Support Forum

When an SSL-VPN gets disconnected without the user intentionally pressing the Disconnect button, shutting down the PC or such, FortiAnalyzer logs the reason for the SSL tunnel shutdown either as "Lost the connection" or as "User requested termination of service".  The first reason is expected, the second isn't. What causes such a disconnect to be logged with reason  "User requested termination of service"? Kind regards, Herta

Is there a way to successfully perform periodic license validation on FortiVM without setting the default route to the Internet?Due to certain circumstances, I need to permanently set the default route to the LAN side. However, when I do this, the license validation fails.I assumed that as long as the FortiGate could reach FortiGuard servers and resolve their names, it would be fine. So I added static routes for the following destinations to enable connectivity.・service.fortiguard.net・update.fortiguard.net・guard.fortinet.netPing to those destinations succeeded. Currently, the license validation only succeeds when the default route is set to the Internet.Is there any way to resolve this issue?Software Version：7.4.7

Hi there,we are working with multiple IPv4 subnets in the area 10.98.0.0/19 but we're configuring them on multiple interfaces as multiple networks with subnet lenght 26.I'd like to add a filter to the prefix list - In Bird2 you can work with greater than equal or less than equal like 10.98.0.0/16{26,26}I tried the same on forti manager, I've added a an entry to the prefix list and entered 26 as prefix length in both greater than and less than. But it throws an error:I don't understand quite right, as it keeps telling me "Greather than" must be greater than prefix (met) and less than or equal than "less than" (which is met as it's equal to it)...What am I missing?

Hi,We have hypervizors with VXLAN interfaces which are connected over vlan 600. So I created vlan 600 in the fortigate, and vxlan interface on top of that. That part works.But now the hypervisor vxlan's will have to connect to different vdom's. So one VXLAN terminates in vdom-a while another terminates in vdom-b. Creating emac interfaces on vlan 600 for each vdom did not help,  because VXLAN can't be created on an emac interface.Any suggestion/experiences on how to go arount this?

HI All,As per the subject I am seeing this traffic logged and timing out due to upstrean firewall dropping it. As far as Video filtering was enabled in on of my vDom but I have since disabled it and am still seeing this logged.I have proxy address set under 'system autoupdate tunneling' and 'config system fortiguard' has 'proxy-server-ip' set. So two questions :1 - Why does this not use the proxy ?2 - How do I disable this entirely ?Thanks Domoninic

Hello There,We are trying to run a playbook to extract pdf files and upload them as a attachment.Extraction seems to work fine but we end up getting a error on the upload.Following is the error in the UI.\n CS-INTEGRATION-5: Error occurred while executing the connector action ERROR :: 400 Client Error: Bad Request for url: https://localhost/api/3/files :: {'type': 'TypeError', 'message': \"Internal Server Error. Check log 'prod.log' for more details\"} :: Url: https://localhost/api/3/files Call for URL: https://localhost:9595/integration/execute/ failed with status code 400 \n Looking at prod.log in cyops-api/prod.log we can see that there is a Issue with the restrictedMimeTypes. [2025-12-02 09:10:07] php.WARNING: Warning: Undefined array key "values" {"exception":"[object] (ErrorException(code: 0): Warning: Undefined array key \"values\" at /opt/cyops-api/src/Service/UtilityService.php:669)"} [] [2025-12-02 09:10:07] php.CRITICAL: Uncaught Error: App\Controller\FilesControll

Hello, i try to write a Report Query with a where clause for the "action" field, if action is only in the "SELECT", "GROUP BY" and "ORDER BY" statement everything works as expected, but if i add the action field to the "WHERE" clause it does not work.The following query does not work, commenting out the "AND action like 'deny'" row will make it work, can somebody explain this behavior to me??I am using "traffic" log type source. SELECT srcip, dstip, action FROM $log as l WHERE $filter AND policyid=0 AND action like 'deny' GROUP BY ( srcip, dstip, action ) ORDER BY srcip, dstip 

Dear Expertise, I would like to ask you regarding backing our Fortigate log to tape is a good way or not? we are using FAZ and our license can support only 5GB per day. Thanks

