Support Forum

We have several Fortigate units (30XE and 20XF) that were upgraded from version 7.2.X to 7.6.4. After the upgrade, we noticed some strange traffic behavior. We have defined a custom management IP and restricted it from accessing the Internet(Deny). However, after the upgrade(7.2.X>7.6.4), we observed some forward traffic where the source is the management IP and the destination is FortiGuard (which is abnormal). At the same time, in the local traffic, we can see that the FortiGate’s WAN IP is also connecting to FortiGuard, and that traffic is allowed — which is expected (normal service) My question is: since this unexpected forward traffic started appearing after the upgrade, could this be a bug in version 7.6.4? All of our customer’s FortiGate devices that were upgraded (around six units) are experiencing the same behavior.  

Hi FGT adminsToday I saw 2 FortiGate physical appliances, with FortiOS 7.2.10, having a strange admin that I've never seen before on any other FGT.On first FGT:On other FGT: What is this account user for? Or should this be removed?

I have installed the latest forticlient package on my debian machine and configured it to connect to our vpn.After providing my (correct) password, the status is changed to 'Connecting', a 'disconnect' button appears, but nothing happens. The status remains connecting for hours. In the terminal, this appears: ```14:23:28.412 › IPC_RENDERER_REQUEST.LOADED14:23:28.413 › WindowManager handleWindowLoaded14:23:28.914 › WindowManager handlePossibleProtocolLauncherArgs argv=["/opt/forticlient/gui/FortiClient"]14:23:28.914 › WindowManager handleCreateMainWindow14:23:29.502 › Receive websocket type=FCT_UPDATE_TASK_DONE14:23:32.949 › Receive websocket type=FCT_UPDATE_TASK_DONEError occurred in handler for 'keytar.deletePassword': [Error: Unknown or unsupported transport “disabled” for address “disabled:”]``` Although I can find other posts about this, I could not find a solution. Any ideas?Thanks in advance, Ruud

Hi Folks,I’m new to Fortinet and the community and I’m reaching out for guidance please.I work for a Gov funded educational org and have been tasked with implementing a SDWAN PoC for Internet access at our remote sites.SETUP –Each site is equipped with a DIA ISP link and we will have access to a Gov provided WAN link that uses a client-side webscript proxy for Internet services.I’ve used the instructions from this Youtube video to plan and configure how the SDWAN setup would be on a Fortigate appliance:https://www.youtube.com/watch?v=K9IUwPXTt3U&t=423sDIA public IP – 194.x.x.184 (Primary)Gov link – 10.x.x.254 / webscript (secondary)Both links would be members of the same SDWAN zone with a simple performance SLA and best quality SDWAN rule. A static route would be configured to send all traffic (0.0.0.0) to the SDWAN zone.Firewall policies to allow traffic would also be configured as per instructions.My question/concern is if the proxied link could be used in an SDWAN setup and if s

Hello everyone, I created a local-in policy as described in this example: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-in-policy-using-ISDB-as-a-source-address/ta-p/323085Overall, the policy works, but for some reason, some IP addresses contained in the ISDB, and these ISDBs are listed as sources in this policy, are not blocked.What could be the reason?

Hey folks,I’ve been diving into FortiManager and noticed there’s a way to deploy SDWAN using Jinja2 templates instead of the traditional static policy/package approach.From your experience with large scale deployments, how common is Jinja templating for SDWAN and policy automation? Is it considered standard practice among MSSPs and enterprise customers, or still more of an advanced/power-user feature?Also curious from a career/skills perspective, is it worth investing time to learn this method for efficient SDWAN deployment at scale?Would love to hear real-world experiences.

Hi all,  I hope you're well.  I am installing 4 x 120G FortiGates into a DC, but these firewalls will not be on the edge therefore no direct internet access. Another layer of firewalls is in front, I need to create an explicit list of IPs, domains, services etc to provide to the individuals who currently manage them to ensure the FortiGates has access to required services for NGFW features.    I am currently building a policy on a lab firewall with what I know and can see is required but is there an explicit list available so I can ensure everything is covered? Thanks, Dan. 

