Support Forum

Description:Hello everyone,I’m facing a strange issue with our FortiGate 30E (firmware version 6.2.16). One of our internal staff networks uses a DHCP relay configuration. The relay forwards DHCP requests to a central DHCP server, from which devices such as computers and phones receive their IP addresses.Today we encountered a problem where some iOS devices (iPhone and iPad) couldn’t connect to the network via DHCP.Here’s what we observed:Not working:iOS 18.7.1iOS 18.6.2Working fine:iOS 18.3.2iOS 18.5iOS 26.01It seems that only newer iOS versions are failing to obtain an IP address through DHCP relay.Below is the configuration of the DHCP relay on the FortiGate interface:set dhcp-relay-ip "10.148.102.102"set dhcp-relay-type regularset dhcp-relay-agent-option enableset mtu-override disableset wccp disableset drop-overlapped-fragment disableset drop-fragment disableset interface "lan"set vlanid 79Has anyone experienced a similar issue where newer iOS versions fail to obtain an IP address

How does the FortiGate VM handle license renewal in an HA (Active-Passive) setup?We authenticate the license via FortiManager in a KVM air-gapped environment.During initial setup, licenses were authenticated separately for each node, but I am curious about how license renewal works after configuring HA.My concern is whether there might be cases where, when the mastership switches from node A to P, the license renewal might fail, causing the firewall to stop functioning. The master device communicates with FortiManager to check and retrieve the license, but the slave device does not have this information, so it seems like it would not be able to renew the license.The reason I think this way is based on the information in the link below.community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-upgrade-FortiGate-VM-license/ta-p/197483Additionally, the version is 7.4.7Thank you very much for your attention and support. I look forward to your advice.Best regards,

Hello guys,I'm working on a Forticlient EMS system.In the last year I noticed that some sites deny the user access.I explain myself: sometimes the cloudflare captcha denies (the image above is just an example from internet) the user access to the websites (ChatGpt is one of them).Now, the same is appening with the onesignal.com site:on the EMS I have a web filtering profile with deep inspection enabled:now, If I am not mistaken, the deep inspection makes forticlient decrypting and re-encrypting the traffic with its own certificate. I believe that this is causing the issue, but please correct me if I'm wrong.I also added the onesignal.com site to the exemption from the web filtering, but the issue is the same.Is anybody of you experiencing the sam issue? Any idea to solve it?Thank you for your support. 

Dear Experts, At SD-WAN configuration, when manual mode is used, is "set priority-members" of "config service" stronger than "set priority" of "config members"?I tried several values and it seems to be such thing.Also, how should we use the both, including use of other modes? Thanks in advance, 

 Dear All any guide configuration for this topology thx

Hello Experts, I have an issue about site-to-site SD-WAN. Here is the situation.There are 2 ipsec tunnels between 2 Fortigates.One tunnel (called as X) is a simple ipsec tunnel.The other (called as Y) is a ipsec aggregation tunnel which has 3 ipsec tunnels (Y1, Y2, Y3)FG1 -- X ------- Network_A ------- X -- FG2    -- Y - Y1 -- Network_B -- Y1 - Y --         - Y2 -- Network_C -- Y2 -         = Y3 -- Network_D -- Y3 -(I hope you understand the above configuration.) When all Network_A,B,C,D belong to normal network, everything is ok.(Both X and Y are seen as green in SD-WAN performance SLA). However, when Network_B,C,D belongs to slow network such as satellite,Only X is OK (alive). Y is not alive as SD-WAN, although all ipsec tunnels (Y1, Y2, Y3)and aggregated Y are established as vpn tunnel.(Y is seen as red  in SD-WAN performance SLA, however all are seen as green in VPN page.) In this case of slow netw

Hey everyone,Is anyone else getting this message when trying to launch a self-paced lab?“The Training Institute Lab platform is experiencing an unplanned outage affecting self-paced lab provisioning. Please try again later.”I’ve been trying for a while, but it still shows the same message.Is this a known issue or maintenance? Any update on when it’ll be fixed?Thanks!

