see my created configuration, and neither do I see theirs. These are remote (RADIUS) users.

Hi to all,I noticed that on a L7 Radius Application profile one can switch on "Dynamic Auth" option a configure a destination port for COA.I am wondering if such a configuration option  could be useful to handle COA "back requests " from a node of the radius pool towards a radius client. Suppose that a on the network switch or a wireless controller the ip address of the Radius VIP is both configured as AAA server and COA authorized ip address. I was wondering whether the "Dynamic Auth" switch purpose was to apply source nat to COA requests coming from any of the radius servers in the pool .   On our current F5 bigip LTM I use a forwarding virtual ip address listening on the COA port to source nat COA requests from the radius servers so that  Radius Clinet receives COA packests having the radius VIP as source address.BRMM

“Is it possible to run FortiLink between a FortiGate and a switch over a Wi‑Fi bridge using two antennas, such as Ubiquiti Loco M5? Are there any known limitations or issues with stability? Thank you in advance for any advice.

Hi,we set up an ADVPN Hub and Spoke VPN where:HUB are 2 Fortigate 2600F in Active-Passive HA configurationSpokes are Fortigate 60FFirmware is 7.4.9 version The VPN works fine, anyway we have problems when some bad events occurs. For example if power goes off or the Hub lost some connectivity and HA switch the primary node, all IPSEC tunnels hangs (they are up but not working)The only way to resume them is to restart every tunnel spoke side (waiting at least 10 seconds between down and up) Does exist a way to avoid this situation? Why the HA switch causes the hanging? Thanks

 With below SDWAN rule, will PC in Rule4 use rule1 if internet on port2 is down? 

BonjourJ'active et je désactive des utilisateurs en fonction d'un process interne. Je souhaiterai pouvoir via une commande réinitialiser les autorisations de connexion. Dans l'état actuel si un utilisateur est "enable" et se connecte, sa connexion reste active même si je passe son état à "disable" ...Auriez-vous une solution ?J'ai vu cette commande "diagnose firewall iprope resetauth" mais elle me renvoie une erreur "parse error before 'resetauth' " Merci.

Hi,I’m having an issue with a Yeastar S20 IPPBX behind a FortiGate in a double NAT setup, and I’m looking for help.The FortiGate is behind an ISP modem (not in bridge mode). The Yeastar is behind the FortiGate, and SIP trunks connect it to other Yeastar systems on remote sites.When the Yeastar is connected directly behind the ISP modem (without the FortiGate), the SIP trunks work fine.Once the Yeastar is placed behind the FortiGate, the trunks no longer establish, even though:all required SIP/RTP ports are opened,VIPs and firewall policies are correctly configured,ports are forwarded on both the ISP modem and the FortiGate.I suspect the issue is related to double NAT or SIP/NAT handling on the FortiGate or ISP modem.If anyone has experience with Yeastar + FortiGate + SIP in NAT environments, I would really appreciate any guidance or advice on how to make this work properly.Thanks in advance

Hello everyone, I have a question to which I was not able to find an answer yet.We have a SDWAN/ADVPN setup with one hub (vdom on a 400E) and about 80 spokes. For the hub we want to buy a new 200G, mainly because of the 10GB interfaces. I have found a couple of articles here about migrating a Fortigate to a new model and this article (346859) points out, that i have to add the new 200G to Fortimanager with the help of Forticonverter. Our SDWAN/ADVPN setup is a couple of years old (we started with 6.4) and I wonder if there is way to migrate the hub without breaking all the scripts.  Under VPN Manager -> IPSec VPN communities we have ADVPN-1, ADVPN-2 and ADVPN-3. Every ADVPN has  the same Fortigate with the "Hub"-role - and this is bound to the serial of the device.  I would like to replace this object with the new 200G.... Is there a document around, that shows how to do this?  Or do I need to create all the SDWAN/ADVPN stuff fr

We want to allow the following protocols between two physical ports with two mac addresses:"arp || stp || mdns || pn_rt || pn_io_device || pn_io || pn_dcp" (wireshark notation) With FortiOS 7.6.4 we have set the opmode to transparent and created a firewall policy to allow 'ALL' services, but that only lets the first protocols/services (arp || stp || mdns ) through, but blocks the rest (pn_*). Is it possible to fix this in any way, e.g. by creating an IPS Signature for Profinet (--ethertype 0x8892) and adding that to the policy?The test setup:    config firewall policy        edit 2            set name "Allow all MACs"            set uuid 6e874ff8-eaee-51f0-5cca-7370b58c116a            set srcintf "LAN2 and LAN3"            set dstintf "LAN2 and LAN3"            set action accept  &nbs

