Support Forum

Hello Team,We are seeking your support if any one has implemented fortisandbox on AWS in HA mode with dual zones.if yes can you share like LLD with scenrio reference for the failover scenario with IPs assigned

I've been building some policies to control egress and I came across and interesting situation. I was building a policy for Apt (apt-get). And it works perfectly fine. Except for when a server has an additional repository installed. These are all Debian 12. And everything works except for when the Docker repos refresh. In which case Apt starts getting back 403's and 401s. Toggling the policy on and off directly affects whether Apt works correctly or not.  So, I'm trying figure out if this is my outbound SSL inspection policy meddling with a pinned cert or something I need to modify in my policy.  Thanks all for the thoughts on this.

I bought two second-hand Fortiap 231fs; the idea is to have only two APs with the same SSID, is it possible? And secondly, I registered it and then deleted it. Now I don't know how to manage it; what's the best way to correct it?

Hi,I have a client turns off this firewall at night and again turns on at morning. So basically firewall restarts, so when firewall starts DNS servers gets changed to an unknown IP, so i have to manually change the DNS to fortigates default server, i have to change the servers every morning, I want to know is it a BUG or something else? previously OS was v7.2.10 to fix this i upgraded to v7.4.8, but the issue still exists. It is a new 80F device.

I have an SSL VPN configured to point to the 128.1.1.0/24 network. When I connect, it assigns me an IP address from the 128.1.1.x range. However, I need to create another connection pointing to the 192.168.2.0/24 network so that it can connect using FortiClient. How do I configure this second VPN connection? I'd like it to assign me an IP address from the 192.168.2.x network. I created a firewall rule for both networks, but it always assigns me an IP address from the 128.1.1.x network. Or would it be better to use an IPsec tunnel for the second VPN? Would the other VPN continue to function normally? Thanks

Hi All, I must be missing something really simple here...In the FortiGate GUI, under Wifi & Switch Controller > FortiSwitch Ports, is there a way to filter by port status? I want to see which ports on all of my managed switches are currently "up". Any feedback is appreciated. 

Hi to all,can somebody explain how to handle QoS and traffic shaping in hub and spoke sdwan where spokes are connected via two tunnels (mpls and Internet). The part that is confusing me is that branches have different Internet download speed and we have one Internet link in HQ. Sum of all branch download is higher than HQ upload. How to guarantee bandwidth for different classes? how to use max bandwidth if other branches are not using it? How does HQ handles these different speeds in SDWAN? Where do Traffic shaping policies and profiles fit in here? regards

Hi, I haven't found anything online relating to this so thought I might ask here if anyone has come across a way to do it, Currently I am testing a VXLAN tunnel running between 2 Fortigate 60F firewalls connected on Port1 (internal1) with a VXLAN interface (vn1000) attached to a software switch along with internal3 connected to a PC within the same IP subnet (192.168.1.x) on each firewall,The PC's are able to ping successfully so the VXLAN tunnel is operating correctly, but I wish to attach a DSCP Marking to the VXLAN traffic (CS6, binary: 110 000), This is currently what I'm seeing through Wireshark:     I have applied DSCP at the the Traffic Shaper 'high-priority' and applied it to the Traffic Shaping Policy 'DSCP_Internal1_SW1'  I believe this is preforming the marking only at the layer 3 level so my question is can I add a DSCP marking at the VXLAN interface or directly to the traffic itself when it enters the switch and leaves marked at

Looking to expand my fortigate knowledge and I dont have the money for a homelab/firewall, but want to learn how to play with Fortigates. I been looking for a lab you can rent.

Hi all,I'm currently updating my fortimanager configuration.The problem I'm struggling with is about dynamic addresses used in interfaces with a captive portal. I have many fortigates with a specific interface that handles guests access (through the captive portal) and I need to tell Fortimanager to insert in the exempt list different addresses. Using dynamic addresses mapped to single devices does not seem to work. When I'll try to install policy packages fortimanager ignores the mapped dynamic address (for different fortigate). Rizio

Hello Community, I have an issue with authorizing FortiAnalyzer with FortiGate,Please advise,  

Hi !I'm looking at going NSE4-> and will buy physical firewall as a start, then add switch/AP to learn how security fabric works.I have a proxmox for VM's (fortimanager/analyzer)I'm looking at the FGT 80F, it will handle 7.6 and have more RAM then the 60F.The 80F will handle everything I need (spec wise).. Just want to doublecheck if it's a good model or if I should look at another model?Thanks!

Hi Everyone, I'm trying to integrate fortinet firewalls v7.0.x, v7.2.x and 7.4.x with Fortimanager v7.4.8 and v7.4.7 but unfortunately unable to integrate to all in my gns3 lab however I was tried to do low encryption algo and ca cert and local cert according to fortimanager but no luck. Hence please help me out on it and share the steps to do the success lab. Thanks in advance 

Hello Fortinet Community,I am reporting a false positive detection for my legitimate Android APK file built with Flutter. File Name: AppleTrack.apk SHA-256 Hash: 7607192fcfcdd64cdef7107ceeb3000d8f4a3dc7cd4b530cfc8a36e951ef7663 VirusTotal Report Link: https://www.virustotal.com/gui/file/7607192fcfcdd64cdef7107ceeb3000d8f4a3dc7cd4b530cfc8a36e951ef7663/detectionAPK : https://drive.google.com/file/d/17JviLMrjUim3dza6Mv94dqCzJTQmSp9a/view?usp=sharingDetection: FortinetAndroid/Generic.S.7E8092!tr (1/65 on VT, all others clean).This is a safe Flutter app for game tracking (Apple of Fortune tool). It uses standard packages like video_player, url_launcher, and shared_preferences. No malware, network calls are only to Google/YouTube for tutorials. The obfuscation is from standard Flutter build (--obfuscate flag). Sandbox shows normal behaviors (DNS to googlesource.com, flutter.dev, etc.).Please review and whitelist/remove this false positive from your database. I can provide the full source

Hello,  I am having an issue with FortiClient. It is installed on a device with an ARM processor. I am attaching a screenshot of the PC specifications and the error message that appears. We have reinstalled, deleted files, cookies, versions, etc. Can you please help me?Best regards.

