Support Forum

Hi, I just changed from SSL VPN to IPSec with for all remote users and now they tell me that one host on Linux had no problem before with SSL VPN (I dont know how he did it - it is an external user) and now with IPSec it is not working. I dont know if he uses the Linux Forticlient but I sent him all the info of the setup and it is not working. Since I dont have any experience with remote access via Linux Forticlient (I dont even know if it works) and since we aperently cant setup up a IPSec with the other site (it has to be remote) I am not sure what I can do. My setup was for Forticlient and he asked me if I can do it as Cisco Client but I dont want to change all my setup and all my access rules....but maybe this is the easiest way, just to set up a new remote IPSec with Cisco and if his sides works. Any ideas or suggestions? Thanks 

Hi everyone, I want to design a setup that uses two FortiGate firewalls for around 200 users.One device will work as the edge & Fabric root firewall for VPN, DPI, etc.The second device will act as an internal firewall for segmentation, VLAN routing, and inter-VLAN policies.My questions are:What is the recommended deployment mode for this setup? Am I going in the right direction with this topology?Is there any official Fortinet documentation or example for this design?In the next phase, I’m planning to use two devices in an HA setup. Does that make sense?Finally, I’m considering the FG-121G (Edge) and FG-91G (Internal) models — are these suitable?

Dear All, I have an issue with the following product we are having:We have an FG200F where I want to forward user-generated traffic to two different locations for  analysis and reporting. As you all know we can only configure one syslog server on the FG200F using the GUI so the only solution is possibly the CLI, now I know and found the commands to enable syslog and setup the syslog server IP Address and port numer. But I am not sure how to use the CLI to enable it to forward user-generated traffic. Can you all help me on how to configure two different syslog server IP Addresses with different port numbers using the CLI.Thank you all. Looking forward to hearing from you soon.

I am trying to determine the best design for VDOMs in a FortiGate that will be used to connect to multiple different customer sites via IPsec tunnels.  Customers must be isolated from each other and I have more customers than the max 10 vdom limit, so a dedicated vdom for each customer is not an option.  My plan is to have:root vdom (Global shell)mgmt-vdom (Fortigate mgmt functions and administration - type "Admin" vdom - has internet access via traffic-vdom)traffic-vdom (has wan interface, function is to provide other vdoms wan/internet access)customers-vdom (customers shared vdom, vpn tunnels for each customer)vendor-vdom (third-party vendor for monitoring customer sites and providing access to vendors cloud applications - vpn tunnel to vendors cloud) No LAN resources for customers, I am only handling traffic from customers to vendor via the IPsec tunnels.What is the best and most secure way to configure vdoms and IPsec tunnels.Inter vdom links from other vdoms to traf

 I am following the guide below to configure gmail as my email server in Fortianalyser.I am using this command to test the connection :  diag test connection mailserver gmail <simonhenderson611@gmail.com> <sihenderson@hotmail.com> It seems to be connecting to the mail server ok but fails later in the process, here are my results below : I would appreciate any help towards getting this working.Thanks Simon https://community.fortinet.com/t5/FortiManager/Technical-Tip-Configuring-FortiManager-and-FortiAnalyzer-to-use/ta-p/213771  diag test connection mailserver gmail <simonhenderson611@gmail.com> <sihenderson@hotmail.com>Testing SMTP server gmail, please wait...* Host smtp.gmail.com:587 was resolved.* IPv6: 2a00:1450:400c:c04::6c* IPv4: 74.125.206.108*   Trying 74.125.206.108:587...* Connected to smtp.gmail.com (74.125.206.108) port 587< 220 smtp.gmail.com ESMTP 5b1f17b1804b1-4710f29da7fsm17475225e9.9 - gsmtp>

Simple question.  Should I be concerned that one FortiGate 101F consistently runs at 60% - 75% memory used, while a like 101F with a significantly larger network and hardware load uses 25% - 35% of memory on a daily average.Both 101s share the same OS version, internal hardware configuration, and basic firewall and SD-WAN configurations.  They differ in that the high-memory use 101 has three 4- port FortiSwitches serviced by FortiLink, roughly 14,000 entries in the routing table, and roughly 500 sessions.  The 101 using less memory hosts 10 48-port FortiSwitches, a 21,000 entry routing table, and roughly 4500 sessions.Neither 101 exhibits anomalous behavior at the moment.  Still, I wonder if I should expect trouble in the future.Thanks.

