Support Forum

Hi everybody, i have configured FSSO on fortigate, the problem is when i create firewall rule, i want to  set source as sAMAccount (ex: test). But by default on FTG, source must be set by CN (CN=firstname test lastname test,OU=VCC,DC=vcc,DC=com). So my question is are there any ways to set source as sAMAccount? if yes, how can i do it? 

Hi there,i am configuring fortiweb on F5 Load balncer but i am facing an issue that my fortiweb is also using the certificate and F5 load balncer is also using the certificate, as per fortiweb servers in ip pool must accept the traffic on port 80 but in my senerio ip in server pool is F5 Vip ip address which accepts the traffic on port 443 , is there any way that fortiweb decrpt the incoming packet do security stuff and then re-encrpt the traffic and then send it to F5 load balancer. because right now i am facing an ssl error , ssl error connection reset . as well as i want to know if i can add 2 default routes on fortiweb ab i have two incoming links configured as 2 vips in my fortiweb 

Hi Fortinet People, I've just updated firmware v7.0.17 to v7.2.11 and tested network internet download speed and upload speed, which is limited. Before updated firmware download speed and upload speed is 600Mbps- 700Mbps. Now download speed is 200Mbps and upload speed less than 100Mbps. And also Dropbox sync is taking very longer time upload speed is less than kb.  What going wrong? Try to disable security policies antivirus Dns filter, application control, IPS. Issue still persists. Do I need edit SSL inspection? 

Hello.I'm moving away from a HP switch (no cli access) and a Sonicwall firewall to the Fortigate side. I have a 91G and 2x148fpoe switches connected.  They are currently configured in Fortiilink and managed so all ports are being managed from the 91G. I have 2 Proxmox servers that I will be moving over to the new environment and am trying to understand how LACP/LAG works on the Fortigate.  It seems similar with Active/passive mode and 'bonding' 2/or more interfaces into the same LAG group so traffic can travel across both if/when needed. I'm trying to understand, and it seems like I would do the following:1. Open the fortiswitch ports tab2. Choose Trunk ports3. Give it a name and add ports either from the same switch, or specific ports on different switches.4. Set the mode to 'active' and hit 'ok'. If I'm thinking correctly then this would set up, say port 1 on sw1 with port2 on sw2, in a LAG/LACP group as active.  Correct? Is that all there is t

Hi,I am looking for older version of FortiClient VPN version 7.0.8 for MacOSCan someone please help me with the information about where I can get the dmg file.RegardsAmbili B Menon

I have disabled split interface in order to setup MLAG on two fortiswitches. I am using the default subnet 10.255.1.0/24 which I have made routable external via WAN1 (lab network so its actually all RRFC1918 space). I cannot seem to create a policy to allow inbound access to fortilink interface so I can SSH to the switches (only_default.fortilink).How do I configure this so I can ssh from an external (non-fortilink) network?Thanks,

Hello all.I'm trying to understand vlans on the fortigate. i have a 91G and 2 148poe switches in managed mode.This system will be replacing a sonicwall firewall and hp switch config.The current config (HP switch, Virtual Server, VLans on VMs) - workstations receive dhcp from a vlan100 server if the hp port is 'tagged' with the correct vlan. An example would be this:If on the hp switch, G1 has 'untag' (native vlan 1) for port G1 and Tagged with vlan 100, then whenever a device is connected to G1, it receives a dhcp address from my (tagged) vlan 100 server. All this all works well.The 91g has native vlan1. It's default network is 192.168.1.0 and any devices connected to it get a 192.168.1.x network. The fortigate has also been configured with a Vlan 100 network.Port 11, on the fortigate is the default vlan1. I connected that port to the HP switch. The hp switch port (uplinked from the fortigate) is configured as "untag G17".Port 9 on the fortigate is configured with the default vlan 1 ne

