Support Forum

Hello All,On our FortiGates under Global/Network/DNS we specify our own DNS Servers but they are almost always in red (high latency) or showing as unreachable.We are only using plain old DNS (udp/53).We have never been able to work out why (it happens on both our 600F and 100F) and what we need to do to fix it , I have no idea if there is some config somewhere that's missing etc etc.Hoping the experts out there can help ? Regards  

Hello everyone, I have the following problem. We currently still have a FortiAnalyzer 400E in use, but it is being replaced by a FortiAnalyzer VM instance based on Proxmox/KVM. We set up the FortiAnalyzer VM yesterday and connected it to our FortiGate as a second Fortianalyzer. So far, everything is working well and running smoothly. However, I noticed today that the FortiAnalyzer VM is reportedly receiving almost three times as many logs as the FortiAnalyzer 400E. According to the license information in the FortiAnalyzer 400E dashboard, it has received approximately 17.6 GB of logs so far today (see image below). We have only one VDOM, the second one is old and not used anymore. That is why the FortiAnalyzer VM has only one VDOM.  The FortiAnalyzer VM has received approximately 51 GB in the same period today, at least according to the dashboard (see image below).  Even on the FortiGate itself, you can see a huge increase in remote logs from around 25

Hi everyone, I’m setting up a SIP Trunk between my 3CX server (on a LAN) and my provider’s MSC, and I’m facing an issue where the 3CX sends its local IP instead of the public (NATed) WAN IP. The setup is as follows: 3CX (192.168.x.x) → FortiGate LAN (192.168.x.1) → FortiGate WAN (10.x.x.194) → POP ISP (10.x.x.193) → MSC ISP (172.x.x.5). The FortiGate performs outbound NAT, SIP ALG is disabled, and UDP 5060 plus RTP 9000–10999 are open and forwarded to 3CX. However, during outbound calls, 3CX logs the following message:Call from "numext"<sip:numext@IP_ISP;transport=udp;user=phone>;tag=xyz to "numcalled"<sip:numcalled@IP_WAN_FORTIGATE;transport=udp;user=phone> has been dropped as it was not acknowledged in time. Please verify configuration and ensure there are no connectivity issues. Packet capture on the FortiGate shows that traffic to/from the ISP (port 5060) passes correctly, but SIP packets remain fragmented, and the Contact: / Via: headers still contain th

Hello,I've run into a strange issue with a remote access IPsec VPN on my FortiGateMy Setup:I used the IPsec VPN Wizard and selected the "FortiClient" template (the one that says it's for Windows, Mac OS, and Android).The tunnel uses IKEv2, a Pre-shared Key.My goal is a split-tunnel (only local traffic goes through the VPN).My Configuration:IPv4 split tunnel is ENABLED in the tunnel settings, and it points to an address group containing my two local subnets.The Phase 2 selector is the default one created by the wizard:I have two firewall policies to allow VPN traffic to my two local networks (one with NAT OFF, one with NAT ON, as my network requires).The Problem:Windows (FortiClient VPN app): Works PERFECTLY. It connects, gets an IP, and the split-tunnel works as expected. I can access local resources.Android (FortiClient VPN app): Fails every time. I use the exact same server IP, PSK, and user credentials. It tries to connect and then fails with the error: "Error: Protocol timeout reac

HelloI am using FortiClient VPN on Android Motorola phone. FortiClient version: 7.4.2.0179Phone: Motorola Moto g Power 5GAndroid Version: 15  I get the following error when trying to connect "FAILURE! Sorry, could not start connection "xxx". Error: Revoked by Android: REBOOT!  The wierd thing is I can connect to FortiClient when I am on Wifi but I cannot connect using mobile data.  

Hi folks, is there any way to re-send the activation email via FortiManager? The customer says it happens very often that this email is not received when a new user is added. When I tested it, email sending from FortiGate (version 7.4.8) worked fine. Platform Type : FMG-VM64Version : v7.4.7-build2685 250527 (GA.M) I know how to re-send the activation email from FortiGate and I also know how to find the activation code in the logs on FortiGate. I'm only asking if there is a way on FMG for this one customer. Many thanks in advance! FortiManager FortiToken  

I’m trying to create a policy to block IPs from the EmergingThreats list using an External Connector feed, but it doesn’t seem to be working as expected.I have an External Connector > IP Address External Feed configured, and it shows approximately 1500 valid entries.Connection Status 2025/10/28 08:31:32Last Content Update 2025/10/27 16:31:24Entries 1490  Valid  I can view the entries, and if I manually test one of the IPs by browsing to it, the connection succeeds, it’s not being blocked. If I add a single IP address directly to this rule, it does block that address correctly. However, when I rely on the external feed, it does not block any of the listed IPs. I’ve also tested with other external IP lists, and I’m seeing the same issue.Is there something wrong with my configuration, or should I be implementing IP blocking in a different way?Here’s the policy configuration I’m using:config system external-resourceedit "Emergingthreats-block-IPs.net"set uuid 05a9ff8e-cf9