Frequently, legit emails will get caught in greylist or quarantine where the Header From address shows the actual organization (for example, no_reply@standard.com) but the From address is something like 01020199df60110e-adad6878-1234-4d5f-9b1c-1d93aa94033a-000000@eu-west-1.amazonses.com. Typically, when an email gets quarantined due to 'Sender Alignment' I would add their email domain to a whitelist that is attached to one of my Recipient Policies that bypasses SPF Sender Alignment. However when the sender uses a service such as amazonses or sendgrid, where the header-from and the header don't match, whitelisting won't work since I assume the whitelist is using from (vs header from). How can I ensure these emails get delivered successfully without opening up all of Amazon SES or sendgrid? Is there a way to create an exception list for trusted DKIM domains? Or can you advise on a better way to handle this? I don't see any other posts abo

Since we migrated to Fortinet and SSL-VPN with FortiClient last year, we have had an increasing number of issues with the client leaving DNS registration disabled on wired and wireless interfaces after a user disconnects from VPN.  The "no_dns_registration" option is set to 2 in the configuration, and it successfully disables registration for the local adapter(s) while connected and restores the setting after disconnecting the majority of the time.   However, we find at least one user weekly whose computer still has a VPN IP address in AD DNS even though they are in the office.   FortiClient version is 7.4.3 (VPN only).    The Advanced TCP/IP Settings window on their network adapter shows that DNS registration is disabled: I thought it may be related to users closing their laptops while connected to VPN or otherwise not disconnecting cleanly, but thus far I have been unable to reproduce it on demand.   Is anyone else experienc

Hi everyone,I’m planning to upgrade a FortiGate 101F currently running FortiOS 7.0.8 to a newer 7.x version (likely 7.2 or 7.4).My client is a bit concerned about the BGP stability after the upgrade, since the FortiGate is currently handling BGP routing.Before proceeding, I’d like to ask if anyone has already performed this specific upgrade and could share their experience;Any issues encountered with BGP sessions, neighbors, or route redistribution after the upgrade.Whether you recommend going straight to 7.4.x or stopping at 7.2.x for now.Any insights, tips, or best practices would be greatly appreciatedThanks in advance for sharing your experience!

Hello, I have a specific deployement scenerio in my hand. My customer has a closed circuit production plant. There are handfull of PCs and a lot of cameras, industrial devices, industrial printers...etc. I have no problems with enviromental devices. The problem is this plant has limited internet connection and does not use LDAP. PCs are joined to a domain and configured in HQ. Then send to this plant. My question is: Can I use agent without LDAP integration for doing basic scans for applications and viruswall? Since there are no LDAP, I am thinking of using self signed certificates and trust them manually from client agents. But I still need to login to the agents, which I won't be able to match to an LDAP. I did some researchs, I have some ideas but I was not able to come up with a viable solution. If you guys can steer me to a right direction I will be glad.  thanks in advance.#fortinac

Hello everyone,My certification is set to expire in July 2025, and I noticed that the Fortinet Certification Program will be updated starting October 15, 2025.I’m currently preparing to take the FortiManager exam to earn the FCP title, but I’d like to clarify whether, with this upcoming change, I’ll still be able to renew my current certification by completing the FCP exam, or if a new process or requirement will apply.Thank you in advance for your help and clarification.Best regards,

I'm working with a FortiGate running version 7.4.9. The current setup has a single subnet between the FortiGate and our on-prem router. However, behind that router, there are many VLANs and subnets on the LAN. I’d like to move DHCP services for those internal VLANs to the FortiGate, but the FortiGate doesn’t currently have Vlan interfaces or routes for those downstream subnets. What’s the best way to configure DHCP on the FortiGate in this scenario?Or is there a way for the FortiGate to serve DHCP to those VLANs without having direct interfaces in each subnet?I have the DHCP Helper disabled but already setup. How do you Name the DHCP Vlans?   I also didn't see a way to name the scopes?  Thanks in advance for any guidance!FortiGate  

I am new to Fortinet / Fortigate and come from a Cisco background.  I am considering swapping a Cisco firewall with a Fortigate firewall, however, there is 1 big roadblock stopping me from doing so. The Cisco firewall in question has a relatively complex set of VPN tunnels that tunnel only to a list of specific IP addresses.  This is essentially to allow a more secure configuration of only allowing a single IP to access certain services across a national footprint from several small offices that only have dynamic IP internet services.  Rather than have X user per site all need to use a VPN client to individually to tunnel to the specific destinations, permanent tunnels are in place at each location that tunnels only traffic to the "protected" services for ease of access.  Each office also has a slightly different list of IPs it can access. On the cisco I basically have 4 different object-groups each with the correct list of IPs in them.  Where Fortine

Hi everyone,I want to set up ipsec with FortiClient as dialup client (as mentioned here: https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/785501/forticlient-as-dialup-client).  Since ipsec seems to have way more options than ssl vpn - if I go trough the IPsec Wizard for remote access. Are these default settings ok (safe) to use?

I have Setup FSSO Collector Agent to be radius accounting server so that it monitors FSSO users and Radius Wifi users , NPS Server forward accounting requests to the FSSO but i have two problems with this setup:1- The FSSO Agent receives accounting stop messages ( confirmed through debug log) but it doesnt remove the user from login users list and neither tells fortigate to remove users 

it happened after a windows update i think im not sure about it i tried unistalling the updates but its still not working what can be the issue? 