Hi. I've set IPsec VPN for the entire company and all the users except from one are connecting with no problems.this user had the problem with an older PC.i replace him with a new one and all worked good for a while.we came back after two weeks and have the same issue with the new one.the settings are right and in logs you can see he is successful  connecting and disconnecting after a sec,from the user FortiClient it seems like the connection is taking too long.he get a massage the connection is timeout.what to do about that?

I need the 32-bit version of FORTICLIENT VPN ONLY  

Hello! About a year ago I took the FortiGate Certified Professional - FortiGate Administrator Exam (NSE4), and was able to prepare with a free study guide from the training.fortinet.com website. I am now trying to take the same course on FortiManager, but can't seem to find the download for the Study Guide.  Is that still available? Thanks! NiftyN9

Hello, I am a monitoring analyst, and I have access to FAZ1000F v7.6.3. When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall. I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible? If so, how can I do it? Thank you.  

Dears, I come from an F5 background and have one key question: how can we deploy FortiWeb in a one-arm in reverse proxy mode, and how can we enable source NAT to avoid asymmetric routing issues as Fortweb will not the gateway of the application server, or will not in inline between the public and App server 

I have a FortiGate 70G (tested with FortiOS 7.4.8 & 7.4.9) in use at a customer site. The FortiGate is connected to FortiClient EMS Cloud and FortiAnalyzer Cloud. When I enable the most basic web filter (in the policy’s security profiles: only Web Filter: “Default” and SSL Inspection: “certificate-inspection”), websites take an extremely long time to load for users — and eventually they just pop up all at once.Following the packet flow, where you can see that it takes 23 seconds before the next data packets appear. I can’t explain this behavior and don’t really know how to analyze it further in detail — maybe someone has an idea or suggestions for additional analysis. I’ve already checked the processes (wad), but couldn’t identify any anomalies there.The accessed page was timebutler.de, but the issue also occurs on other sites. If I remove the web filter, everything runs completely normal. The logs don’t show that anything is being blocked when the web filter is enabled. 

I have been testing some changes to my FortiAP 231F profile over the past couple of days and the only thing I can say is.... are the FortiAP profiles broken? I have been testing and make changes over the past week and have noticed several concerning "issues" or trends. Consistently, anytime a change is made to the FortiAP profile all APs assigned to that profile reset their 2.4 and 5Ghz channels to Channel 1 and Channel 100 respectively.Even after manually rebooting the APs, APs that are right next to each other will select the same channels.Does 80Mhz wide channel width work on the 231F? How can I verify? As the FortiGate does not clearly report what the channel width it is using. Devices in question:1 FortiGate 101F running FortiOS 7.2.12 build1761 9 FP231F APs running firmware v7.2.0 build0424

Hello everyone,I’m new to this community and to Fortinet products in general. I’ve been working for years with a Cisco ASA Firepower 5506-X, and I’m now migrating the entire setup to a FortiGate 100F running firmware 7.6.4.Overall, the FortiGate configuration process has been quite straightforward — except for the VPN part, which has caused me quite a few headaches. I’d like to share what I had configured on the ASA and what I’m trying to replicate on the FortiGate (note: I don’t have an EMS license).On the ASA, I had two WAN interfaces (primary and backup), each with its own self-signed certificate issued by an internal Active Directory CA (Windows Server 2022).Within the ASA, I had four VPN profiles:• VPN Normal• VPN IT• VPN Advanced• VPN ExternalEach profile had its own split tunneling configuration, allowing users to see only the networks relevant to their access level.Each profile also had a dedicated IP pool and DNS settings (internal AD DNS for corporate users and public DNS for

Hello, I'm following this guide : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-permanently-block-SSL-VPN-failed-logins/ta-p/287171#:~:text=Creating%20the%20Automation%20Stitch%20(Part,for%20the%20new%20Automation%20Stitch.&text=Next%2C%20select%20Add%20Trigger%2C%20then,by%20selecting%20FortiOS%20Event%20Log Trying to do an automation to create a new group each day.I 'm on a FG100E with OS 7.0.17 I manage to create the group with the date :edit VPN_Failed_Login_%%date%% But when I want to add this new group to my config firewall local-in-policy with append srcaddr VPN_Failed_Login_%%date%% I got this : entry not found in datasource value parse error before 'VPN_Failed_Login_%%date%%' Command fail. Return code -3 Any help? Thanks, 

I have SAML SSO enabled on the FortiGate using Azure as the IdP, and it's working well. I'm now trying to enable the SP certificate. I tested several certificates from the FortiGate certificate list, but each one fails with the error:"Signature algorithm used to sign data is not supported." The IdP metadata shows Azure requires this signature method in SAML metadata:<SignatureMethod Algorithm="...rsa-sha256" /> How can I generate or issue a certificate on the FortiGate that will produce RSA with SHA-256 signatures via CLI? Please help with CLI commands or steps. 