Hello team!! We have 2 Fortigates in 2 different sites: FGT80F in site1, and FGT40F in site2I had created a P2P IPsec VPN between both Fortigates some time ago (Connected through Internet)This VPN was working fine for more than 2 years until now.Recently I realliced that although the VPN was up, I couldnt access to anything in the other site through the VPN.  Both Fortigates have Firmware 7.6.4In "Dashboard -> Network -> IPsec", I used the "Bring down -> Entire tunnel" option to "restart" the VPN.After few seconds, the VPN was up again, and started to work (I started to reach anything in the other site through the VPN)After some time (less than 2 hours, IDK how much time exactly), happened the same issue and I "solved" this again by "restarting" again the IPsec VPN, using the "Bring down -> Entire tunnel" option. I cant see any related log.Do you have any suggestion to try to diagnose why did this happen?We didnt change anything recently. Thanks in

Hello everyone, As for i know, REST API Administrators should be disabled by default in FIPS-CC mode:1) (REST API admin account option is not avai... - Fortinet Community)2) (Solved: Re: Fortigate 3301E missing API 7.2.11 - Fortinet Community) I'm new to Fortinet, and i'm currently configuring a Fortigate61F with firmware version v7.2.8 build9703 (FIPS-CC-72-5), downloaded following instructions from this article (Extended Support for v7.0 FIPS-CC Certifi... - Fortinet Community). Enabling FIPS mode was done via console following this guide: (How to enable FIPS-CC mode - Fortinet Community)Command "get system status" shows "FIPS-CC mode: enable"Creating an admin from:  System - Administrators - New - REST API Admin, succeed.APIs works as expected. I haven't found anything related REST API in FIPS-CC mode in the FortiOS 7.2.8 Release Note.Is this the intended behavior or i have made some mistakes enabling FIPS mode? Thanks in advance!  

Hi EMS admins When I update from EMS 7.4.4 to EMS 7.4.5 I have the following error.Upgrade EMS: Err:1 http://apt.postgresql.org/pub/repos/apt noble-pgdg InReleaseUpgrade EMS: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7FCC7D46ACCC4CF8 The upgrade finishes successfully however. And I think you have seen similar error if you performed the same EMS update operation. The question is:Did it bypass the signature check and installed PostgreSQL update? Or did it just abort PostgreSQL update and performed the other package updates?

I need assistance updating my FortiWeb with. We do not have support for downloading the firmware.

FortiAP 431F Deployment without using FortiGate: i want to deploy fortiAP 431 Usibg forticloud (FortiEdge) without use of FortiGate . i was able to incoperate the AP into my network by giving it an IP. But the AP is not contacting forticloud. What could be the issue . I am missing something.I was able to enter ther AP in config mode. I need help deploying the AP and managing the AP online.  #FortiAP #FortiCloud 

Dear Fortinet Support Team,We kindly request your assistance in reviewing the current “Phishing” classification applied to our domain horecathanglong.com .This domain belongs to Horeca Thang Long, a legitimate business operating in the commercial kitchen equipment sector in Vietnam. Our website contains no Phishing, or deceptive content, and we believe this classification is a false positive.We respectfully ask your team to re-evaluate the domain and update its status accordingly.Please let us know if any additional information is required from our side.Thank you for your attention and support.Best regards,Pham Van DoanhHoreca Thang Long CompanyAdd: B1.1-BT101-08, Thanh Ha B, Phu Lương Ward, Hanoi, Vietnam

Hello, I am trying to configure 802.1x authentication on FortiSwitch 148F (firmware 7.6.4) connected to a Fortigate-80F (firmware 7.4.9) using FortiLink but it looks like the FortiSwitch doesn't send any authentication requests to a FreeRADIUS server. I created a firewall policy using CLI as fortilink is not available in GUI, selected "fortilink" interface as source and enabled NAT, policy is also set to allow traffic.I configured RADIUS server on FortiGate, created User Group with RADIUS as a mameber and FortiGate is able to connect to a RADIUS server. Unfortunately when I assign security policy to a FortiSwitch port, the client is not authenticated because FortiSwitch does not send any packets.I thought maybe there is a problem with 802.1x supplicant, so I enabled MAB and still no packets going to RADIUS. I tried to run sniffer in CLI and it doesn't capture any packets.Diagnosed NTP and Fortigate and FortiSwitch say NTP is reachable.  I tested sync status and

SNMPv3 Not able to discover device in BMC application.I have enable on Interface SNMP, Username password created and SNMPv3 enabled . SNMP walk is not able to get the output.