Hi,We have multiple traffic shapers and shaping policies configured, each with the same value set for both the guaranteed and maximum bandwidth. These policies are applied based on source networks and are linked to shaping policies (not directly to security policies).The issue we’re encountering is that during testing, we are not seeing traffic reach the guaranteed bandwidth levels — even when the network is idle. We’re not getting close to the configured guaranteed/max bandwidth, and end-users are reporting slow performance.Currently, we do not have any bandwidth defined on the outbound interfaces, and from what I understand, this might be a contributing factor. My question is:Without defining outbound bandwidth on the interface, how does the firewall know when to enforce traffic shaping policies (e.g., to throttle down to guarantee bandwidth when the interface is congested, or to allow bursting when there’s capacity)?Is shaping applied based only on each individual shaping policy, or

Hi, we are changing from SSL VPN to IPsec since our FG90G doesnt support in the next OS the SSl VPN. Right now we are testing with the IT department and I got feedback that the client closes the connection after x minutes, something that with SSL VPN never happened before. We are using unlicensed FortiClient, I dont know if we have option on the client with ALWAYS UP. Is there something we can change on the Remote IPSec configuration on the FG90, maybe Dead Peer Detection? We set it up with the wizzard. Thanks! 

Hello folks, Anyone can explain me what is going on and how to fix this pls!? I just connected 2 separate sites to Fortisase using Secure Private Access.BGP to Forti PoPs are established but the sites are not exchanging routes.Shouldn't the 2 sites reach each other through Forticloud? This is what i'm used to in Velo Cloud and Cato.I only have 2 sites, head office in Europe and another site in the USA. RegardsSaid

Hello Team,    I wanted to know if i have configured my fortigate firewall with source user accounts of user1, user2 and user3, and ip addr1, and ip addr2,and mac addr1, mac addr2, and mac addr3.How firewall will process the source match logic according to the source objects and type mentioned above User accounts, IP addresses, and mac addresses?TIA

I recently upgraded my computer to Windows 11 and since then my VPN has not worked. I uninstalled the previous version and upgraded to the latest, to no avail.I see it trying the connection on the Fortigate, but that's it. Below is the client log.11/26/2022 9:31:00 PM info ipsecvpn date=2022-11-26 time=21:30:59 logver=1 id=96566 type=securityevent subtype=ipsecvpn eventtype=status level=info uid=473E35B610DE464ABDxx5E9F5149E34C devid=FCT8003212200810 hostname=XXXXX pcdomain=N/A deviceip=192.168.0.41 devicemac=b0-XX-7a-72-XX-XX site=N/A fctver=7.0.7.0345 fgtserial=FCT8003212200810 emsserial=N/A os="Microsoft Windows 11 Professional Edition, 64-bit (build 22621)" user=Bryan msg="loc_ip=192.168.0.41 loc_port=500 rem_ip=00.000.00.165 rem_port=500 out_if=0 vpn_tunnel=REPLACED action=negotiate init=local mode=aggressive stage=1 dir=outbound status=success Initiator: sent 00.000.160.165 aggressive mode message #1 (OK)" vpntunnel=REPLACED11/26/2022 9:31:12 PM warning ipsecvpn date=2022-11

From the debug, we can see that there is no problem with the time on both sides. 

Hi, On PSIRT i have now seen a few posts now where the solution for a CVE is to update to FortiOs 7.2.12.For example: https://fortiguard.fortinet.com/psirt/FG-IR-25-026But version 7.2.12 does not exist. Or am i confused?  BR,Arnold 

hello everybody: I installed a virtual machine on my computer (Oracle Virtual Box) to run behavior tests on my network. I noticed that even though it's not loaded, it browses normally. I'd like to know how to prevent any machine running in a virtual machine from browsing. I've tried to detect the virtual machine by MAC or IP, but I can't. How can I block virtual machines? I searched the security profiles and only found VMware. Can you give me some ideas on what to do?Thank you very much.

Hi everyone, Looking for help with a strange API authentication issue on one specific FortiGate. Setup:25 FortiGate firewalls managed via automated backup scriptUsing API v2 endpoint: /api/v2/monitor/system/config/backup?scope=globalSame API user (BACKUP-SUPER_ADMIN) configured on all devicesProblem: One firewall (let's call it FW-TEST) consistently returns HTTP 401 Unauthorized, while the exact same script works perfectly on the other 24 devices. What I've tried:Regenerated API token multiple timesVerified user permissions (identical to working firewalls)Manual test with Postman: same 401 errorGUI login with same account: works fineCompared API settings between working and non-working FW: no differences foundQuestion: Has anyone encountered a situation where one FortiGate rejects API authentication while others with identical config work fine? Could there be hidden settings or firmware-specific quirks that affect API token validation? Using FortiOS version if you k