Hi, we're migrating to IPSec Tunnel from SSL-VPN to get in front of SSL-VPN support being removed in the near future. Some of our users use Linux desktop at home and I was wondering if there's anything in the works for full support of IPSec on Linux forticlient in addition to Multifactor Authentication. We have integrated Entra into our Fortinet Tunnel. This is fine with SSL-VPN, but nothing for IPSec.  StrongSwan doesn't work as far as I can tell as it doesn't have the ability to interactively take the auth token for Entra and appending the token to my password doesn't work.  Thanks!

🧱 EnvironmentFortiGate model: FG-101FFortiOS version: (please add, e.g. 7.4.3 or 7.2.6)VPN type: IKEv2 IPsec (remote access)Authentication: LDAP users & groupsClient: FortiClient 7.4.3 (Windows 10 Pro 64-bit)🪪 ScenarioI’m configuring an IKEv2 IPsec remote access VPN that authenticates users via an LDAP server.The connection is established from FortiClient successfully up to Phase-1 (SA_INIT), but it fails during user authentication (EAP phase).EAP failed for user "test"EAP response is emptyconnection expiring due to EAP failure

FortiGate VPN Device Integration to FortiNAC.I am currently working on integrating FortiGate with FortiNAC.I need assistance with the configuration steps and the guide that outlines how to properly integrate FortiGate (FGT) with FortiNAC (NAC) for VPN-based access control.The officel guide I already read.Is there have any guide for this .   

Hi there im trying to create this setup for 2 buildings. FortiGate - FortiSwitch(Switch1) - FortiAP <---Mesh link---> FortiAP - FortiSwitch(Switch2) Is it possible to have all devices online on the Fortigate 60F running 7.6.4 ?

I have deployed the FortiGate Firewall in GCP with HA Active and Standby, and Fortiweb in Active Active, but in the GCP load balancer is showing only the healthy status of active, not standby. Is this the normal behavior? any anyone has suggestions, please advise.

I ran into this issue on our FortiMail and wanted to let you know: We found a mail going out of the FML that should have been quarantined due to failing DMARC check. However the mail went through to the user even without any filtering. The log only states the failing DMARC check but no action and no further checks/filters while there is more checks/filters in the recipient policy and also the antispam profile in the policy does specify the action to quarantine it upon failing DMARC check. I opened a ticket with TAC on this and they sent me to the right path: The reason is a new option which was introduced in 7.4.0 first. Since 7.4.0 there is a dmarc generic action option in security=>options=>antispam. Per factory default this is set to not perform any action.This leads to the FML still detecting a failed DMARC check but ignore any specified action. However due to the failing DMARC check it still skips the rest of the checks/filters and lets the mail out compl

Hi all, I'm having trouble getting 2 fortigate firewalls to connect via VPN, it looks like the phase1 is up but the phase2 never gets triggered. Even if I execute a ping between the two sides it never comes up. I've attached a screenshot of the VPN settings at both ends as well as the static routes and the firewall rules that I've got configured. I've tried running the Fortigate to Fortigate IPSEC wizard and I get the same result. I currently have NAT disabled at both ends but I've tried it with it enabled and enabled/disabled at both ends. I've checked and the preshared keys are the same and they're both using AES256-SHA256 DH14 on both the phase1 and phase2s I'm really confused, can anyone offer any advice?  

HiFortigate 60F, blocked after upgrade to release 7.4.9.i can't access via https. Can someone help me to troubleshoot it?Message: Secure Connection FailedAn error occurred during a connection to 172.16.1.1:11443. PR_CONNECT_RESET_ERRORError code: PR_CONNECT_RESET_ERRORThe page you are trying to view cannot be shown because the authenticity of the received data could not be verified.Please contact the website owners to inform them of this problem.