Support Forum

Hello,I need to migrate the configuration of a Palo Alto firewall to a FortiNet firewall.Could you tell me if there is a tool available to perform this migration and if it is free?Thank you.

OS: LinuxKernel: 6.9.3FortiClient VPN Version: 7.4.0.1636I have been connecting to this network for months, this morning when trying to connect I had this on my console output Create VPN network interface failedNow the usual way of connection just does not work. Here are my log outputs:sslvpn.log 20240614 14:13:09.997 TZ=+0100 [sslvpn:INFO] main:1817 Init 20240614 14:13:09.000 TZ=+0100 [sslvpn:INFO] main:622 Load profile: eicon 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:631 Inherit local DNS: No 20240614 14:13:09.002 TZ=+0100 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20240614 14:13:09.002 TZ=+0100 [sslvpn:INFO] main:329 Get DBUS session bus address 20240614 14:13:10.004 TZ=+0100 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20240614 14:13:10.005 TZ=+0100 [sslvpn:DEBG] main:393 get passwd: true, get cert passwd: false, get user input: false 20240614 14:13:10.018 TZ=+0100 [sslvpn:INFO] main:329 Ge

We have multiple users reporting extreme slowness when opening files from a file server. This seems to have started when we upgraded FortiEDR to 5.2.8.41 last Wednesday. We were also upgraded to 7.2 backend this Sunday.  I ran some tests on my machine to rule out the network. With FortiEDR enabled on both my machine and the file server a 13 MB .pdf takes 10 seconds to open. When disabling FortiEDR on my (client) machine the time to open is only a second. We see similar behavior on other machines/file servers.  Anyone having similar issues?

Hi all, I'm configuring my 70G on 7.2.12. I'm trying to setup a Virtual Server with load balancing and offloading a certificate via Lets Encrypt.  via "diagnose sniffer packet any "host [client ip redacted]" I can see the traffic arriving on the wan1 interface. But without any response. I setup debug flow like so: diagnose debug console timestamp enablediagnose debug flow show iprope enablediagnose debug flow show function-name enablediagnose debug flow trace start 100diagnose debug flow filter addr [client ip redacted] But requests to the virtual server don't generate any debug flow output. the Virtual Server:FortiGate-70G # diagnose firewall vip realserver listalloc=2------------------------------vf=0 name=[the website name].com/1 class=4 type=1 [endpoint IP redacted]:(443-443), protocol=6total=1 alive=1 power=1 ptr=332816741ip=192.168.9.11-192.168.9.11/2283 adm_status=0 holddown_interval=300 max_connections=0 weight=1 option=01alive=1 total=1 enable=00000001

Hello, I am planning on using the fortiap 433g for a warehouse. I want to use 3rd party antennas,Ventev M6060060D4D3620FP and Ventev M6060060MO1D43620 Does anyone have experience with these antennas? Are they compatible with the 433G? Thanks,

Hi,I need help troubleshooting a FortiClient VPN issue on my Windows 11 laptop.Problem SummaryWhen I click Connect in FortiClient VPN (v7.4.3.1790), the Connect button immediately changes to Disconnect, but the VPN never actually connects.No “Connecting…” animation, no delay, no status messages.Even if I enter a wrong password, the behavior is the same — Connect → Disconnect button appears immediately, but no error is shown.The same VPN credentials work on my colleague’s laptop, so the issue is specific to my system.

I'd like to use FAC's TACACS+ service. Users will be pulled in from EntraID via SAML. Of course Entra has MFA via MA Authenticator.What happens in this scenario ? FAC couldn't broker Entra's MFA right ? Would I need Fortitokens in this case to do MFA ? Don

I have advpn shortcut from spoke1 to spoke2 and 3 link connections.If i traceroute from spoke1 to spoke 2 i got below path FW01 (Internet) # execute traceroute-options source 10.10.112.2FW01 (Internet) # execute traceroute 10.101.62.1traceroute to 10.101.62.1 (10.101.62.1), 32 hops max, 3 probe packets per hop, 84 byte packets1 10.10.112.1 4.026 ms 4.149 ms 6.013 ms (hub ip)2 10.10.112.3 9.931 ms 10.167 ms 9.969 ms (spoke tunnel ip)3 10.101.62.1 10.194 ms 11.533 ms 10.212 ms (endpoint) FW01 (Internet) # execute traceroute-options source 10.10.111.2FW01 (Internet) # execute traceroute 10.101.62.1traceroute to 10.101.62.1 (10.101.62.1), 32 hops max, 3 probe packets per hop, 84 byte packets1 10.10.111.1 2.554 ms 3.221 ms 3.834 ms (hub ip)2 10.10.111.3 12.219 ms 16.811 ms 13.925 ms (spoke tunnel ip)3 10.101.62.1 18.478 ms 17.462 ms 16.482 ms  (endpoint) FW01 (Internet) # execute traceroute-options source 10.103.113.2FW01 (Internet) # execute traceroute 10.101.