We have recently enabled 100G links on our FortiGate firewalls towards non-Fortinet devices. As we require to leverage existing OM3/OM4 LC Duplex cabling, the FN-TRAN-QSFP28-BIDI optic was chosen on the FortiGates. The other end is a Juniper QFX5120-48Y switch with the JNP-QSFP-100G-BXSR optic. Both optics are 100GBase-BXSR (sometimes called 100GBase-SR-BiDi) and thus should be able to communicate with eachother. However, with system default configurations, the link will not come up. Both ends will report good light levels but no active link. There were no clear indicators why the link remained down even though light was good. After fiddling around with various settings, with some interesting results, I have found that we need to explicitly disable FEC on the interface on the FortiGate (enabled by default). In the end, it resulted in the following settings for the 100G port on the FortiGate for the link to come up:config system interface edit "por

Dear community, I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).I am using this msi setup command line:msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered. This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.Thanks for any advices. 

ince FortiOS going to obsolete SSLVPN from 7.6 onward,InformationDitch away the idea user group, it unable support user grouping like SSL VPN did.FSSO is a must for user grouping except local database, but FSSO has some restrictionFSSO deploy with DC agent mode for better performancePlease test with your own mobile data, example I connect my office wifi and the office WAN IP is use to peer with DC via IPSec, when test this remote access I always matched with the office IPSec profile.If you have multiple IPSec dailup profile, it could be matched to other IPsec profile that contain same phase-1 variable, especially the NAT-T option. Example, your Remote Access profile name F, FortiGate will try match the proposed variable from top to bottom (Profile A-F), let say the proposed proposal profile match variable at Profile C, firewall will take the NAT-T value at Profile C and negotiated based on it, but your remote user Profile F is without NAT-T but FortiGate will keep communicate with NAT-

Hi All, We have an ISP providing us layer 2 to several sites via a QinQ tunnel. I have seen having an ISP in between devices is not supported for a L2 FortiLink; however, several people have had success doing so. The issue is currently that FortiLink establishes for a small period of time if freshly factory reset and mgmt vlan settings are changed to 4094. This will establish the link, then FortiGate sends configs. After a while the CAPWAP tunnel goes down and the switch never comes back online. FortiNet support mentioned this could be an STP issue, though they weren't willing to further investigate as the ISP devices may be playing a role. I confirmed via packet capture the only STP packets being received are that of the upstream FortiSwitch.  Any insight to how these setups are working, or configuration that assist this would be helpful! We are very close with the ISP, and they are always willing to work with us, so any insight to what they might be able to d

Hello Fortinet community, I am experiencing an issue with LDAP user authentication failing on one Aruba switch using FortiAuthenticator as the RADIUS server. The admin local password login to the switch works fine, but LDAP users fail with the error logged on FortiAuthenticator: "remote LDAP administrators authentication with no token failed: invalid password" Notably, the same LDAP users authenticate successfully on other Aruba switches with the exact same FortiAuthenticator and LDAP policy configuration. What I have checked/tried so far: Verified RADIUS shared secret matches exactly on switch and FortiAuthenticator. Confirmed LDAP users and groups are correct and working on other devices. Compared Aruba switch configuration with working switches — config is identical. Confirmed no special RADIUS attributes are set in FortiAuthenticator policies since other devices work fine. Verified FortiAuthenticator can ping the problematic switch.&nbsp

I have a fleet of managed iPads that are older Air2s running iOS 15.8, and the recent update not only deleted all previous VPN configurations, it also no longer displays the login screen with the new configs. All of my other iPads are able to connect, it's just these older ones that cannot. It appears that it's trying to use SSO, even though that is deselected in the config. When they try to connect, this window appearsBut tapping on OK results in this window:They are never offered the regular login window to enter their username and password.I have submitted a ticket but have yet to get a response, so thought I'd ask here ot see if anyone else is experiencing the same.