Hi Team,Can some one give a knowledge base/ article which details the step-by-step procedure on how to replace a fortigate firewall running V7.4.8 in Fortimanager GUI.In my setup Fortigate VM's are running - SD WAN rules, please give me detailed step-by-step procedure on how to replace (RMA) the faulty Fortigate Virtual machine with a new Virtual machine from Fortimanager 7.4.8 GUI.Also please detail the procedure to transfer the license from faulty machine to new virtual machineThanks,Prabhu

Hi Team Is there any best practice for deciding Scan for Vulnerabilities need execute Event-based scanning or Scheduled scanning.  

I'm using IPsec VPN with FortiClient 7.4. I've configured two IPsec VPN servers (primary and backup) and deployed the settings to clients via FortiClient EMS. However, during usage, the connection to the primary server consistently drops every 30 to 60 minutes, while the backup server disconnects even more frequently and irregularly.All components are running version 7.4, and there’s no packet loss between the public networks involved. This issue affects all users in our environment.Has anyone encountered this behavior? Any suggestions on how to troubleshoot or resolve it would be greatly appreciated.

I use my FortiAnalyzer (7.4.8) as a "poor man" syslog server and am trying to see if I can incorporate logging from Cisco Umbrella. Cisco Umbrella only sends to AWS S3 storage and I have the path and keys for said bucket. I saw where FortiSIEM has said functionality, but I don't own that product... so seeing if there is a way to handle this via FortiAnalyzer in any form or fashion. This might end up being my final push point if it cannot, to go with something more dedicated as my new syslog platform.

We have our Fortigate firewalls configured for Syslog offloading to Cynet.  We are then trying to take action, to block IP addresses of users trying to brute force VPN credentials.  We are using a script provided to Cynet by Fortinet named Fortigate-Remediation V0.2.exe, and when it tries to block an IP address, it is getting back "Max retries exceeded".  Any chance anyone knows what the fix for this is?

Hi all, Could I use the FANT-5IN1-TG-5M-FEV antenna with the FortiGate 50G-5G? Thanks a lot Best regards,

Hi everyone,I built a small public-facing web app that calculates Air Force PT scores using the latest standards. The site is fairly simple (just data inputs, PFT calculations, and score outputs), but I want to make sure it's properly secured since it’s starting to get more traffic.I’m running it on a cloud VPS and have a FortiGate VM set up, but I’m not totally sure if I’m configuring things correctly for this type of lightweight tool. Specifically:Do I need full Web Application Firewall (WAF) features for something this small, or would basic IPS + URL filtering be enough?Are there recommended settings for protecting simple form-input sites from script injection or bot traffic?Should I be using any FortiGate-specific features to handle potential spikes in traffic or prevent abuse?And lastly, is there anything I should check to make sure my HTTPS setup is fully compliant?I’m not handling any personal data, just the PT scoring inputs, but I still want to lock it down correctly.Any guida

New to Fortinet and VPN... I setup my Fortigate-60 similar to the example from the documentation: " Dialup-Client IPSEC VPN Example" When I try to connect I get the following error in my Forticlient log: status=negotiate_error msg=" Negotiate SA Error: protocol_id=1, notify_msg=18 (INVALID_ID_INFORMATION), ispi_size=0 " . When attempting to connect I' m behind a Linksys router with no firewall. Anyone know why I' m getting this or is their some better documentation I can follow to figure out this message? Thank' s

Hello, Could please let us know if 70G Support Agentless ZTNA.  We want to use it for RDP Bookmark access. Thank you

Hi , I have few firewalls - virtual machines running v7.4.8 all the virtual firewalls are configured with SD WAN rules. This is a SD-WAN setup - Hub & spoke topology. My requirement is DSCP values configured on a Fortigate firewall should be left untouched on other Fortigate firewall.  My setup is a hub and spoke setup.  Can anyone please give practical example of configuring DSCP values on a firewall from Forti manager GUI or FortiGate firewall CLI so that same DSCP values are reflecting on other firewall