Hi, we have FGT90G with 7.4.7 and 4 FortiAPs with 7.4.X  - everything working without any problems for almost one year. We didnt change anything and this morning all FortiAPs show offline in Managed Forti APs. No changes were made in interface and everything is still enabled. Since they have fixed IP we can access and ping them without problems. So with ping there should not be any interface/ switch / power issue but we tried connecting one AP directly on the interface on the FG and the same result. We tried with this AP also de and authorize and still offline. We restarted wireless controller demon and still no difference. Any suggestions? Thanks

for some reason my original attempt to post this resulted in it being marked as Spam and I haven't heard from the moderators.  So here it is again - Hi all, I'm configuring my 70G on 7.2.12. I'm trying to setup a Virtual Server with load balancing and offloading a certificate via Lets Encrypt.  via "diagnose sniffer packet any "host [client ip redacted]" I can see the traffic arriving on the wan1 interface. But without any response. I setup debug flow like so: diagnose debug console timestamp enablediagnose debug flow show iprope enablediagnose debug flow show function-name enablediagnose debug flow trace start 100diagnose debug flow filter addr [client ip redacted] But requests to the virtual server don't generate any debug flow output. the Virtual Server:FortiGate-70G # diagnose firewall vip realserver listalloc=2------------------------------vf=0 name=[the website name].com/1 class=4 type=1 [endpoint IP redacted]:(443-443), protocol=6total=1 alive=

Dear team, We have multiple admins in our IT team that logs in to the FortiGate on a daily bases, however, some of our team has recently discovered that they can change the theme inside the settings section, some of them has messed with the bright UI, and it is burning my iris. Therefore, is there any possibilities that you can separate this to per login rather than a global config that applies to everyone once set please? Appreciated and regards

Hello Team, Our customers use SSL-VPN on their FortiGate with 2 IdPs:one for their users (EntraID)one for our users (also on EntraID - different tenant)As migration from SSL-VPN to IPSec Dialup, we will need to use those 2 IdP with IPsec. At the moment, it does not seem to be supported in IPsec Dialup (since the ike-saml-server is directly defined on the interface). We did a PoC with FortiAuthenticator Cloud acting as SAML Proxy (routing based on domain), it works but it is a very expensive solution just to compensate a lack of support on the FortiGate... Are there any other workaround?Is the support of multiple IdPs planned in future FortiOS releases? 

Pretty much like the title says. My posts keep getting marked as spam. I've sent multiple messages to the moderators but I haven't gotten any replies. Can someone here help? Are there any Fortinet employees on this forum?

Has someone ospf6 running over a IPsec Tunnel?Ipv6 over the tunnel is working fine. Adding the interface to "router ospf6 interfaces" does not work: The IPsec interface does not appear unter "get router info6 ospf interface". There is only a loopback interface added also.BGP is working fine with ipv6 using the same tunnel.

Hello everyone,What do you think would be the best option to manage hundreds of customer FortiGate’s from one management panel. Thought FortiGate Cloud but these devices are register in the customer’s own support portal. I am not entirely sure if FortiGate Cloud MSSP feature can provide that, afaik it does not let you manage other support accounts FortiGates. Well the last option seems to be to be look like FortiManager. But I am not sure for FortiManager Cloud I can add any device from any support account so I need confirmation if anyone used that before. Last option seems on-prem Manager in which we open it to internet to register customer devices to our Manager.Is there any other suggestions you can make?

Hi everyone,I’m facing a recurring high memory usage issue on a FortiGate 71F running 7.4.8, and I’m hoping someone here has seen this before or can point me in the right direction.Memory gradually climbs throughout the day.URL Filter seems to be the primary contributorHas anyone experienced memory creep or high memory usage related to the URL Filter process on 7.4.8?And what would you recommend doing next? 

