Support Forum

Hello, I recently purchased several second-hand Fortinet devices (FortiGate, FortiSwitch, FortiAP, FortiAnalyzer) for personal use only, with the goal of learning and improving my skills with Fortinet technologies. I opened a support ticket to request an Ownership Transfer, but it was declined because the equipment did not come from an authorized Fortinet partner.Here is the response I received: “Sandra HamiltonAdded on 2025-11-25 23:29Fortinet Support Hi Jerome,Please refer to the following link for details regarding the registration of devices not purchased from an authorized partner:https://www.fortinet.com/corporate/about-us/legal.html. ‘Fortinet support is only available for products purchased directly from an authorized Fortinet reseller. Products not purchased from an authorized reseller are not eligible and will not receive support.’ Unfortunately, we cannot process the ownership transfer. The reasons are as follows: Fortinet cannot guara

We are trying to authenticate a wireless client using EAP-TLS on a Meraki AP against a FortiAuthenticator (with RADIUS).The EAP-TLS is successful but the wireless client doesn´t receive a DHCP IP address, nor does it have network access. However, a wired EAP-TLS (computer authentication) request from the same client works flawlessly. Parts of the debug log show: (2794) facauth: ===>NAS IP:192.168.100.96 (2794) facauth: ===>Username:host/W10CLIENT.company.local (2794) facauth: ===>Timestamp:1707907999.157486, age:1ms (2794) facauth: Comparing client IP 192.168.100.96 with authclient Meraki-AP1 (192.168.100.96, 1 IPs) (2794) facauth: ------> matched! (2794) facauth: Found authclient from preloaded authclients list for 192.168.100.96: Meraki-AP1 (192.168.100.96) (2794) facauth: authclient_id:2 auth_type:'eap-tls' (2794) facauth: Found authpolicy 'EAPTLS' for client '192.168.100.96'<SNIP>(2794) facauth: Updated auth log 'host/W10CLIENT.company.local' for attempt

 I would like to know if some have done something similar ?How to enable a user to change password or renew expired password using ZTNA, i have seen some post but for ssl vpn or ipsec https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-allow-LDAP-user-to-change-password-at-first/ta-p/243530 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-LDAP-user-to-renew-expired-password-via-VPN/ta-p/408679 FortiClient #ZTNA FortiGate 

Hello team!! I need to know compatibility between FortiOS (Fortigate) and FortiClient, and between FortiClient and Client OS versions.For example, I need to know for an specific OS version (Windows, Linux, and Mac OS), which is the last FortiClient that supports this OS.  And also, I need to know, for this FortiClient Version, which is the last FortiOS supporting this.I found some old compatibility matrix, but this didnt help me.Which is the correct way to find out this?Do I need to read the release notes?  FortiOS or FortiClient release notes?In which section do I find the compatibility? Thanks in advance.Regards,Damián

Hello. We want to change our EMS-Server to be reachable from Public and not only from internal network. At the moment users connect to an internal FQDN-Name while on internal network or connected via VPN.  When changing the FQDN name of EMS-Server to a public reachable name, is this affecting the current connected users?  The current users are connected through an invitation code and registered via LDAP to EMS-Server. Do they need a new invitation code after changing the FQDN Name? Thank you. 

Hi everyone, How do I limit bandwidth on a policy in FortiGate 600E using a method that restricts bandwidth for specific IP addresses only?

We have a remote site with a primary connection to internal networks via MPLS/BGP. Everything works.When MPLS goes down, we have a backup ipsec VPN tunnel (OSPF) that comes up after about 90 seconds. In testing, I have a continuous ping running against a client machine at the remote site. Pings timeout when MPLS goes down, and then replies resume when VPN comes up. Traceroute before and after shows that routing is changed from MPLS path to VPN path. So everything looks good from routing and ICMP perspective. However, after the site comes up on VPN, I am unable to use our management tool (ManageEngine) to manage the remote machines. ManageEngine no longer sees the machine agents and displays them as offline. I cannot use the remote control tool, and I cannot use the remote command line tool. Also, I cannot RDP to the remote machines either by hostname or IP address. Finally, I can no longer log into the remote fortigate firewall with my domain credentials,

Please help what command to show output below?  