Hi I have an issue with change SSL to IPSec configuration.I follow instruction to build FortiClient Dial UP connection.https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Dialup-IPsec-VPN-Split-Tunneling/ta-p/192207I have an issue with split tunnel, on windows enviroment doesn't appear single routes that assign via split tunnel but only default router. From android trablet it seams work. I am created n°2 policy,1st Dial Up Tunnel -> Local LAN                                       OK2nd Dial Up Tunnel -> to other IPSec tunnel                  KO 2nd policy doesn't work, in diag I see the packet sent but i can't receive answer What can i test? 

 Since the upgrade from 7.0 to 7.4 our FortiGate 100f No Longer Sends Traffic Reports to FortiAnalyser Cloud. It uploads Event Logs and VPN Logs and that's about it.   Is there anyway of switching this on? I can't find any logging options specifically.  Any help appreciated :) 

Hello team!!! We have a Fortigate 100F with many IPsec VPNs for FortiClientI configured all IPsec VPNs with IKE v1 and allways used an AD group synchronized in the Fortigate for user authenticationAlso, I use the peer ID field to select an specific VPNAll these VPNs are workingNow I created an IPsec VPN with IKE v2, but when I try to connect, I get an error:In FortiClient: Wrong Credentials EAP failed connecting to VPNnameIn Fortigate: date=2025-07-23 time=16:06:15 eventtime=1753297576267021760 tz="-0300" logid="0101037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Negotiate IPsec phase 1" msg="negotiate IPsec phase 1" action="negotiate" remip=1.3.5.7 locip=1.2.3.4 remport=4500 locport=4500 outintf="port9" srccountry="Argentina" cookies="b51c1f1809859ab8/7f365d0b1f864add" user="1000" group="N/A" useralt="N/A" eapuser="testdomain" eapauthgroup="N/A" assignip=N/A vpntunnel="IPsec-dom-W3" status="failure" result="N/A" peer_notif="NOT-APPLICABLE" fctuid="E2D4BA7

i have a few Fortigate firewall running on 7.2.xx version.Planning to upgrade to 7.4.8.do i need to upgrade all at the same time or i can just upgrade the main FGT at our data centre and the rest at our site office at a later date ?all are connected using ipsec tunnels

We have some clients using the Forticlient VPN who get looping at 98%. Others are connecting with no issues.The login is set up to use SAML from EntraID. They successfully log in and this can be seen in the EntraID logs. The connection process gets to 98% and the user is prompted to log in again. I have tried this on a failing device with both the latest 7.4 version and with an old 7.0.8 version and get the same result. The FortiGate the VPN connects to is running 7.4.9.Checking the logs on the FortiGate, there is no indication that the user attempted to connect. Checking the event viewer on the failing client there are no errors listed refering to the FortiClient or for the time the login was attempted.The clients are all Windows 11.I did find one article about setting the global ssl_vpn_webmode to enabled but this was already set when I checked.

Hi,I have ipv4 policy rule to allow traffic to bitdefender servers like:*.bitdefender.com*.bitdefender.netwith both ports 80 and 443 TCP.But when I go to transfer logs, I see that traffic is still blocked: 185.225.250.26 (update-onprem.2d585.cdn.bitdefender.net)443 Akamai-CDN Deny and many other subdomains of .bitdefender.net with application name Akamai-CDN.Why this traffic is blocked as I allowed every (wildcard) subdomains for this traffic? 

For the past few days, our new Windows 11 25h2 PCs, fresh from our master image, have stopped connecting to the VPN with Fortclient 7.4.0.1658. The icon no longer appears in the system tray either. Any idea ?

A helpdesk endpoints admin accidentally marked all endpoints uninstalled. What is the best way to get them registered and connected again for all of the clients that have forticlient installed.

Hi everyone! I do have HQ, and 10 more branches. Each branch has direct internet. So I need to do a deep inspection at each site. I was using the normal way. Generate a CSR from each Firewall. Sign it by my Local CA as a subordinate. Then import it to my FortiGate. Then use this new cert in my SSL policy. But I have read a document from Fortinet showing a better way to create on my Local CA: Create a Microsoft sub CA certificate https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/680736/microsoft-ca-deep-packet-inspection Still, I'm confused. What's the different, and better way? Just generate one cert as mentioned. Or do CSR from each FW to let FW information appear to users when there is an SSL error? Kindly advise and let me know the best and different. Note. I do have Local CA and FortiManager to manage all my 10 FortiGates.

Hi All, I'm looking at a configuration where I have 2 standalone Fortigates (not configured as HA pair) and a fortiswitch which has FortiAPs connected. Is it possible to configure Fortilink from each Fortigate to the switch to allow the switch to be managed from both fortigates with one Fortilink having higher priority over the other or is it the case of using VRRP between the Fortigates and Fortiswitch? Regards Adrian

Hello, i have a working VPN Device Tunnel (named FG-VPN-Device) for my Windows 11 Clients. These clients can connect on a certificate based authentication with the fortigate firewall.The Tunnel is configured with Mode Config enabled and a the IP is assigned with a Client IP Range (10.58.58.50-10.58.58.99). But i can´t route any traffic over SD-WAN with this config, as the IP Range has no gateway.After some more reading, i think, that i need to set a IP and DHCP Server for this Interface (named FG-VPN-Device). I followed this article  DHCP IP address reservation with Dial up ... - Fortinet Community But after settings these options, the Windows 11 Client can´t connect anymore.There is no DHPC assignment to the client. any idea what is missing?

Hi all, I've been using Forticlient VPN for a while on my M1 MacOS and it worked perfectly. Suddenly, when I try to connec through VPN it always come the same error: "Network error. The request timed out."I've tried with firewall off and different networks and still it doesn´t work. I also have total access to disk and network extensions on for Forticlient. Do you know what could be? Thanks!! 

Hi, Users connect to M365 services using a redirection authentication to the FAC (version 6.6.2).The config is working fine on Microsoft and iOS but not on Android devices.For example, if i add an account to the teams application on the phone, i insert the username and after that i receive got a blank page and not the fac page. All suggesition will be appreciated :) Regards,Simon  

Trying to set-up Agentless Portal access as per  https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-Agentless-ZTNA-with-FortiGate-v7/ta-p/373718#M11651 I have it all configured but when I try to access the web portal I get the following error. Any suggestions?

I just ran into this: I have an Adom in FMG. In this is a FGT100F I want to use for lab purposes. It was reseted to factory default before adding it to FMG. It added successfully and I can configure it in FMG. I was able to deploy device configuration to it successfully.I then created a provisioning system template that assigns system dns, ntp etc. The template also does the interface config (creating vlan interfaces and afterwards configuring them). For the interface configuration one variable out of the policy package is used.Once I assign that FGT100F to that template and try to deploy device config only it fails. There is no installation log available and the progress log only says "[fw-teststandort1[copy] root] Copy global shared objects failed (adom:my_Adom, dev:fw-teststandort1) (reason:none)". It does not provide any further information. Also dia deb app securityconsole 255 does not provide any more information. Does anyone have a hint on how to further debug this to

hello guys, i have this part of script where I try to get all logs from fortianalyzer to save in text file When i run script, i just get the first 100 logs and any other logs can get it  Knowing that when I changed the offset value to 500, it returned 100 logs different from the first 100. This means that when we change the offset value manually, it works, but when I do this in the script, it only takes 100 logs.Note that when I do a debug in the Forti Analyzer, it actually shows what is happening in the script and returns only the first 100 logs, but any other request does not return a log. # ----------------------- # Step 4: Retrieve logs using pagination with limit = 100 # ----------------------- all_logs = [] offset = 0 limit = 100 # Use 100 logs per page max_attempts = 3 # Maximum attempts to retry fetching logs print("\nRetrieving logs in pages...") while offset < total_logs: logs_payload = { "id": "123456789", "jsonrpc": "2.0", "m

Hi, I have new deployment project for ZNTA. We have a Local CA. we have generated a CSR from FortiGate and signed it by a local CA to be imported in FortiGate. and for EMS I would like to know what should do for the certificate, as there is no CSR option. Should I only import local CA Root Certificate to EMS server? Kindly need help to understand the certificate required for EMS within local CA and FortiGate.

Hello Forum, im trying to setup FortiLink in this setup: Fortigate <-> Cisco Switch <-> FortiSwitch I get the FortiSwitch up and running, connecting through the Cisco Switch with native VLAN set to the FortiSwitch VLAN.The Switch is fully manageable through the FortiGate -- Great Success!! But i facing the issue if Im connecting a second interface to the FortiSwitch and Cisco Switch. I wanted to setup this connection for redundancy so the topology would look like this: If im connecting the second Port of the Portchannel to the FortiSwitch, the link is starting flapping on the cisco site.. Is there maybe a problem with spanningtree oder port-profiles on the FortiSite? Does anybody of you had this problem earlier?We have to deploy this enviroment, because we cant change our distribution switch right now. Thank you!