Hello everyone, I am in my first year of an IT degree, I am very new to all this. For our programming course, we use the university's coding environment, to use it we have to connect to the university VPN. The university uses Forticlient, we have to follow an instruction document explaining how to download Forticlient and change the configuration settings. This has always worked for me, I was able to access the uni's VPN just fine for months, now suddenly there have been some issues. It won't let me in, so I tried all kinds of things, I tried changing my uni password (because we use our uni credentials to log in to the VPN), which didn't work. I tried uninstalling and re-installing forticlient, which didn't work. I tried re-entering all the configuration settings over and over, still I had the same issue. Then I noticed that when I save and exit the configuration settings, and then re-open them, the pre-shared key is different, it's longer, forticlient seems to be a

hi everyonewe have 100f (6.2.2) in our production and our topology is as bellow : we have 2 vdom root and global and port 1 is in vdom root.we don't restrict admins by restricted host.ping is ok between agent and manager. we config snmp as follow: 1) Go to Network -> Interfaces 2) Choose an interface that an SNMP manager connects to (port1) and select 'Edit' 3) In Administrative Access, select 'SNMP' 4) Select 'OK' [size="2"]To configure the SNMP agent 1) Go to System -> SNMP 2) Select 'Enable' for the SNMP Agent 3) Enter a descriptive name for the agent 4) Enter the location of the FortiGate unit 5) Enter a contact or administrator for the SNMP Agent or FortiGate unit 6) Select 'Apply' To add an SNMP v1/v2c community - GUI: 1) Go to System -> SNMP 2) In the SNMP v1/v2c area, select 'Create New' 3) Enter a Community Name 4) Enter the IP address and Identify the SNMP (192.168.30.21) 5) Select the interface if the SNMP manager is not on the same subnet as

Hello Community,how to create a fully-meshed VPN with Provisioning templates on FortiManager for FortiGates  with multiple ISP lines and 2 HUBs and multiples Spokesmy architecture is like :HUB1 ==> 4 ISPsHUB2==> 4 ISPs10 Spoke ==> 2 ISPsmy gol is to have in the spoke full mesh to HUBs ( 8 tunnels VPN IPSec  to HUB1 and 8 tunnels to HUB2) 

Hi there,New to Fortimanager and trying to figure out some simple best practices. I have to roll out around 20 x 70G firewalls across 20 locations. The configuration of these firewalls will be identical. Struggling a little in Fortimanager with creating zones, software switches, etc. Would a best practice to be just setting one up locally exacly how I want it and then importing the config to push to the others or is there a better way?These are all pretty simple... few software switches with VLAN's all grouped into zones and a handful of policy rules.

I am evaluating what it would take to implement RDMA/RoCE, specifically with Storage Spaces Direct.  I see where the Data Center Series switches (1000/3000) support IEEE 802.1Qbb Priority-based Flow Control (PFC) but I don't see mention of Data Center Bridging (DCB) or Enhanced Transmission Selection (ETS) which are typically also associated with implementing RoCE.  I've done some basic searching and find articles from Cisco, Mellanox, Juniper, Microsoft, etc, but I don't see any references to configuring RoCE on FortiSwitches.  Is it possible?  And if not, is it on any roadmap or do you recommend other technologies like iWARP?

Hello, I would like to know how the Fortinet Developper Network hands on lab works. Cause for now, I can only see Fortiauthenticator, Fortimanager and SDWAN when I access it.How can I request a lab for FortiNAC or any other fortinet solution ? Or is it just what's available ? BR,

Hello,I would like to ask for your advice on how you would configure logging on Fortigate routers and whether it is worth enabling security fabric in such a configuration:-one main Fortigate and Fortianalyzer in the main location.-four Fortigate routers at the branches connected to the main Fortigate (hub and spoke topology) via doubled IPSEC (SD-WAN).-the remote Fortigate routers do not have UTM licenses because all network traffic is reversed and goes out to the Internet through the main Fortigate router. Now how would you configure the security fabric and logging in this case?1. Security fabric disabled, logging into Fortianalyzer only from the main Fortigate (here, traffic to the Internet is visible from remote Fortigates anyway) - this is the current situation.The downside of this solution is that in order to check local traffic, I have to log in to each of the branch  Fortigates.2. Security fabric disabled, but adding remote Fortigates to Fortianalyzer (there

I was digging into this feature wanted to get some real-world understanding.Have you of had this service block something?Is it only malware / file-based (assuming so since its in the AV Profile)Is there anything comparable in the Palo world? Sounds a bit like Wildfire but Wildfire is more sandboxing. But it also has crowdsourcing since if one customers wildfire detects a file that is malicious everyone will get that wildfire update.Thanks and appreciate any thoughts here.

I'm in an organization where we have Application Control enabled in our FortiGate. We have allowed Viber within the Application Control, but for some reason, we can send messages except for media files. This seems to be inconsistent too as some members of the organization can send despite being in the same IP address range. Viber has been allowed in the Application Control since I got in the organization, but this problem suddenly occurred last week. How can this be solved? EDIT: I can confirm that this is not a Viber problem because if we disable the Application Control, we can send media, but disabling Application Control is not an ideal solution for our organization.