Hi, i currently met with an error i cannot fix no matter how many hours i put into it.The workstation is currently working on Windows 11 pro 24h2 with 7.4.3.1790 FortiClient vpn Only with ARM based processor SnapDragon X Elite - x1e78100The app was working just fine until one day it stopped, happened for 2 ARM based laptops around the same timeI tried:Reinstalling the app, vcredists, javasRemoving all folder, also the hidden ones relating Forticlient VPNRemoving everything with the word "Forti" from regeditUpdate the windows system and the deviceTon of reboots, launching app as admin, changing permissions to folders in windowsCurrently im losing hope because i keep trying and trying everything i can find on the web and forums and its not working.I will really apreciate any help.Kind regards.

Hi everyone, I've configured an openLDAP server as an LDAP server for my FortiAuthenticator, connection is establish successfully. I need to import a specific user in Remote Users, but the user is located in an OU that contains more than 500 users so the Fortiauthenticator is not able to display the full list of the members of the OU. I've tried a bunch of filter but I still get a "No result found" each time, because example filters have found and adapted are all Windows AD based and that's not my case here The username attribute on the OpenLDAP server is "uid" Is there a way to filter only a specified uid using LDAP filter when querying the openLDAP server ? so the Fortiauthenticator can display it and let me import it For Example, I have the following Base DN : ou=users,dc=domain,dc=com The User DN is : cn=vpn.user,ou=users,dc=domain,dc=com How can I return only "vpn.user" in the list since the "users" OU has too more entries to be displayed on the FortiAuthenticator GUI Than

Having had quite a few issues, there is one annoying one that is remaining, I have a Fortigate running an SSID using the FAC as the Portal for registration etc, which is working fine on Android, Laptops etc. but any apple device when selecting the SSID redirects to the "captive.apple.com" page on the phones and displays the message "Hotspot login, cannot open the page, the server cannot be found" if the user browses to this captive address you do get the "success" message. Im raising this here as there are a few articles that tell you , on the Fortigate to "exempt" captive.apple.com from the SSID, which I have done. this article: Captive Portal on Apple devices - Fortinet Community doesnt do anything, is anyone able to offer some assistance? is this because the iphone has cellular data turned on or related setting?thanks

Dear Experts, By 2 separate vlan switches, can we have 2 different LAN subnets?Here is an example. "internal" (original vlan switch) has physical ports 1-3. 192.168.10.1/24New vlan switch called "switch2' has physical ports 4-5. 172.16.1.1/24Both "internal" and "switch2" have routes to wan.There is also route between "internal" and "switch2". I tried, however, I cannot realize it. The device is Fortigate 60F. Any comments would be appreciated. Best regards,  

Hey all, Using the Forticlient VPN for Android (mostly with Samsung phones but other varieties).Connecting to a Fortigate 81F. I want to enforce MFA via Microsft 365.  It works fine on Windows desktops, but there is an issue with the Android app. Firstly it requires Google Chrome which is strange but... when Chrome opens to the M365 login page I go through the motions, switch to the authenticator app type the number in, switch back to the Google Chrome sign-in page but it still has the Approve sign in request page, and Forticlient doesn't  seem to recognise that anything has happened. I have 2 other apps that work similarly and they work fine.  Is this an issue someone else has come across and hopefully solved? thanks j

Hi We would like to migrate our 2 ISPs to the FG200G for SDWAN configure as load balancer. Our current load balancer, Mushroom, supports a maximum throughput of 300 Mbps. This limits our setup. Question Our current setup is  Mushroom load balancer has four ports: two are connected to our ISPs, one goes to HSIA Xpossible, and the last one goes to the firewall. I would like to decommission the Mushroom load balancer. Can the FG200G handle a large /16 network with a single VLAN for HSIA Xpossible? Have you tried this setup? Do you have any ideas for a more efficient approach?

Hello everyone!Just a quick question,  how should I prepare for it? Is retaking the FCP_FGT_AD-7.4 Learning Path quizzes enough, or should I practice with other types of tests as well? Any advice would be greatly appreciated! Thanks in advance!