Hello! I have a question about the FortiClient full app (not the "FortiClient VPN-only" version), can it be used for SSL & IPSec VPN connections only in unlicensed mode, after the 30-day "trial" period expires?I know I can simply use the "FortiClient VPN-only" version, but the problem is that it's latest version currently is 7.4.3 and I have a Windows ARM64 machine on which that version recently started having a JavaScript error and simply won't work anymore.I've tried the FortiClient full app, which is 7.4.4 and it works.

We have two Fortigates of interest FGT1 and FGT2 participating in both area 0 and area 12.FGT1 receives a route from FGT3 via FGT2 via area 0 (as expected).But FGT2 receives a route from FGT1 via area 12 (not expected).This creates asymmetric routing. Any guidance on debugging would be appreciated. Area 0 is a managed network, we do not control the Cisco routers. There is nothing in the wan1 cloud other than interconnects. FGT1 at Site 1 originates a VM subnet /30. FGT1 participates in both area 0 and area 12.FGT2 at Site 2 also participates in both area 0 and area 12.FGT2 at Site 2 routing table shows the /30 via area 12. My expectation is the route would be learned via area 0.FGT3 originates a /24 route that appears at FGT1 via area 0 as expected.FGT4 is only on area 0 and receives the /30 route via area 0 as expected. The core issue here is that we have asymmetric routing at FGT2. I understand that intra-area OSPF traffic is preferred over inter-area traffic. How

Hi guys, I can't install the free Forticlient VPN client on Windows 11 ARM. It doesn't generate any errors, it just rolls back and returns the following message:    This was the version I downloaded:  

hello kindly we need your assistance in checking the problem, we have an endpoint which is connected to Forticlient ems an when off-fabric, we need to block the user from having local internet access and for all the traffic to reach the internal network only through a configured ipsec tunnel. the issue is that when connected to vpn i have 2 default route, the vpn with lower metric, but on windows he will do automatic check when seeing the internet is dow and then he is using the local default route with the higher metric. i need to totally block the internet for the off-net user. how we can achieve this and intend to have a permanent and stable solution. to note that the webfilter is enabled and all categories are set to block

Hi everyone,I’m working on a FortiGate running FortiOS 7.4.x.I have:2 WAN interfaces inside virtual-wan-link (SD-WAN)2 IPsec interface inside another SD-WAN zone called remoteAbout 100 different /24 subnets that should be routed into the remote zone (over the IPsec tunnel)All internet traffic must go out through virtual_wan_linkThe obvious solution is creating 100 static routes, one for each /24, pointing to the remote SD-WAN zone — but that’s not practical at all.How do you guys handle large numbers of remote networks in SD-WAN deployments?Thanks!

Hi team, After upgrading our FortiGate to FortiOS 7.2.12, SSL VPN connections via FortiClient were consistently disconnecting at 40% during tunnel setup.This issue did not occur on 7.2.11. After downgrading to FortiOS 7.2.11, SSL VPN connections are now stable and working as expected.Could you help me troubleshoot this issue further to confirm root cause and ensure safe upgrade paths in the future?

Hi, I must upgrade a Fortigate 1000F from 7.2.10 to 7.4.8.I receive an error that i've never seen : "File is not an update file".I'v verified checksum of the file.I've got the same error when i try to upload the file directly to the gui and if i try the upgrade with fortiguard servers.The support team send me a firmware image to compare with the file i've downloaded and the files are exactly the same. Has anyone ever encountered this problem?ThanksSimon

Hi community members I noticed from time to time docs.fortinet.com is not accessible and I get the below error message.  From CLI: $ ping docs.fortinet.comPING docs.fortinet.com.geo.fortinet.net (149.5.234.138) 56(84) bytes of data.64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=1 ttl=46 time=51.0 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=2 ttl=46 time=43.4 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=3 ttl=46 time=57.1 ms64 bytes from 149.5.234.138 (149.5.234.138): icmp_seq=4 ttl=46 time=43.0 ms--- docs.fortinet.com.geo.fortinet.net ping statistics ---4 packets transmitted, 4 received, 0% packet loss, time 3004msrtt min/avg/max/mdev = 42.972/48.625/57.136/5.852 ms$ wget https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/704939/vrrp-virtual-macs--2025-05-04 09:43:02-- https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/704939/vrrp-virtual-macsResolving docs.fortinet.com (docs.fortinet.com)... 14

Hi all. I have an odd issue and can't figure out what is going on. I use the P2 ControlD free DNS server over port 853 for DoT. This worked perfectly for months and never saw any issues until now, but it shows the IP4 addresses (76.76.2.2 and 76.76.10.2) for ControlD as unreachable. However, I can ping the IP addresses from the fortigate no problem and other routers show no issues. Also, Quad9, Cloudflare, Mullvad, and other DNS over TLS providers work. Any ideas?

Hi FWB adminsIn FortiWeb standard A-A HA I can see session pickup (in CLI), but not in high volume A-A HA, while I think this feature must be available here since HV A-A HA should keep the sessions on fail-over, as this is basic HA feature when the sessions are critical.So is it implicitly enabled even not shown or it just doesn't exist in HV A-A HA?