Hi! Im struggling to construct a proper whatsapp rule. Have 3 different lines to catch all the traffic since with only one it was impossible.The first rule is destination "Meta-Whatsapp", nothing else since no service can be elected using that way.Then have to create a second rule to catch TCP & UDP 3478, since have a lot of blocks without that one.Finally, have to add whatsapp_com and _net wildcard. No much traffic on that one but have to add it.Im running FortiGate 7.4 with all licenses.Thanks to all!

I can't seem to connect using the free FortiClient using # macOS Ventura. When I get the popup below and I click "Open Security & Privacy Settings" it takes me to the "Appearance" pane, but when I got to Full Disk Access the FortiClient and fctservctl2 does have access. Has anyone solved this issue?PopupSystem Settings 

Hello, I followed this KB  https://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801194/deploying-mclag-topologies.  This is my topology:Aggregate FGT (x1,x2) set lacp-mode active and Fortilink split interface disable.FGT x1 --> port23 FortiSwitchAFGT x2 --> port23 FortiSwitchBport 24 FortiSwitchA --> port 24 FortiSwitchBport 25 FortiSwitchA --> port 25 FortiSwitchB  This is the topologybut I would have expected a topology like that Any suggestions? Thanks in advance for the support.BR

File is present in Windows drivers folder.PSIRT is unclear on whether vpn-only edition is vulnerable. There is no 7.4.4 release for vpn-only.Is vpn-only vulnerable? If yes, when is update coming?

Hello everyone,we are currently running a FortiGate on firmware 7.6.4 with an IPsec dialup VPN using SAML authentication over IPv4. This setup works without any issues.However, more and more of our users are receiving IPv6-only connections from their ISPs (no public IPv4 available anymore), which causes the IPsec tunnel to fail. Because of this, we want to migrate the dialup VPN to IPv4/IPv6 (dual stack).I have several questions regarding the required prerequisites:Does the FortiGate WAN interface need a public IPv6 address from the ISP in order for IPv6-only clients to connect?Does the FQDN used for the dialup VPN also need a AAAA DNS record, so clients can resolve the FortiGate over IPv6?Is switching the Phase1/Phase2 interface to “IPv4/IPv6”, and adding IPv6 firewall policies enough? What about the DNS resolution of the internal hosts?Thanks in advance, is there any migrating doc available? I can only see SSL VPN IPV6 docs.

We've have a pair of FortiGates in Azure in HA and we're setting up the SDN Connector using Managed Identity.  We do not understand what the resources path setting is doing for us.  From what I read it seems that this setting restricts the scope of what the connector will interact with in Azure.  However, we are defining all the route tables in Azure that we want the connector to update in the event of a failover.  I don't believe we need the resource path settings (subscription id, and resource group).  I don't believe they will do anything for us in our configuration.  Can someone let me know if I am right?  I want to leave that setting turned off entirely.

Hi We are tying to setup the following: Autoconnect to IPsec VPN using Entra ID logon session information https://docs.fortinet.com/document/forticlient/7.2.3/ems-administration-guide/396545/autoconnect-to-ipsec-vpn-using-entra-id-logon-session-information We have the Client configured in EMS and able to connected to the IPSEC VPN, but how can you then control which logged in users have access via firewalls policies?  I was thinking about using usergroups on firewall policies but this just doesnt seem to work, does any one have any experience of restricting the FW policies based on which users are in which groups in Entra?? Many Thanks

I want to know how to block info.php or any other page through fortiweb. I created access rule and applied to web protection policy but does not seem to be working. Please see the screenshot below. Am I missing missing anything?  

FortiGate 7.4.3 using both VM and 60F platforms.I set up two tunnels in a zone with duplication=force outbound and de-duplication enable inbound. On the origination side, outbound packets are duplicated on both tunnels and are de-duplicated on receiving end. This works both ways. However, if I ping or try a TCP connection, the response packets sent from the other end are not duplicated.I ran the Debug Flow and it clearly states in the log if it is duplicating or not, and for established sessions for "return" traffic it always picks the input interface of the session to send the data to, and does not take the extra step to duplicate to the other zone member.Is this by design, a bug, or a configuration error? I scoured config flags to see what is related to duplication and found nothing there.

Hi,I have a fortigate 200F and I want to setup micro-segmentation. we have cisco 2960 switches in our network and all servers are VM on vmware esxi server. How can i do that?

