Support Forum

Good afternoon,according to SSL certificate shortening, is there possible to NFR customizing ACME provider (GEANT CA), not only Letsencrypt ? In this time I found that customizing ACME provider in not possible, right ?FortiWeb ? FortiGate ?Thanks and best regardsJ.Karliak

HelloA question for Fortinet.There is already machine learning on FWB and FSM for anomaly detection.Any idea when it will be implemented on FML? I believe is crucial for intelligent filtering.

Hi community, I am currently using the Let's Encrypt feature on my FGT (FOS 7.0.4).Everything is working really good.I just had the idea to use the FGT as a "certificate hub". So the external FQDN of my NAS points to the FGT WAN IP. This way the FGT can issue a certificate for the external FQDN for my NAS.Now I am looking into a way to export the issued Let's Encrypt certificate (cert file, key file and passphrase). Found out that the cert file and key file are stored at the FGT and can be exported over the CLI. Sadly, the passphrase is "only" saved encrypted on the CLI (because of security reasons).To import the Let's Encrypt certificate to my NAS, I need the passphrase unencrypted. Any ideas how I could get the encrypted passphrase on the CLI into an unencrypted form? Looking forward for your ideas. Many thanks.Kind regardsDominik FortiGate

Hello, for several days, a bot has been trying to connect to my Fortigate 60F.How can I block these attempts ? Thanks !

Hi FortiClient admins What is FortiClient Server?  https://repo.fortinet.com/forticlient_server_readme.txt Anyone knows?

Hi, this FG60F with 7.4.5 (before 7.4.4 and same problems) has lots of problems with SD WAN. Today I was there to ceck internet access and SD Wan config but I cant solve the problem. The SD WAN is strange, like at least 2-3 times a week and than for some hours one of the WANs has 30-80% package loss. Also than navigating behind the FG you notice the problem when you are using WAN x at this moment. At the same time that the FG showed 70% package loss, I connected my laptop behind the router and checking with pings and internet speed test the line for >20min and NO problem at all. Again connecting to the FG I get package loss. I changed even the cable to be sure. The SD Wan config is simple, one implicit rule sessions 50-50 and Performance SLA to ping Cloudflare 1.1.1.1 and 5-5-10-500-5-5 all activated. What can be the reason of these package loss showing in the FG? Also I have fortiddns over WAN1 and when it shows package loss, I have problems connecting from

Hi everyone, I'm having a very unusual problem. I have a FortiGate cluster on IBM Cloud, version 7.6.2. Node 1 and Node 2. Node 1 had a RAM problem, rebooted, and failed over to Node 2, so far, no problems. I kept Node 2 active while we replaced the RAM. The problem is that, after replacing the RAM, whenever I try to fail over to return Node 1 to active, the network gets extremely intermittent, several pings are lost, many systems can't communicate, and BGP neighbors won't connect. Of course, I've checked everything I could think of, the HA configurations are correct, and the boxes are syncing without any issues. Has anyone else experienced a similar scenario?

We have two pairs of 91G's running 7.4.6 at two different locations. Each has a DMZ with subnet 192.168.100.0/29, and each location has a route map that allows redistribution of connected routes into OSPF. Site A is preferred and has route redistribution with a better metric. This works fine, but the problem is if the server at Site A goes down, but default the associated FortiGate doesn't know that server is down (the switch port is still up) and continues to advertise the connected route. Is there a way to configure SLA to query the server at 192.168.100.2, and if that server is not reachable, then the FortiGate removes 192.168.100.2/29 from the OSPF process until the server is once again available?

Review the following configuration configwaf machine-learning-policy edit1 set sample-limit-by-ip 0 next end What is the expected result of this configuration setting? A) When machine learning (ML) is in its collectting phase, FortiWeb will accept an unlimited number of samples from the same source ip address B) When machine learning (ML) is in its collecting phase, Fortiweb will not accept any samples from any source ip addresses  

Hi,in the documentation of the FortiGate Rugged60F it says, that port internal4 and wan1 form a bypass pair.As I understand by reading documentation (https://docs.fortinet.com/document/fortigate/7.4.7/hardware-acceleration/754739) this results in forming a hardwired connectivity between these ports in the case of a power failure / power-off.This might result in a security issue, if using those two interfaces in different network segements / vlans, if I understand this description correctly.I also couldnt find any documentation on how to disable this feature - only for different FortiGate models. And those either say its possible to disable via CLI (80/81), but a different model describes it cant be disabled and is the default configuration (Rugged 90D):https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-poweroff-bypass-and-bypass-watchdog-on/ta-p/195677https://community.fortinet.com/t5/FortiGate/Technical-Tip-Bypass-Ports-on-FortiGate-Rugged-90D/ta-p/194412Could you hel

Hi everyone,I’ve encountered a confusing situation when creating IPSec tunnels on FortiGate (version 7.4.8). If I create a loopback interface and then try to create a tunnel interface with the same name (e.g., “TUN-1”), I get a duplicate object or conflict error, which makes sense.But, if I use the tunnel creation wizard and select “Create” in the interface selector, it sometimes allows me to create a loopback interface and a tunnel-interface with the same name in a single step. I think this might be a validation issue or a bug. According to Fortinet docs and best practices, each interface must have a unique name.Is this a known issue with the wizard?Could future firmware updates break these configurations with duplicate names?

I want to send an email when an interface goes down on the Fortigate firewall or when an IPsec tunnel goes down. I couldn't find any articles mentioning a trigger that would send an email for a specific interface or a specific IPsec tunnel. I have a specific interface I want to set up. How can I configure this?

Hi everyone  I have two firewalls 201G model version 7.4.6, when i configure vdom partitioning with separate two cluster root and rnd. Root is primary in cluster 1 and rnd is primary in cluster 2, but rnd didn't work. I show HA configured, which is no problem; status and role are correct. When i connect the wan port to rnd primay (cluster 2), the port status is down and pppoe is not up, but when i connect the same port on cluster 1, it's up, but pppoe status is installing. Does anybody meet that case, and how can i fix that Thanks for your help

Hello, I need your help.I have a Fortigate 100F running firmware 7.4.7, and I have configured GRE over IPsec tunnels.My networks are routed using static routes.The problem is that when one tunnel goes down, the traffic still continues to flow through the main tunnel, so failover to the second tunnel does not occur.Is there a way to configure something like a link monitor or any other mechanism so that when Tunnel1 goes down, it automatically switches to Tunnel2

We have forti cloud EMS version 7.4.3 , invitation code (no expiration set) set to single user does not work, when user is entering invitation code in forticlient-7.4.3 version ( tried both manually and copy paste), it does not give any error it's just show processing tab and nothing moves further. Tried to entered invitation code via CMD also but no luck. Please help here

Hi there, Is there any way to configure information disclosure as alert and deny .I am getting forgery request request in this scenario my server is requesting for internal urls in it behave , fortiweb is blocking it already in standard inline protection profile but not blocking low severity alerts and sessions are very high. Please help 

Hi! I have an issue that has been bugging me for quite a while. I have a FortiSwitch where all the ports appear as offline in my FortiGate GUI, but the ports are active and, for the most part, functioning properly. I assumed this was a silly GUI visual glitch until recently, when I tried to add a FortiAP. However, it does not register when plugged into the switch, but it does register when plugged into the firewall or another switch. I have tried reboots and performed a factory reset on the switch, which provided some relief. The switch now lists the devices connected to the ports, but all the ports still show as offline. The ports appear to show activity when viewed on the console. This issue appeared one day after no known changes, such as updates or configuration changes.  Here is some information about the devices.Fortigate 60F Version: v7.2.11 build1740FortiSwitch Version: S124FN-v7.6.1-build1047FortiLink manages switch. I have other switches connected and

Hi All, I have configured IPsec over SDWAN with redundant links (S2S Ipsec tunnel) to connect multiple branches and monitor with SDWAN. But the problem is when I configure OSPF on tunnel interface then only single neighborship come up and another neighbor is not showing. And when I configure static route then it works for both redundant interface. I troubleshooted multiple times but did not resolve the issue. Is there anyone who has faced the issue while configuring OSPF on tunnel interface with IPsec over sdwan. Thank you  

Hello guys, please who can support/assist me in resolving my lab issues. I have been troubleshooting since day before yesterday with no resolution. I have my windows 10 vm and fortigate 7.6.3 vm on the vmware station I am pretty much sure i have the ip configurations correctly The windows 10 vm is on custom- host only fortiagate vmnet 2 is also on custom - host only The vmnet2 on the virtual network editor is also on vmnet 2 with 10.10.10.0/24 network My port 2 on fortigate is 10.10.10.1 /24my NIC on windows 10 is 10.10.10.2 /gateway - 10.10.10.1Physical host - 10.10.10.75 /gateway 10.10.10.1I made sure both fortigate vm and windows 10 vm are on the same vmnet2 However i do not know why i cannot reach fortigate  I just realised that if i change the connection from custom - host only to bridged it works and i can reach the fortigate  the custom - host only wouldnt   and i am concerned that not having lan network

HelloIm troubleshooting an issue where after forticlient v7.2.7 is installed via an msi file and a mst, the application installs but is in an unlicensed stateThe msi/mst file is downloaded directly from the customers site in the EMS PortalWhats interesting is the VPN Config is bieng pulled down from the profile.There is enough licenses available so its not thatDoes anyone know what else I could check here?Thanks

Dear team, Has anyone else observed this issue? When we create a contractor user with a corporate email address and no one logs in with that user, after a while, it causes the existing user VLAN to change to isolation. When I check that user and click Show Hosts, I can see another host belonging to the same user with the contractor email address. The strange thing is that when I check that host, I can see that the logged-on user is the contractor user, even though we did not log in. Somehow, I guess the passive agent finds that device user, checks the email address, and matches it with the contractor user. Is this normal behavior? It's not happening instantly; it takes some time to detect the other host and link it with the contractor user. My goal is to create a contractor user, assign them to the onboarding VLAN, and install new computers. That's why the help desk team creates users with corporate email addresses and keeps them for a month. Do you have any suggest

Hi! I recently updated the firmware of a FortiGate 200F from version 7.2.11 to 7.4.9 and the HA did not finish synchronizing.There are 2 tables out of sync: system.central-managementfirewall.internet-service-nameAny ideas to solve it?  

Hello, I wanted to install FortiClient EMS HA with Bitna mi Docker architecture with FortiClient EMS 7.4.4 image. For this, I used the official Postgres and FortiClient latest version packages. However, despite several attempts, EMS does not start with HA. I used the official documentation during the installation. Thanks in advance for your support. he gets nodesEMS Node(s):Name | Role | Status | Last Seen--------------------------------------------------+---------+---------+----------------------------ems-1 (*) | primary | online | 2025-10-18 18:14:07.562784DB Node(s):Host | Port | Role | Status | Latency (MS).. .. .. .. | | standby | offline | 40.. .. .. .. | 5432 | standby | offline | 41 

We have a vendor who has 2 servers with 2 NICs configured with teaming. Port 1 of each server is directly plugged into port 2 of each FortiGate (also belongs to vendors, and these are 60E's running 7.0.x). We've been testing failover, and it's been problematic. At least one server, sometimes both, will be unreachable when we test failover. We can disconnect the cables to the standby FortiGate, and the servers are instantly reachable. Even after the server is reachable, as soon as we plug the cable back into the FortiGate, the server is sometimes unreachable. We've not had any experience with this before, but then all FortiGates we manage have ports plugged into switches. Are there any ideas as to what we can try? Thanks

Hi Guys. I have starved my own knowledge and googlefu so i hope someone in here can help me.We are transitioning from SSLVPN to IPSEC VPN and want to keep using our SAML setup. When trying to connect to the IPSEC VPN tunnel i get prompted with my SAML prompt, enter my credentials, log in and the client then hangs in "Connecting".In my debug i see the SAML request being processed and completes as it should but i see no IKE debug prompts.Nothing appears in my VPN log either. The only thing i can see is in my Forticlient, where i get an error regarding power which i reckon is not related to this. When connecting to the SSLVPN (same public IP, different ports ofc.) i go straight through and connect with no issues. Does anyone have any idea why i am stuck in "Connected" when my SAML request is processed?Kind RegardsEDIT:We have tested with Forticlient versions 7.2.4, 7.2.5 and 7.4.0 and with different vendors of net adapters and from different locations.