Hello everyone, I tried to exempt an DDNS FQDN, but it still gets blocked by the FortiGate.SSL-Log:SSL connection is blocked, certificate-status: expired untrusted I tried with an Address FQDN object and also via this method https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-Exemption-based-on-FQDN-in-Proxy-based/ta-p/387569 . The connection to the FQDN still gets blocked. I also have to add we are using a different HTTPS port to reach the address (3438) and yes the remote certificate is expired since it came with the device.

Does anyone know if FortiNAC(-F) will ever support MPSK?

Hi All, As I know Internet connectivity required for fortiswitch and fortiAP to get the license register with fortinet support. Can I give one time internet access to switch and AP and later on remove post getting registered?

Hello FortiNet, We have found an error when calling the FortiClient API.Basically the problem is when we use the FortiClient API and the tunnel(the name of the VPN in FortiClient config) has a space in it for example "IPSec Test" it won't start the vpn when we call "vpnManager.Connect("tunnel name");

Good day I am trying to install Forticlient on Microsoft Surface Laptop 7 (ARM64 processor) and I am getting FortiClient VPN Setup Wizard ended prematurely error message. I have used ARM64 installer. May someone please advise how to resolve it

Hello, I'm a bit newbie in Forti environment, but I'm trying to rename the appliance name with the "Device Name" entered in FortiManager:     I thought about CLI:config system global    set hostname ${Hostname}endbut for sure ${Hostname} is unknown   I thought about TCL:#!puts [exec_ondb "/adom/FortiProxy/device/." "config system global    set hostname XXXend" "# "]But with what replace XXX ? Maybe there is another easy solution? Thanks in advance

Hi, we would like to protect our web service with WAF profile but activating WAF in the policy we get a webfilter violation error message and we can only activate withou SSL inspection which makes no sense.  Than we tried to import our wildcard certificate as local certifcate to use in SSL/ SSH Inspection just to find out that without a CA certificate we cant use it for our policy.  Any suggestions how we can get WAF profile running in proxy mode for our VIP? Thanks!

I'm having difficulty blocking the sending and receiving of files on WhatsApp by extension such as .pdv, .doc and .xlsx

I was trying to establish a VPN IPSec tunnel against a Cisco Meraki MX90.We are using FortiOS 7.2.11Config matched on both sides.P1IKEv1 - AES256-SHA256 DH14P2AES256-SHA256 DH14Both P1 and P2 were up, although, P2 was flapping sometimes.No packets going through.Found this in the logs:Invalid ESP packet detected (payload not aligned)After a Google search - Solved: Invalid ESP packet detected (payload not aligned). - Fortinet CommunityWhen P2 was changed to SHA1 we were able to establish connectivity.Does anyone know why does this happen?

https://www.avfirewalls.com/FortiSwitch-124D.aspI see there "limited lifetime warranty" QUESTIONS: 1. is that means if faulty, I'll get replacement if the hardware still available2. is that global warranty or local warranty only, because I was asking Fortinet Indonesia guy, he doesn't know FortiSwitch has "Limited Lifetime Warranty" 3. if I bought from eBay and bring to Indonesia. Can I transfer ownership? tq

I have three static routes to reaching my bgp Neighbour via ipsec tunnel by using ike/32 injection with same AD,metric and priority how fortigate will select the best path for bgp control plane message.@Jean-Philippe_P @msingh_FTNT @Anthony_E 

Newbie question here, I'm working in an MSP, and one of our clients Fortigate FW license expired which caused web browsing to be blocked. I've look into this and was able to get things working before we renewed the license. Our team is planning to give recommendations on purchasing a similar fortigate appliance with identical license but with different expiry dates. I just want to be sure if this will work, if the primary FW loses its subscription will the 2nd device take over if the subscription on it are still active?