Hi everyone, Are there FortiWeb plans for routing protocol support bgp support? Fortigate and FortiWeb have full routing protocol support but not FortiWeb. For example this can be really useful when integrating with kubernetes (k8s) cluster as Calico or Cilium CNI can send PodCIRD through BGP as a way to advertise not the Node-Port service but Cluster-IP without Vxlan tunnels. https://docs.fortinet.com/document/fortiweb/7.6.0/ingress-controller-2-0-0-installation-guide/609720/kubernetes-ingress https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/d19c0748-b069-11f0-b8e9-a6060d4c736b/FortiADC_Kubernetes_Controller_3.0.0.pdf  

Hey everyone, Are there plans for FortiADC gRPC security support like in FortiWeb? https://docs.fortinet.com/document/fortiweb/8.0.3/administration-guide/797650/grpc-protocol

If my ip pool for remote access VPN is 10.200.200.1-10.200.200.100 then which ip address will be used as client gateway?

Good afternoon, I have a question regarding user session logs. I have a group that has YouTube blocked but in the logs I see YouTube sessions that are blocked and sessions that are not and they download (??) 400 MG, can you explain to me what is happening? I am doing something wrong?I have Fortigate 60F v7.0.13 build0566 (Mature).Thank you so much 

Hello, I'm currently blocking Windows updates via Application Control on my FortiGate firewall. However, I'm having trouble. I want to configure Windows updates to only install language packs. Is there a way to do this? I checked the traffic flow, but I can't figure it out...

I have hub connect to the spoke using 3 different lines, and from bwlow pic i want to troubleshoot why path using 10.103.113.6 is not best path. Anyone knoe how to troubleshoot this? FW01 (Internet) # get router info bgp network 10.4.0.0/16VRF 0 BGP routing table entry for 10.4.0.0/16Paths: (3 available, best #2, table Default-IP-Routing-Table)Advertised to non peer-group peers:10.103.113.2 10.103.113.3 10.103.113.4 10.103.113.5 10.103.113.6 10.204.0.30Advertised to peer-groups:advpn_isp1 advpn_isp2Original VRF 0Local, (Received from a RR-client)10.10.111.6 from 10.10.111.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 1Last update: Thu Jan 8 04:59:01 2026 Original VRF 0Local, (Received from a RR-client)10.10.112.6 from 10.10.112.6 (107.107.107.107)Origin IGP metric 0, localpref 100, valid, internal, bestReceive Path ID: 1Advertised Path ID: 2Last update: Tue Jan 6 09:20:25 2026 Original VRF 0Local, (Recei

Hello,We noticed that FortiClient 7.4.3.1790 loads the following OpenSSL‑related DLLs:libcrypto-3-x64.dlllibssl-3-x64.dlllibcrypto-3.dlllibssl-3.dllThese files appear to be based on OpenSSL 3.1.7, and Microsoft Defender for Endpoint is associating them with:CVE‑2024‑13176plus one additional vulnerability affecting OpenSSL 3.1.xCould you please clarify the following?For the OpenSSL 3.1.7 components bundled with FortiClient 7.4.3.1790:Are these builds affected by the vulnerabilities?Or are they patched/customized by Fortinet, even though this is not mentioned in the release notes?Is there an existing or upcoming FortiClient build that includes a more recent OpenSSL version (e.g. 3.1.8 or 3.1.9)?Is there a Fortinet security advisory confirming whether FortiClient is impacted (or not) by CVE‑2024‑13176?We are trying to determine whether this should trigger remediation or if it is likely a false positive from Microsoft Defender.Thank yo

Hi all,I’m currently working with two FortiGate 401F units that I want to deploy either in a Virtual Wire Pair or in transparent mode to serve as IPS devices. These are placed in a classic 3-tier layer design and should sit transparently between the Core and Distribution layers.In our current setup we are dealing with asymmetric routing, and the FortiGates are supposed to act as IPS. We have the FGSP cluster configured, and sessions are being synced correctly. However, when following the Fortinet documentation for UTM inspection on asymmetric traffic (https://docs.fortinet.com/document/fortigate/7.4.9/administration-guide/324430/utm-inspection-on-asymmetric-traffic-on-l3), the traffic is not being forwarded back to the session owner. Instead, it still exits out of the transparent interfaces.So far, even with symmetric session pickup / session routing options tried, the traffic path remains as if the FortiGates are just passing through without proper asymmetric session steering back to

Hello and sorry for my english, I try to configure WAF profile on my fortigate 7.6.5. it is not difficult to configure but for create exceptions i don't understand what is the best way... For example, the WAF block this URL : http://moodle.toto.fr/course/modedit.phpI have the event ID signature : 40000137First, it is possible to do exception in GUI ? don't find....i undertsand i can do signature exception in CLI but i see there is also :address-list : Address block and allow listsurl-access : URL access listso what is the best way ?thanks a lot

Hi EMS adminsIn FortiClient EMS 7.4.x, what is the difference between database backup and zip backup?Is it the same? May I understand zip backup contains DB backup and EMS settings? What is the recommended backup?Searched in documentation but couldn't find the difference.