Hi EMS adminsStarting from 7.4.4, in addition to the EMS binary installation method on Linux VM, Fortinet introduced a new installation mode which is VM image: a customized/hardened Linux with pre-installed EMS software, where we can't access the Linux shell, and only the new EMS shell is available.My questions are:As there are now 2 installation modes, is there one specific mode that is recommended?As this is the first release with the VM image install mode, is it recommended to install it in production? I mean is it enough stable? Will I find all the commands I need for all kinds of configuration and troubleshooting that I may need? E.g.: Can I check OS and DB log files? Can run tcpdump or similar sniffer command for traffic troubleshooting?I guess the standalone installation mode (with binary file) will be discontinued and the VM image install will be the unique available mode, right? So if I have now a standalone installation in my current prod and want to anticipate by moving to V

I have found out recently that if i create new user profile on Windows and start Forticlient there it carries over settings of another Windows user using this machine. It is weird approach first of all. Most Windows applications have unique per user settings for every windows profile. Now i have to find a way to delete settings when i prepare same PC for another user by creating a new profile. So, i need to find a location of user settings to be able to wipe them.

i have an urgent situation ans i need your expertise, i have implemented a vdom on my network, i had issues with one of my segments or ip blocks, i configured another root interface, but unfortunately, this new root interface is not able to communicate with some of the existing vdom's, Kindly share a guide or your support shall be appreciated.Thanks 

Is it possible to retrieve metadata on scheduled cli or tcl script.i create meta variable $(ip)I tried on script cli variable $(ip) "$(ip)" '$(ip)' $ip 

I am planning to start my Fortinet certification journey, and I would like to gain some clarity on the Fortinet certification costs. I have checked the official resources, but I would appreciate hearing from those who have recently taken the exams. Could anyone share their experience with the cost of the Fortinet certification exam? 

Hi everyone!  Good day and greetings! I know that there could be a topic on this somewhere and this is a general question but please bear with my st*pidity and ignorance. My FMG_VM64_AZURE is running v7.2.10-build1682 250211 (GA). Our managed fortigates (Both Hardware and VM) are running 7.2.11,build1740 (GA) (Mature).  Now we've been planning on upgrading because our current firmware versions are affected by these  vulnerabilitieshttps://www.fortiguard.com/psirt/FG-IR-25-647 Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass We need to upgrade to atleast 7.2.12 or above version. We're planning on going to 7.4.x 1. I don't see any 7.2.12 version for Fortimanager VM. Am I seeing it correctly?2. I know this is a st*pid question, but if I upgrade my managed Fortigates to 7.4.8, should I upgrade my Fortimanager to 7.4.7? FMG is still lower than the FG if this is the case.3. Does anybody had any major issues to share

Hello everyone,I’m currently working with FortiGate and FortiWeb, I'm new to Fortinet, and I’m looking for a step-by-step PDF or guide that shows how to configure and set them up properly.If anyone has a detailed guide, tutorial, or official documentation in PDF format, I would really appreciate it if you could share it.Thank you very much for your help!

Hi , can someone pls advise whether can translate source port "Any" to a specific tcp port on fortinet central SNAT? thanks in advance ! 

Hi, how can we configure this situation. We have a SD Wan with normal internet access A (1GB/1GB) with NAT router before the FG. The other interface is B MPLS and we dont have NAT. Today A failed and users didnt have access to the internet but dod have access to the MPLS network. The SASE policy had NAT activated and so the access via B MPLS access dondt work. Cloning the same policy without NAT and pushing above solved the problem. Now with access A working again (preferred by SD WAN rule for internet access), users again could not access to the internet because of the policy above with NAT. What can we do? I would like both options to work without having to change the policies. Thanks!

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM applianceWe backup our VMs with Veaam.We have the following settings for most backup jobs.But I'm getting the following error with the Forticlient EMS 7.4.4 server.If the "Enable application-aware processing" option is deselected, the backup completes successfully.Regarding Postgres, I thought it wise to check the "Enable application-aware processing" option.Is a VM backup without this option a reliable restore?