We have an issue with our firewall, since 3 months back everything behind the firewall is almost no accesible vi Internet, if we can access the different devices it is really slow . After some investigation we figured out it must be the firewall. So i connected an ethernetcable between my ps and firewall. Did it as this  On your management computer, configure the Ethernet port with the static IP address 192.168.1.2 with a netmask of 255.255.255.0. 2.  Using the Ethernet cable, connect your computer’s Ethernet port to the FortiWeb appliance’s port1. 3.  Start your browser and enter the following URL: https://192.168.1.99/  (Remember to include the “s” in https://.)   But i cannot access the web UI, i get Timeout How can i solve this issue,  I dont want to reset the firewall because dont remember the setting for it. I spent hours setting it up:-) Hope for some helpfull input

Hello team!!! My boss asked me to block Internet access for Firefox and Opera browsers in a Fortigate 60F :( with version 7.6.4In an application control, which is like the "default" (All categories as "Monitor"), I added an application override, to block the following apps:* HTTP.BROWSER_Opera* HTTP.BROWSER_Opera.Mini* Opera.Turbo* Opera.Update* Opera.VPN* Firefox.Update* HTTP.BROWSER_Firefox (All applications found with the words "Opera" and "Firefox")I applied the application control to a policy for the test machine, and when I tested, I still could use any browser.The policy has applied the default "certificate-inspection" profile as "SSL Inspection"Does this needs to use full inspection?Do you know why both browser are still working?Is there another way to block these browsers from the Fortigate? I know this is better to block the application from the computer or from a centralized solution, but I need to know if is this possible to accomplish this with the Fortigate

Currently I have a Fortigate 60F and using a dedicated fortilink interface to port 24 of a S124EP switch. I now have a FortiAP C24JE wall plate AP I would like to add with built in switchports. Whats the best way to configure this into the system to make use of the AP and switch ports. Can I create another fortilink interface on my switch for it and have it pass all the information through to the AP/Switch combo?  

I set up a fairly simple guest network with one FG80F and two FAPs. Per company standards, I have to implement a Captive Portal. When I initially configured the SSID, it was "open" security mode with a "Disclaimer Only" CP, and it would redirect to the facilities website when you accepted the terms and conditions. I tested it myself when I was on site and it worked perfectly.  A week goes by and the site rep contacts me explaining that users can't connect to the internet. They get the splash page, click accept, and then nothing. He tested it himself and sent a pic of the result (see attached). I found that disabling the CP lets users connect just fine, which leads me to believe there's some issue with the redirect. I don't know why it would be working one day and stop the next. I've gone over my configs several times and nothing jumps out at me as a possible cause, but I'm still fairly new to Fortinet, so I must be missing something. Thoughts?     

Hey all,Sitting up fortigates for my work recently and I'm curious how many of you actually use the "deep-inspection" for ssl inspection, particularly for the IPS vs just the "certificate-inspection".Seems like it would really slow down internet traffic and cause performance issues, plus the need to throw a cert on all clients.

Hi, We have recently understood that IKEV1 is being phased out and we are currently studying IKEV2 for our IPSEC Dialup connections.We are a Windows house so we will be using LDAP for our users and I would like to know if anyone can provide feedback about which MFA or 2FA they are using and any associated problems.I have seen varying information that stated that if we use EAP-MSCHAPV2 we cannot use FortiToken with LDAP accounts.  And if we use EAP-TTLS we must have EMS licences but Fortitokens might still be possible.Can someone confirm which setup the have successfully setup, it must be a LDAP setup and which MFA they are using and any roadblocks that they have come across.Cheers 

 I have an 802.3ad aggregate using 4-port in FG dual-node cluster and a Cisco Catalyst Cisco IOS Software Bengaluru, Catalyst L3 Switch Software CAT9K_IOSXE, Version 17.6.5, RELEASE SOFTWARE fc2The current status is: In FG all 4 ports are in Up-Running-Active statestatus up algorithm L4 lacp-mode activeBut in cisco side, half of the ports are in SUSPENDED stateWhy is that?How to detect parameters that are not matching? FG support is limited to tell me that in FG side everything is OK and even sending diag and sniffer information, still, they can´t tell what´s could be wrong in Cisco SideHere, an example, the S status of the port101    Po101 SU       LACP        Gi2-0-44 w     Gi2-0-46 s============================================================================status: upnpu: nflush: nasic helper: yports: 4link-up-delay: 50msmin-links: 1ha: masterdistribution algorithm: L4LACP mode: