Support Forum

I am using Fortinac F version 7.2. I have the following issue. A user joins the network using a persistent agent. They obtain an IP address from the relevant VLAN to which the necessary policies are applied. However, when the user removes the persistent agent, instead of being moved to quarantine, they continue to obtain an IP address from the same VLAN.

Hii wondering, the thing is i need to intergrate and AD to Forticlient Cloud EMS, but am wondering where to install the AD connector, am thinking to install it on the Windows Server associated with the AD, but my windows Server is Lisening on a private IP, the AD connector should be installed on the device that is accessible by both the EMS and the AD how can i manuever this, which environment do you recommened i should install the AD connector Thanks for your feedback

I’m seeking clarification and a possible solution regarding the recent change in FortiGate’s SAML authentication requirements. The issue is described in the following Knowledge Base article:https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SAML-Authentication-fails-after-firmware/ta-p/407859 According to the article, the new specification requires that both the Response and the Assertion within the SAML response be signed.I understand that some IdPs, such as Microsoft Entra ID or Google IdP, support signing both elements as shown in the examples. However, what is the recommended workaround or solution if we are using an IdP that can sign only one of them? I also have two questions regarding this policy:1. Is this requirement a permanent change?2. Could you share the rationale for requiring both the Response and the Assertion to be signed? From my understanding, the Assertion is already a component of the Response, and signing the Response should i

Hello everyone,I currently have two FortiWeb VMs configured in an HA cluster (Active-Passive mode). However, I’m facing an issue during the HA setup. When I enable HA, the master node completely overwrites the configuration of the secondary node, causing it to lose its initial settings. In addition, after the negotiation process between the two FortiWebs, the cluster does not become active — both devices remain separate and do not synchronize properly. I would like to know how to prevent the master from overwriting the configuration of the secondary during synchronization, and how to fix the issue that prevents the two FortiWebs from forming a functional cluster.Thank you in advance for your help and advice.

On MacOS 15 (FortiClient version 7.2.6), at the MacOS login screen a message appears prompting for credentials.  The message states: FortiClientAgentYou are making changes to your Certificate Trust Settings.Enter the name and password of a user in the "(null)" group to allow this. No matter what credentials are entered, it won't accept them. I've opened a case with support, to no avail so far.They referred me to this article (for an older version of FortiClient), and I added all the services it mentions that need full disk access and checked the other settings:https://docs.fortinet.com/document/forticlient/7.0.9/macos-release-notes/223986 I would investigate downgrading to see if that helps, but we want to be on the latest release so that we are up-to-date on security patches. Does anyone have any suggestions? Thanks in advance for any advice.

Hi, I do have a new deployment for the EMS 7.4.4 server for the ZTNA project. I do follow the guide about how to change the default settings, such as DNS and IP. It shows "$ sudo nano /etc/netplan/01-netcfg.yaml" to modify the initial setup. But when I did the installation. It was totally different. There is no Sudo command allowed. Kindly provide your support to guide on the basic CLI command on how to change the initial setup to let EMS access the internet and activate the license. Meanwhile, I do have the BPS license. How can I use that to let the Fortinet team help in the setup?

i try to test fortiems server,i have install it 2 times ON VM WARE ENVIRONNEMENT and the second time , i enter my forticloud credentail and , the messsage error is that a try licence WITH ANOTHER HARDWARE   already EXIST.I WANT TO USE ONLY THE SECOND FORTI EMS SERVER.PLEASE HELP

Hello FML admins, I am currently testing the Mail Migration feature in FortiMail to migrate email data from Gmail to FortiMail.I have followed the procedures outlined in the following documentation: https://docs.fortinet.com/document/fortimail/7.6.3/administration-guide/326016/migrating-email-from-other-mail-servers-server-mode-only#domain_user_1224406687_2752746https://community.fortinet.com/t5/FortiMail/Troubleshooting-Tip-FortiMail-migration-users-does-not-work/ta-p/306683 However, I consistently encounter an “Authentication failed” error during the migration process.Could you please confirm if there are any additional configurations or permissions that need to be set on the Gmail side to allow FortiMail to perform the migration successfully? Any tips would be much appreciated.Kind regards,

i am try ting to config 40F to 40F using site to site vpn when HQ has Static WAN ip and Branch use Dynamic , after config the tunnel is still down , even i try Hub - Spoke same issue , in HQ the 40F setup is behind the main Firewall ( 60F ) , does it required any Port forwarding . i have go through several video and documents , the config show ok ,still the VPN not coming online . 

Hi all,i've got an infrastructure of cluster fortigate running 7.4.5 managed by fortimanager. One of this cluster is in the headquarter all the others are branch offices. All of the clusters send logs to the fortianalyzer and all the branch offices send also syslog to a syslog collector behind the headquarter cluster. When looking in the fortianalyzer pointing the headquarter cluster i can see all the branch offices send the events via syslog, but if i point the branch offices to see the events exit from the firewall i can see them only from one branch office and all the others are not showed. I'll past the config from the one i can see and from the other that not. To me they seems the sameThis is the one not working:fw-xxxxx-xxxxxxxxxxxx-o~-01 (setting) # getresolve-ip : disableresolve-port : enablelog-user-in-upper : disablefwpolicy-implicit-log: enablefwpolicy6-implicit-log: disableextended-log : disablelocal-in-allow : disablelocal-in-deny-unicast: disablelocal-in-deny-broadca

Hello,I'm new here, i have installed forticlient 7.4 in ubuntu 24.04.I was connected to my VPN server. after a week when i tried to reconect i had this error "config DNS failed".these are the logs from the forticlient:20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2168 Init20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2186 VPN is running in restore DNS mode20241212 13:01:50.750 TZ=+0200 [sslvpn:INFO] nettools:1854 More than one device with index 2 can be found20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xx.xx.xx.xx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xxxx::xxx:xxxx:xxxx:xxxx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.781 TZ=+0200 [sslvpn:DEBG] vpn_util:299 Get connection name: netplan-eth020241212 13:01:50.791 TZ=+0200 [sslvpn:INFO] nmtools:865 Network Manager settings backup file doesn't

We have deployed NagiosXI for monitoring and our server team is trying to use the Nagios Agent (NCPA) to monitor a domain controller. We have app control configured on the firewall policy for accessing the domain controllers blocking everything except what is permitted through Application and Filter Overrides. NCPA, which uses TCP/5693, is being blocked by app control and the only thing I can think of is creating a custom application signature to add as an override. The problem is when I follow the documentation to create the custom signature the FortiGate just keeps returning an error. The config I entered is listed below, any suggestions would be appreciated.FortiOS 7.4.7  # conf application custom(custom) # edit "NagiosXI_5693"new entry 'NagiosXI_5693' added(NagiosXI_5693) # set protocol TCP(NagiosXI_5693) # set signature "F-SBID( --name \"NagiosXI_5693\"; --protocol tcp; --dst-port 5693; )"(NagiosXI_5693) # set category 15(NagiosXI_5693) # nextload custom rule errorobject

I downloaded Fortinet Firewall VM version 7.6.4. I want to use it for testing purpose.Although I started the VM and accessed the management console, I see the message "VM is not licensed or license is invalid for current VM configuration. Upload a new license or reconfigure the VM. I want to get just trial license.I checked following past post. But it does not solve the issue. I also contacted support, they requested me to post my issue in this community site.https://community.fortinet.com/t5/Support-Forum/Requesting-Forticare-Trial-license-proxy-null/td-p/357387Can somebody help to get a trial license?My serial number is FFVMEVWJXNQCX3FE.

Hi I have a weird behavior and can't find the reason.I have FGT 300E and FAPs 432FR and even if AP got IP address and all wireless controller settings are ok, FortiGate not showing FAP in GUI. If I add it manually then after few sec is onlineThe same with 432G on 200E. ( FAP os 7.6.2)On both devices FortiOS is 7.2.10. I made sniffer and I see 59.674415 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37561.565662 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37562.195526 199_MGMT -- 10.24.64.29.15246 -> 10.24.64.1.5246: udp 37572.230574 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37575.612002 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37578.233103 199_MGMT -- 10.24.64.29.15246 -> 224.0.1.140.5246: udp 37580.253982 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246: udp 37583.655548 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246: udp 37586.236722 199_MGMT -- 10.24.64.29.15246 -> 255.255.255.255.5246:

We recently upgraded our Comcast coax server to their fiber service. We are paying for a 2gig connection. They terminate their side of things to a Ciena 3924 and provide a fiber SFP handoff for us to connect. We have FortiGate 60F's deployed currently at our various sites. So it runs from the Ciena to a 10G media converter, to Cat6A to the FortiGate WAN2 port. Our 3rd party tech support provider copied the config from WAN1 (the coax) to WAN2. When we run speedtests on the new connection our 2gig service drops to 4Mbps. One person on-site said they tested as low as 0.19Mbps. Comcast has verified 2gig to their demarc. I have replaced the fiber, media converter, and ethernet cables. We purchased a ethernet SFP module to replace Comcast's fiber SFP, however that SFP module was only a 1gig and Comcast said because we are paying for 2gig, the config won't let them downgrade the connection. We are not able to figure out what is going on with this. Does anybody have any ideas?