Cookbook: ADVPN s/BGP on LoopbackGuide on how to properly setup ADVPN with on Loopback.This is a quick and easy configuration. Don't let MSP's charge you 40-50k for this solution. We've been in three scenarios this year, where we had to come in and fix a customers install that their MSP did for 50k, and rip it completely out and start over.Full Testing proof Dual-Hub / 15 overlays: https://youtu.be/04BjjyMYEEk?si=o6qpHrprttcPCyHGCreating templates and deploying with FMG: https://youtu.be/h42MymcAVng?si=nhaJUHNVnrCqcrp8Proving cross overlay traffic works: https://youtu.be/3SmNWZGlIgw?si=QCXi7reaJq3eKQDYImportance of sla-min-meet: https://youtu.be/WMpTmdnr**bleep**?si=tlp2o-xPlCrPVt3EProof aux-sessions is bad, turn it off: https://youtu.be/2ay5iQkZOf8?si=WiT8teo5dklebGbKReach out to me if you need help, guidance, or just want it done quickly and correct by a US based Fortinet partner.========================= Pre-TASKS ==Plan this out, watch this firstI truncated

finally had time to add this to my HOWTO sheet for everyone.Requirements:Forticlient: 7.4.1 +FortiOS: 7.4.5 +https://docs.google.com/spreadsheets/d/1QgMkKxQQINvPLsXQyRRb3QqWmRizXpt-xOLvMxfw9F8/edit?usp=sharingEnjoy!UPDATE: I just revised the document so it is a full XML config file (tagged as partial) thus you may import it into foritclient and it will only add the additional profile and preserve your others.NOTE: Admins may want to import this into theirs, and then re-export it. It will allow the PSK to become encrypted and then you may be able to share it.

There are already some upgrade issues realted with version 7.4.9.Upgrade reason is, that fortigate cluster doesnt operate at all after every 14-20 days and only way to get it back, is to make power interruption.I have heard, that if to upgrade from 7.2.11 to 7.4.9, fortigate can be stuck after upgrade. Somewhere was comment from Fortinet, that they investigate that problem.I upgraded a model 60E and it was succesful. It makes me more confident, but only little, because model 600F is different and that is I'd like to upgrade next. Best case, there is no downtime at all and dual SFP tranceivers also are compatible. Worst case, that I have to manage via console and boot from older version and configuration and then I have old version back. Does anyone have expreiences, what models are related with this problem or is it just FortiOS case and not hardware related problem?

We had our fortigate set to auto update firmware and it did. No issues, and then days-weeks later the customer reported same devices off it's LAN not getting internet access, and some devices off it's sub interface (VLAN 10) which was used for their Guest wifi (No AP's off this firewall).  While looking at the GUI under dashboard Network, or Assets & Identities, the Address column instead of showing regular IPv4 addresses (EX: 192.168.1.x) it was showing something like a GUID # which was something like 32-48 characters long, but not a IPv6 address.  After a reboot they reported the issue went away and the GUI started showing correct, so we are downgrading to 7.4.8. 

How to configure FortiGate Secure SD-WAN using the FORTIMANGER for HUB and Spoke ADVPN Deployment  Take control of your network like never before! Step into the world of cutting-edge networking with our in-depth guide to configuring FortiGate Secure SD-WAN for a Hub and Spoke deployment using FortiManager. This is more than just a tutorial-it's your blueprint to transforming your network into a high-performing, secure powerhouse! Here's what you'll master:Building Secure Overlay Tunnels: Achieve seamless connectivity between hubs and branches.Crafting Advanced SD-WAN Rules: Elevate app performance and user experience with precision steering.:shield:️ Optimizing Routing: Maximize efficiency and security across your infrastructure.:control_knobs:️Centralized Management with FortiManager: Simplify complex deployments with ease. https://youtu.be/6tz7fWc960I 

Hi all,I was thinking about upgrading to 7.4.9 but I’m seeing a few threads and posts about issues with IPsec tunnels. Is there a particular configuration type which are mainly impacted? We have many tunnels with third party vendors. Will 7.4.9 cause issues with them? Is there a patch or fix for it?I checked 7.4.8 but it’s got a lot of vulnerabilities which are patched in 7.4.9, so I’m stuck on my decision.Thoughts?