Hi, since I've recently acquired a 10G fiber home connection. I'm kicking around an idea of how to go about getting the most out of the connection.If I recalled correctly, its possible to define any interface to perform any roles. Is that still correct?I'm thinking of getting a 90F, and refining WAN2 as the primary LAN interface, and not use the 1GE ports at all or just redefine it as DMZ. Also, throw in dumb 10GE switch behind LAN (WAN2) that so my primary / higher priority computers and devices they would benefit from maximum available speed https://9apps.ooo/ .Does this configuration seem reasonable and possible?Preemptively thank you for the inputs

i have server in my network and i have make virtual ip to access server from outdoor network with static ip and from indoor network with internal ip and it work fine  how can i access server from internal network with static ip

we're trying to do RMA and when i access the ADOM and navigate to Managed Fortigate (1) tab in device&groups section the page appears blank.   

I have two Fortiweb VMs running on Hyper-V, configured in HA mode. I no longer have acess to the local admin account. I can only log in to the primary VM using a regular RADIUS-based user account.Could you please advice on how to recover or regain admin acess in this situation ?

Hi there, is there a roadmap for supporting FortiEDR under macOS tahoe?We are currently using a 6.0.1.1022 version on macOS 15 but want to go forward to 26. Are there any plans on supporting it any time?Best regards

Hello everyone, I need help creating a site-to-site VPN on Oracle Cloud Infra (OCI), I'm having several problems and difficulties, can anyone help me??

GreetingsWe start FORTISASE v25.3.139Trying to connect the on premise AD with Fortisase ** Access & Authentication >> Domain >> Create >> Active Directory AD connection  Server Address Must by Public IP, and enter credentialsit it secure to make VIP and enter the credentials, or there is another way thanksNader

Hello there,maybe some of you already experienced this issue and help me out.We have a FortiGate on Version 7.4.8 and want to use ZTNA Tags trough SSL-VPN to allow access to specific ressources.The Tags get assigned to the endpoints and under GUI Policy&Objects -> ZTNA -> Tags the endpoint is listed under the tag with the correct SSL-VPN Tunnel IP, but using "diag firewall dynamic list" the IP is not listed anywhere.This of course leads to the User not using the right policies.diagnose test application fcnacd 2 and diagnose test application fcnacd 5 do not change anything, diagnose endpoint fctems test-connectivity is fine as well.I already rebuilt the connector and we just updated the EMS to 7.4.4 (It did not work in 7.4.3 as well).I don't know what else to try, the support is looking at it as well but could not find anything yet.Any help would be appreciated!

Hi everyone,I’m using **FortiWeb 600F (reverse proxy mode)** and need to implement **request rate limiting based on a custom HTTP header**, not on the client IP.Limit requests to specific endpoints:/order/buy/order/sellEach request includes a header `x-user-trace`, which identifies the user.I want FortiWeb to **allow only one request per 300 milliseconds per unique `x-user-trace` value.**If the same user (same header value) sends another request within 300 ms, it should be **blocked or responded with HTTP 429 (Too Many Requests).**if request.path in ["/order/buy", "/order/sell"]:if "x-user-trace" in request.headers:key = request.headers["x-user-trace"]allow 1 request / 300 ms per keyelse:block or respond with 4291. Can FortiWeb natively perform rate limiting using a **custom header** (like `x-user-trace`) instead of the client IP?* I know that **DoS Protection**, **Bot Mitigation**, and **Rate Limiting** features exist, but they appear to use **source IP** as the identifier.2. Is there

Olá pessoal, estou fazendo uma pós em redes e cibersegurança que envolve muito o fortigate e cisco. Queria ideia de labs e cenários para implementar no eve-ng, um cenário que possa envolver principalmente FSSO, IPSEC e SD-WAN, pois são temas que precisam ficar muito claros para que eu possa ter sucesso na minha certificação NSE4. Teriam ideia de cenários reais que eu possa estar implementando para praticar? se for cenários que vocês mesmos já implementaram na vida real seria melhor ainda. Topologias e diagramas também são bem vindos hehe.